OPC Annual Report to Parliament 2024-2025
OPC Annual Report Overview
The Office of the Privacy Commissioner of Canada (OPC) released its 2024‑25 Annual Report to Parliament on June 5. In it, the OPC commissioner outlines three strategic priorities: protecting and promoting privacy with maximum impact; addressing and advocating for privacy in a time of technological change; and protecting the privacy of children. In assessing the Canadian privacy landscape, the report reveals an increased concern towards privacy in AI use, a small increase in the number of data breaches, and continued concern over data storage by social media apps. It also highlighted investigative results and outlined ongoing preparations for the anticipated Consumer Privacy Protection Act.
Key Findings:
The 2024-2025 cycle is characterized by a rise in public concern. The OPC received 11% more complaints in 2024-2025 than in the previous year. Institutions like the RCMP, Correctional Service Canada, and Immigration, Refugees and Citizenship Canada were the most frequent subjects of these complaints. In addition, the number of reported breaches in the public sector rose to 615. This has affected over 309,000 individuals—more than double the previous year’s number. Furthermore, there has also been a spike in significant cyber breaches, with reports increasing from 37 to 55 in a single year.
The OPC led several oversight and investigative efforts over the past year to address these complaints. In governmental oversight, the OPC has worked with departments implementing AI tools to perform privacy assessments to promote and enforce responsible data practices. In investigation, the OPC conducted a global privacy survey of websites and apps, finding that 97% employed manipulative design tactics aimed at procuring data from users, thus prompting organizations to pledge revision. The report also highlights how the OPC’s has increased collaboration with law enforcement to uphold safeguards in the development and implementation of emerging surveillance technologies.
The OPC emphasizes the importance of international collaboration, aiming to protect individuals’ privacy rights across regulatory jurisdictions by working with international governments to uphold privacy standards across the world, with the aim of making it easier for Canadian businesses to engage and succeed in a globalized world. This year, the OPC expanded its mission by joining forces with the U.S., Brazil, Nigeria, and the UK. This led to a joint investigation into the 23andMe breach in addition to ongoing collaboration with international bodies like the G7 and the Global Privacy Assembly. These partnerships help Canada remain a critical player in shaping the digital privacy landscape across borders.
Recommendations:
In its advice to Parliament, the Privacy Commissioner emphasized the need to update Canada’s privacy laws through the passing of the Consumer Privacy Protection Act (CPPA), which would replace the current private-sector framework and give the OPC tools like the power to issue orders and impose fines. The Commissioner also urged for legislation to regulate AI through the proposed Artificial Intelligence and Data Act (AIDA).
Moreover, the OPC pushed for updates to the Privacy Act, arguing that privacy should be recognized as a fundamental right. The report further recommends giving the OPC broader authority to audit, compel evidence, and enforce compliance, helping Canada stay aligned with global privacy standards. Altogether, these changes are conveyed as being crucial for rebuilding public trust and protecting Canadians.