From Vision to Impact: Five Years of Privacy and Transparency in a Digital Ontario
2024 Annual Report
Commissioner's message
As I reflect on my first term as Ontario's Information and Privacy Commissioner, I am reminded of the challenging start to my mandate. Five years ago, the world was in a highly precarious situation. We were just at the beginning of a global pandemic that brought with it unprecedented challenges. Ontarians turned to us for guidance on how to navigate the heightened privacy risks associated with the new virtual world they were thrust into from one day to the next. We saw increased citizen demand for access to trustworthy information they could rely on in an otherwise dizzying world of misinformation.
The pandemic also forced us, as an organization, to change how we think and work, as we adapted to a new social reality that was shifting beneath our feet. To help build resiliency through times of uncertainty, I set out a vision of a modern and effective regulator with real-world impact. Since then, our work has focused on achieving positive outcomes from the perspective of Ontarians to ensure that privacy protection and access to information are not abstract ideals, but tangible rights that strengthen the public’s trust in their institutions.
Our mission over the past five years has been to help strengthen a foundation of public trust by enhancing Ontarians' confidence that their privacy and access rights will be respected."
- Patricia Kosseim, Information and Privacy Commissioner of Ontario
Privacy and transparency in a modern government
IPC goal: to advance Ontarians’ privacy and access rights by working with public institutions to develop bedrock principles and comprehensive governance frameworks for the responsible and accountable deployment of digital technologies.
"The successful adoption of AI tools by public institutions can only be achieved with the public’s trust that these tools are being effectively governed. To gain that trust, we must ensure they are being used in a safe, privacy-protective, and ethically responsible manner, with fair outcomes and benefits for all Ontarians."
Transparency Showcase 2.0
"Transparency and access to government-held information is about empowerment. It equips people with the information they need to participate meaningfully in the democratic process, engage in constructive discourse, and hold their governments accountable. It’s the bedrock that democracy is built on, inspiring public trust and providing trustworthy, evidence-based information to shape policies, programs, and services to improve the lives of Ontarians."
Children and Youth in a Digital World
IPC Goal: to champion the access and privacy rights of Ontario’s children and youth by promoting their digital literacy and the expansion of their digital rights while holding institutions accountable for protecting the children and youth they serve.
Advancing digital literacy: Ontario's new curriculum promotes privacy skills
For years, the IPC has advocated for stronger privacy education for children. In 2024, we were delighted to see Ontario launch its revised Elementary Language Curriculum (grades 1-8), which prominently features the promotion of privacy skills. The curriculum introduces a new focus on digital literacy, digital citizenship, and online safety. These learning objectives directly align with the IPC’s Privacy Pursuit! lesson plans for grades 2-8 we launched last year, as well as our Digital Privacy Charter for Ontario Schools. They are also entirely consistent with the Global Privacy Assembly’s Personal Data Competency Framework for Students, co-sponsored by the IPC back in 2016.
Empowering children with the knowledge and skills they need to understand and navigate the online world helps them exercise their privacy rights and make informed, thoughtful decisions about what personal information they wish to share, and with whom. But we cannot download all responsibility on their small shoulders alone. It is incumbent on us, as governments, regulators, schools and educators, to protect them and their personal information online from the forces they cannot see or control."
Digital Privacy Charter for Ontario Schools
On Digital Citizen Day, the IPC released the Digital Privacy Charter for Ontario Schools, inviting schools and school boards to pledge their commitment to protecting students’ personal information while also empowering students to make informed privacy choices. The charter consists of twelve high-level commitments reflecting a “smart mix” of existing legal obligations, best practices and common sense, for educators to earn the confidence of the students, parents, and communities they serve.
Building future privacy leaders: IPC Youth Advisory Council
This year, the IPC’s Youth Advisory Council (YAC) helped develop our first ever Youth Ambassador Program, aimed at empowering young people to champion online privacy awareness by spreading the word about digital literacy and privacy rights among their peers. The YAC provided advice on a Youth Ambassador Toolkit, including a slide deck, speaking notes, handouts, a presenter’s guide, a train-the-trainer tip sheet, as well as social media resources – everything young leaders need to be effective privacy ambassadors.
Trust in Digital Health
IPC Goal: to promote confidence in the health care system by guiding custodians to respect the privacy and access rights of Ontarians and supporting the pioneering use of personal health information for research and analytics to the extent it serves the public good.
Advocacy for Protecting Health Privacy and Access Rights
In 2024, the IPC continued its advocacy to protect Ontarians' privacy and access rights in the evolving digital health landscape. Central to these efforts was our critique of Schedule 6 in the More Convenient Care Act, which proposed significant changes to PHIPA. The IPC raised concerns about the diminished rights to access personal health records, the risks posed by an overly complex and inconsistent privacy framework, and the extensive reliance on vague rulemaking for implementing Digital Health IDs.
Next-Generation Law Enforcement
IPC Goal: to contribute to building public trust in law enforcement by working with relevant partners to develop the necessary guardrails for the adoption of new technologies and community-based approaches that protect both public safety and Ontarians’ access and privacy rights.
Guardrails for Police Use of Investigative Genetic Genealogy in Ontario
In 2024, the IPC furthered its research and policy work on an emerging investigative tool called Investigative Genetic Genealogy (IGG). IGG involves collecting a DNA sample from a crime scene and comparing it against profiles in private sector DNA databases to search for partial family matches, using new, sophisticated genetic sequencing techniques. Then, using genealogical research and tactical surveillance methods, police begin to narrow down investigative leads in their search for possible suspects. Police are increasingly using IGG to solve serious crimes, but it also raises significant legal, privacy and ethical considerations. Building on insights from the IPC’s Privacy Futures Project in 2023, we engaged directly with interested parties to develop meaningful guidance that balances public safety with fundamental privacy and human rights.
The IPC strongly recommends that police services adopt these guardrails if using, or considering using, IGG as an investigative technique, in advance of any explicit legal authority and proper statutory controls in this novel area.”
IPC Goal: To resolve Ontarians’ appeals and complaints in a fair, timely, and meaningful manner by providing timely resolution to Ontarians’ access appeals and privacy complaints, issuing concise and plain language decisions, and supporting understanding of the law by publishing actionable guidance based on trends and lessons learned from individual cases. Some of these efforts are highlighted below.
Enhancements to tribunal efficiency and responsiveness
Over the past five years, the IPC has seen a 30 per cent increase in incoming files, rising from 2,768 in 2020 to a record high of 3,613 in 2024. Despite this significant growth in caseload, we have made substantial improvements in efficiency, ensuring that Ontarians receive timely resolutions to their privacy and access concerns.
In 2024, the IPC closed 3,084 files, marking the highest number of closures in IPC history. Of those, 2,719, or 88 per cent, were successfully resolved or dismissed through early resolution, expedited process or mediation, avoiding the need for lengthy adjudication. At the same time, we reduced the average time to resolve access appeals by 8 per cent, from 10.7 months in 2023 to 9.9 months in 2024. Average time to resolve privacy complaints saw an even greater drop in average processing time of 9 per cent, from 5.9 months to 5.4 months. We managed to reduce the backlog by more than 17 per cent from the beginning to the end of 2024.
A review of noteworthy cases
Over the past several years, Ontario organizations have become increasingly vulnerable to cyberattacks. According to the Canadian Internet Registration Authority’s 2024 Cybersecurity Survey, the risks of cyberattacks, particularly to municipalities, universities, schools and hospitals —or the MUSH sector — are on a rise. The survey found that 55 per cent of MUSH sector organizations had experienced a cyberattack in 2024, compared to 38 per cent in 2023. Of these attacks on MUSH sector organizations in 2024, 29 per cent were successful, compared to 22 per cent in 2023.
"Time and again, we see that good information governance means not only having privacy policies in place, but also training staff on how to implement them in practice and then doing the necessary follow-up to make sure the training is up-to-date and provided on a regular basis."
IPC in the courts: Judicial reviews and rulings in 2024
This year, the issue of individuals submitting multiple appeals or complaints to our tribunal led to important developments in our processes, including the adoption of a File Processing Limitation Policy. A 2024 Ontario Divisional Court ruling dismissed an application for judicial review brought by an appellant who challenged the IPC’s decision to limit the number of files they could actively pursue at one time. The court found that the IPC’s file processing limits amount to administrative directions that allow the IPC to control its own process and manage its limited resources effectively.
FOI, Privacy and Performance in 2024
Under Ontario’s privacy laws, public institutions are required to provide annual compliance statistics to the IPC, which we collate into an annual statistics report and use to provide insights into notable trends to the Ontario Legislative Assembly.
In 2024, Ontarians submitted 70,293 freedom of information requests, more than a 6 per cent increase over the previous year.
Response rates, indicated by the number of access requests fulfilled within a 30-day timeframe, varied across sectors. For provincial institutions subject to FIPPA, over 78 per cent of access requests were completed within 30 days, signifying a notable improvement compared to 2023, when just 67 per cent of requests were completed within 30 days.
Municipal institutions covered by MFIPPA completed 82 per cent of requests within 30 days, slightly higher than the previous year's rate of 80 per cent. This modest but steady improvement shows that many municipalities are continuing to make timely access to information a priority for their communities.
2024 Snapshot: Files and Appeals
Modernization and digitization
In May 2024, the IPC launched its new and improved website, offering an enhanced, user-friendly experience designed to make accessing our information more straightforward than ever. The new site prioritizes speed, ease of use, and search functionality, featuring faster loading times and an intuitive design.
Throughout 2024, the IPC continued to modernize its operations to improve efficiency and enhance how it delivers services. As part of this effort, we’ve successfully moved to Microsoft 365 to help teams work more effectively, collaboratively, and securely.
We also introduced IRIS, our new intranet site, giving staff easier access to key resources, guidance, and tools. In parallel, we have begun a multi-year project to replace our internal case management system, to better support our day-to-day operations and casework. These modernization efforts, supported by an enterprise-wide staff training program, will enable the IPC to provide more responsive, transparent, and secure services.
Throughout 2024, we also stepped up our information security and cyber-resiliency. We made great strides in maturing our cloud computing incident prevention and detection capabilities to increase alignment with industry standards. We updated our incident response plan and conducted a table-top exercise to test it out in practice and improve our emergency readiness.
Employer of choice
The IPC’s employee recognition program celebrates outstanding contributions, teamwork, and dedication to our mission. At the heart of the program are the IPC’s Annual Exemplary Awards, which recognize individuals and teams, nominated by their peers, who embody the organization’s core values of respect, integrity, fairness, collaboration, and excellence.
In addition to the Exemplary Awards, exceptional work is highlighted throughout the year through a variety of means, ensuring that employee achievements are acknowledged and celebrated in real-time, and in a way that is meaningful to IPC staff. This includes regular recognition employee emails on behalf of the Commissioner and Senior Management Committee. By fostering a culture of appreciation, the program encourages and reinforces the IPC’s commitment to excellence in service and leadership.
Strategic priorities and planning
In 2024, the IPC entered the final stretch of its 2021–25 Strategic Plan. To support successful implementation of the IPC’s vision, mission and goals, the IPC continued to refine its Strategic Plan Framework. The framework outlines key activities for the year, expected outputs, desired outcomes and key performance indicators. The latter are particularly important to allow us to measure our progress against our goals, and ultimately, measure our real-world impact. The framework is designed to focus our resources in those areas that are of greatest strategic importance to Ontarians and has been instrumental in guiding our efforts towards becoming a modern and effective regulator with real world impact.
Financial Summary
SALARIES AND WAGES | $21,132,000 | |
|---|---|---|
EMPLOYEE BENEFITS | $5,492,400 | |
TRANSPORTATION AND COMMUNICATIONS | $185,300 | |
SERVICES | $4,242,800 | |
SUPPLIES AND EQUIPMENT | $161,100 | |
TOTAL | $31,213,600 |
Organizational Chart
Decisions affecting Ontario’s Greenbelt are of significant public interest, engaging important environmental sustainability and governance implications. Established in 2005, the Greenbelt was designed to protect environmentally sensitive land, agricultural areas, and natural heritage systems from urban sprawl. Any changes to its boundaries or protections must be carefully deliberated and decided with utmost transparency and accountability.
In November 2022, the government announced the removal of almost 2,000 acres of land from the Greenbelt to support housing development. This decision sparked widespread public outcry, particularly given previous assurances that the Greenbelt would remain untouched. Investigations by the Auditor General of Ontario and the Ontario Integrity Commissioner revealed serious flaws in the decision-making and record-keeping processes, raising concerns about transparency, fairness, and legal compliance.
