Letter to the Standing Committee on Access to Information, Privacy and Ethics on the Main Estimates for the Office of the Privacy Commissioner of Canada for 2026-2027

Press Release

John Brassard, M.P.
Chair
Standing Committee on Access to Information, Privacy and Ethics
House of Commons
Sixth Floor, 131 Queen Street
Ottawa, ON  K1A 0A6

Dear Chair:

I am writing in follow up to my appearance before the Standing Committee on Access to Information, Privacy and Ethics on May 7, 2026, in relation to your study of the Main Estimates for the Office of the Privacy Commissioner of Canada for 2026-2027. During my appearance, I was asked to explain the factors behind the Indigenous contracts figures for my Office in 2024-2025 and provide details as to how my Office supports indigenous procurement as part of its commitment to economic reconciliation.

In the 2024-2025 period, my Office significantly exceeded the federally mandated target of 5% for Indigenous procurement by achieving 10.7%. This success was driven by my Office’s proactive use of Public Services and Procurement Canada tools and a consistent effort to invite Indigenous businesses into our competitive processes.

Though my Office has recently transitioned from a result of 10% in 2024-2025 to setting a target of 5% for 2026-2027, this does not represent a reduction in effort, but rather an alignment with the mandatory federal minimum while we navigate broader organizational shifts:

• Completion of Major Contracts: A significant IT support contract with an Indigenous service provider reached its natural conclusion in 2025-2026. This specific project accounted for a large portion of the previous year’s percentage.
• Expenditure Reduction and Internal Capacity Building: Consistent with the government objective, my Office is committed to reducing expenditures on external management and other consulting services by 20% over the next three years. My Office has begun reducing reliance on external services by leveraging internal talent, supported by recently approved temporary funding, which in turn reduces the total volume of external contracting.

Despite these shifts, our commitment to economic reconciliation remains a priority. We are evolving our strategy from a “project-based” approach to a systemic one by:

• Early-Stage Planning: Integrating Indigenous procurement strategies directly into the initial procurement planning phase for every major project.
• Strategic Set-Asides: Increasing voluntary set-asides when Indigenous capacity exists and operational requirements, best value, prudence, probity and sound contracting management can be assured.
• Prequalified Partnerships: Prioritizing Indigenous businesses within existing standing offers and government-wide procurement tools to ensure consistent participation.

The 5% figure serves as our guaranteed baseline; our internal goal remains to identify every possible opportunity to surpass this target and foster long-term, meaningful economic partnerships with Indigenous businesses.

During my appearance, I was also asked to provide details concerning my recommendations for reform of Canada’s federal privacy legislation. I would like to share with the Committee seven priority recommendations for PIPEDA reform that I believe would be the most impactful in enhancing privacy protections and privacy rights in Canada:

1. Enforcement Powers: Establish stronger enforcement powers by providing the Privacy Commissioner with the power to issue binding orders, impose administrative monetary penalties (AMPs) and to conduct proactive audits.
2. Fundamental Right to Privacy: Recognize privacy as a fundamental right in the purpose clause and in an embedded preamble.
3. Children’s Privacy: Enhance children’s privacy rights by explicitly recognizing the best interests of the child and mandating the Privacy Commissioner to develop a code of practice for children’s privacy.
4. De-identification: Promote innovation by including a framework for de-identification and anonymization.
5. Right to Deletion and De-listing: Ensure that individuals maintain control over their personal information through a clear and explicit right to de-list and delete personal information.
6. Privacy by Design and Privacy Impact Assessments: Enhance accountability by requiring organizations to implement privacy by design and conduct privacy impact assessments for high-risk activities.
7. Trans-Border Data Flows: Promote international trade by instituting specific rules and requirements to protect personal information moving outside of the country.

I have identified the above list as my priority recommendations for modernizing Canada’s federal private-sector privacy law because they would strengthen key regulatory powers and address systemic issues that my Office has observed, including emerging risks in the digital economy.

As to the public sector, I have developed a similar list of priority recommendations for reform of the Privacy Act to address significant gaps in the law. Those recommendations are as follows:

1. Collection Threshold: Create an explicit necessity and proportionality requirement for the collection of personal information.
2. PIA Requirement: Require departments to conduct privacy impact assessments in high-risk situations.
3. Orders: Provide the Privacy Commissioner with the power to issue binding orders.
4. Safeguards: Adopt an explicit legislative requirement to safeguard personal information.
5. Breach Reporting: Create a legislative requirement for reporting privacy breaches.
6. Discretion to Report: Provide more discretion to the Privacy Commissioner to publicly report.
7. Discretion to Decline: Provide the Privacy Commissioner with discretion to discontinue or decline complaints.

Modernizing Canada’s privacy laws is necessary to fully meet the challenges of today’s data driven world. It will protect Canadians and give them confidence that their data is protected and used responsibly, and it will support Canadian businesses and public sector institutions to innovate responsibly and earn public trust.

Thank you again for the opportunity to provide my input into your important work.

Sincerely,
(Original signed by)
Philippe Dufresne
Commissioner
c.c.: Nancy Vohl, Clerk of the Committee

IBF5