2021-22 Survey of Canadian businesses on privacy-related issues

Executive summary

Prepared for the Office of the Privacy Commissioner of Canada

Supplier Name: Phoenix Strategic Perspectives Inc. (SPI)
Contract Number: 2R008-210080-001-CY
Award Date: 2021-11-05
Contract Value: $75,575.74 (including applicable tax)
Delivery Date: 2022-03-10

Registration Number: POR 035-21

For more information, please contact: publications@priv.gc.ca

Ce rapport est aussi disponible en français.

2021-22 Survey of Canadian businesses on privacy-related issues
Executive Summary

Prepared for the Office of the Privacy Commissioner of Canada
Supplier name: Phoenix Strategic Perspectives Inc.
March 2022

This public opinion research report presents the results of a telephone survey conducted by Phoenix SPI on behalf of the Office of the Privacy Commissioner of Canada. The research study was conducted with 751 representatives of Canadian businesses between January 12 and February 18, 2022.

This publication may be reproduced for non-commercial purposes only. Prior written permission must be obtained from the Office of the Privacy Commissioner of Canada. For more information on this report, please contact the Office of the Privacy Commissioner of Canada at: publications@priv.gc.ca or at:

Office of the Privacy Commissioner of Canada
30, Victoria Street
Gatineau, Quebec
K1A 1H3

Catalogue Number:
IP54-96/2022E-PDF

International Standard Book Number (ISBN):
978-0-660-43174-1

Related publications (POR registration number: POR 035-21):
Catalogue number (Final report, French) IP54-96/2022F-PDF
ISBN: 978-0-660-43175-8

Aussi offert en français sous le titre Sondage de 2021-2022 auprès des entreprises canadiennes concernant les enjeux liés à la protection des renseignements personnels.

Executive Summary

The Office of the Privacy Commissioner of Canada (OPC) commissioned Phoenix Strategic Perspectives (Phoenix SPI) to conduct quantitative research with Canadian businesses on privacy-related issues.

Purpose, objectives and use of findings

To address its information needs, the OPC conducts surveys with businesses every two years to inform and guide outreach efforts. The objectives of this research were to collect data on the type of privacy policies and practices businesses have in place; on businesses’ compliance with the law; and on businesses’ awareness and approaches to privacy protection. The findings will be used to help the OPC provide guidance to both individuals and organizations on privacy issues; and enhance its outreach efforts with small businesses, which can be an effective way to achieve positive change for privacy protection.

Methodology

A 15-minute telephone survey was administered to 751 companies across Canada from January 12 to February 18, 2022. The target respondents were senior decision makers with responsibility and knowledge of their company’s privacy and security practices. Businesses were divided by size for sampling purposes: small (one-19 employees); medium (20-99 employees); and large (100+ employees). The results were weighted by size, sector and region using Statistics Canada data to ensure that they reflect the actual distribution of businesses in Canada. Based on a sample of this size, the results can be considered accurate to within ±3.6%, 19 times out of 20.

Contextual Note

The OPC has conducted this survey of Canadian businesses every two years since the baseline survey of 2011. For many of the issues explored, there is a decade of tracking data available to monitor businesses’ privacy practices. The previous iteration of this survey was 2019, prior to the COVID-19 global pandemic. The pandemic has had well documented impacts on businesses in Canada^{Footnote 1} with measures adopted by firms to contain the spread of COVID-19 resulting in revenue declines, employee lay-offs and turnover, remote working, and reduced hours, among other impacts. This year, the survey was conducted at the height of the fifth wave of the pandemic (the Omicron variant) after nearly two years of pandemic-related restrictions. To manage Omicron, government-dictated restrictions on businesses increased once again in January 2022, with some jurisdictions reverting to lockdown protective measures.

The Omicron-related restrictions, and the pandemic more generally, affected this wave of the research: including the research design, in particular, the number of responses received and, quite possibly, the views of business representatives who participated in the survey. When businesses are preoccupied with pandemic-related impacts on their day-to-day operations, it is reasonable to assume that privacy responsibilities might not be top-of-mind. For instance, the reported decline in compliance with privacy practices may be more a reflection of limited recall or knowledge of these measures on the part of the respondent, or the fact that these matters have been given less priority amidst significant operational changes.

Key Findings

Many companies have a privacy policy in place, but fewer companies reported having one in 2022 than in 2019.

• Approximately six in 10 (59%) business representatives said their company has a privacy policy in place. This represents a small decline since 2019 when 65% of companies reported having such a policy in place. The likelihood of having a privacy policy is higher among larger businesses. Seventy-nine percent (79%) of large businesses surveyed said they have such a policy, compared to 66% of medium-sized businesses and 58% of small businesses.
• Among companies that have a privacy policy, most reported having a policy that explains in plain language the following: the purpose for which their company collects, uses, and discloses customers’ personal information (84%); how their company collects, uses, and discloses this information (83%); and what personal information is being collected (78%). In addition, 72% of respondents said their company has a privacy policy that explains in plain language with which parties the personal information collected will be shared. Moreover, 66% have a policy that explains how customers’ personal information is disposed, while 57% have a policy that explains the length of time the company keeps customers’ personal information, and 51% have a policy that explains in plain language the risks of harm in the event of a data breach.
• Seventy percent (up from 51% in 2019) of respondents working for companies that have a privacy policy said their company makes its privacy information easily accessible to customers. Businesses with one employee (i.e., those who are self-employed) (78%), along with companies with five to nine employees (82%), are more likely than larger companies to make their privacy information easily accessible to customers. In addition, 43% of companies that have a privacy policy notify customers when making changes to their policy (up from 36% in 2019). The same proportion—43%—obtain consent from customers when making changes to their company’s privacy practices (up from 34% in 2019).

Half or more of Canadian businesses have implemented most of the privacy compliance practices measured in the survey.

• Across all measures, compliance with privacy practices has decreased since 2019. Nearly six in 10 (57%) respondents said their company has a designated privacy officer (versus 62% in 2019). Following this, 51% said their company has developed and documented internal policies for staff that address privacy obligations (versus 55% in 2019), while the same proportion (51%) said their company has put in place procedures for responding to customer requests for access to their personal information (versus 60% in 2019). As well, 51% said their company has put in place procedures for dealing with customer complaints about the handling of their personal information (versus 58% in 2019). The likelihood of having implemented these practices increased with business size and was highest among large companies for nearly all measures.
• Fewer (34%) said their business regularly provides staff with privacy training and education (down from 39% in 2019).

More than nine in 10 companies have not experienced a privacy breach.

• Ninety-four percent of companies reportedly have not experienced a privacy breach (this is unchanged since 2019).
• There is no clear consensus when it comes to how concerned companies are about potential data breaches. A little more than one in four (28%) said they are concerned about a data breach (scores of six and seven), with 23% extremely concerned about a potential breach. On the other hand, 41% are not concerned about a potential breach (scores of one and two), including 30% that are not at all concerned about this.
• High concern (scores of six and seven) about a data breach has fluctuated over time, from a low of 24% in 2013 to a high of 37% in 2019. At 28%, high concern has declined significantly this year as compared to 2019.

Many companies are well aware of their responsibilities under privacy laws.

• Eighty-six percent of business representatives said their company is at least moderately aware of their privacy-related responsibilities, including 40% that are extremely aware of these responsibilities.
• Seventy-four percent of business representatives said their company has taken steps to ensure it complies with Canada’s privacy laws. The likelihood of taking steps to ensure compliance increased with company size: 85% of large businesses, and 82% of medium-sized businesses reportedly have taken steps to ensure compliance compared to 73% of small companies have done so.
• One-third of businesses representatives surveyed said their company is aware that the OPC has information and tools to help companies comply with their privacy obligations. The likelihood of being aware of these resources was higher among medium-sized (41%) and large (56%) companies than among small companies (32%).

Contract Value

The contract value was $75,575.74 (including applicable tax).

Statement of Political Neutrality

I hereby certify as a Senior Officer of Phoenix Strategic Perspectives that the deliverables fully comply with the Government of Canada political neutrality requirements outlined in the Communications Policy of the Government of Canada and Procedures for Planning and Contracting Public Opinion Research. Specifically, the deliverables do not contain any reference to electoral voting intentions, political party preferences, standings with the electorate, or ratings of the performance of a political party or its leader.