Via email: cpvp-opcconsultation1@priv.gc.ca
Privacy Commissioner of Canada Philippe Dufresne
Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
Dear Commissioner Dufresne:
Re: Call for Comments – Consultation on OPC Guidance Processes
I am writing on behalf of the Privacy and Access Law Section of the Canadian Bar Association (CBA Section) in response to the Office of the Privacy Commissioner (OPC’s) Consultation on OPC Guidance Processes. We write to express our support for the guidance issued by the OPC and its process.
The CBA is a national association of 40,000 lawyers, Québec notaries, law teachers and students, with a mandate to promote improvements in the law and the administration of justice. The CBA Section comprises lawyers with an in-depth knowledge of privacy and access law.
Consultation Items
- OPC engagement with businesses, groups, and individuals
- Forms of consultation
- Consultation timing
- Draft OPC consultation policy
- Awareness of OPC consultations
- Presentation, contents, and utility of PIPEDA guidance
- Format and organization
- Guidance topics
- Clarity and utility
We want to express our support for the guidance issued by the OPC and its process. These resources serve as a vital touchstone for legal professionals, stakeholders, and businesses, providing the clarity needed to ensure compliance with industry best practices. The guidance produced by the OPC is highly valued for its expertise and practical utility. As the regulatory and technical landscape continues to evolve, maintaining the availability of these documents is essential for consistent implementation by organizations and public understanding.
Improved Integration of Other Resources
The guidance should clearly connect and integrate all relevant OPC resources, including prior findings, decisions, and interpretations, so that organizations can understand how principles are applied in real contexts. To enhance its practical value, the guidance should provide concrete case-based examples and scenarios—not only broad principles—to help organizations operationalize their obligations.
Accessibility of Previous Versions
We would like to emphasize the importance of establishing a robust archiving system for previous versions of the guidance. While it is necessary to prioritize the most current standards, the historical versions remain critical for several reasons including:
- They provide essential context for projects or actions initiated under prior regulatory frameworks.
- They serve as a necessary reference for legal and compliance audits involving past activities.
We encourage the OPC to ensure that, as new updates are released; older versions are not simply removed but are moved to a dedicated, easily accessible archive on your website.
Disclaimer Statements, Obligations and Recommendations
The disclaimer statements accompanying the guidance may make them seem less reliable or suggest that their content requires extra caution. To keep the guidance credible and ensure they are used as intended by organizations, they must be sufficiently clear, practical, and comprehensive to enable businesses to rely on them with confidence. This will reinforce the guidance’s reliability and show the organization’s commitment to the standards and safeguards needed for effective implementation. Furthermore, in keeping with recent OPC practice, guidance should clearly distinguish between legal obligations (e.g., by indicating what activities an organization must or must not undertake) and what the OPC views as best practice (e.g., activities an organization should undertake).
New Guidance
In circumstances where newly issued guidance may conflict with, supersede, or otherwise alter the interpretation of existing guidance, we highly recommend that a consultation be undertaken. Such consultation ensures that stakeholders are fully informed of the potential implications, have the opportunity to raise concerns, and can contribute to the conversation and a coherent transition. Establishing this dialogue not only mitigates uncertainty and operational risk but also reinforces transparency, accountability, and trust in the OPC’s guidance and engagement processes.
Additional Tailored Consultations
Organizations that implement the recommended guidance and follow tailored advice provided by the OPC’s Business Advisory should be treated as having met their due diligence responsibilities. Instances where an organization has adhered to this guidance in good faith and where it is still found to be non-compliant should be viewed as opportunities to update guidance, potentially with the organization and/or industry’s input, with a view toward promoting future compliance. In such cases, steps should be taken to ensure the organization’s reputation is not harmed, such as by seeking its consent before naming the organization in a related Report of Findings.
The development of this guidance should involve meaningful consultation with sectorial/expert stakeholders, including organizations that regularly confront these issues and individuals and communities directly affected by them. We recommend that stakeholder groups such as the CBA and other sectoral bodies be given notice and the opportunity to provide input as part of a transparent, timely and optimal process.
Conclusion
In conclusion, the CBA Section appreciates the opportunity to provide comments on the OPC’s Consultation on Guidance Processes. We strongly support the OPC’s continued commitment to transparency, collaboration, and clarity in developing and maintaining its guidance materials. By ensuring these documents remain accessible, practical, and reflective of stakeholder input, the OPC will foster greater regulatory certainty and promote the consistent, fair, and effective application of privacy laws across Canada. We would welcome continued engagement and remain available to participate in future consultations or working groups that support these objectives.
Yours truly,
(original letter signed by Julie Terrien for Christiane Saad)
Christiane Saad
Chair, Privacy and Access Law Section