Privacy Complaint to OPC — PIPEDA (Canada)

A Privacy Complaint to OPC — PIPEDA in Canada sets out a complaint about an organisation’s handling of personal information to the privacy regulator, governed primarily by PIPEDA and provincial privacy legislation.

The OPC is an independent officer of Parliament created under the Privacy Act to oversee the federal government's compliance with privacy obligations, and under PIPEDA to oversee private sector compliance. The Privacy Commissioner of Canada investigates complaints, conducts audits, promotes awareness of privacy rights, and may apply to the Federal Court on behalf of individuals who have had their privacy rights violated.

Under PIPEDA ss.11-12, any individual may file a complaint with the OPC regarding the privacy practices of a private sector organization. The OPC will notify the organization of the complaint, provide an opportunity to respond, and investigate. The investigation may include review of documents, interviews, and on-site inspections. The OPC attempts to resolve complaints through conciliation and mediation where possible. Upon completing the investigation, the OPC issues Findings — a report that determines whether the organization contravened PIPEDA and makes recommendations for compliance. Published Findings (with personal information removed) form an important body of guidance on PIPEDA interpretation.

PIPEDA applies to federally regulated businesses (banks, telecommunications companies, interprovincial transportation, broadcasting) and to private sector organizations that collect, use, or disclose personal information in the course of commercial activity across provincial or international borders. Organizations carrying on business exclusively within Alberta, British Columbia, or Quebec are subject to provincial private sector privacy legislation that has been deemed 'substantially similar' to PIPEDA — PIPA (AB/BC) or Law 25 (QC). Complaints against these organizations are handled by the respective provincial privacy commissioners.

The Personal Information Protection and Electronic Documents Act 2000 (PIPEDA, S.C. 2000, c. 5) is the primary statute governing this complaint process. Section 11 of the Act 2000 grants individuals the right to file complaints with the OPC. Section 12 of the Act 2000 governs the OPC's investigation powers. Section 13 of the Act 2000 allows the OPC to attempt resolution by mediation and conciliation. Section 14 of the Act 2000 allows complainants to apply to the Federal Court of Canada after receiving OPC Findings. Section 16 of the Act 2000 authorizes the Federal Court to award damages including general damages for humiliation. The Privacy Act 1985 (R.S.C. 1985, c. P-21), Section 29, governs complaints about federal government institutions — separate from PIPEDA complaints against private sector organizations. Quebec's Act respecting the protection of personal information in the private sector 2021 (Law 25) created the Commission d'accès à l'information (CAI) as the provincial enforcement body for Quebec private sector complaints under Section 90 of the Act 2021. Alberta's Personal Information Protection Act 2003 (PIPA, S.A. 2003, c. P-6.5), Section 46, and British Columbia's Personal Information Protection Act 2003 (PIPA, S.B.C. 2003, c. 63), Section 36, govern provincial private sector complaints in those provinces through their respective Information and Privacy Commissioners.

A Privacy Complaint to the OPC is appropriate in the following circumstances.

Access Denied or Delayed: Under PIPEDA s.8, individuals have the right to know what personal information an organization holds about them, and to request access to that information. Organizations must respond to access requests within 30 days (with a possible 30-day extension). If an organization denies an access request without valid justification, or fails to respond within the required time, a complaint to the OPC is appropriate.

Unauthorized Collection or Use: If an organization has collected your personal information without your knowledge or consent, used it for a purpose you did not consent to, or disclosed it to a third party without your authorization — and internal complaints to the organization's Privacy Officer have been ineffective — a PIPEDA complaint is the appropriate remedy. Common examples include organizations sharing personal information with marketers without consent, employers using employee personal information beyond the purposes of employment, and online platforms collecting data through cookies without meaningful consent.

Failure to Correct: Under PIPEDA s.8(7), individuals have the right to challenge the accuracy of their personal information and to have inaccurate information corrected or annotated. If an organization refuses to correct incorrect personal information (such as incorrect health records, credit bureau entries, or employment records), a complaint to the OPC or applicable provincial privacy commissioner is the appropriate step.

Privacy Breach Notification Failures: If you believe an organization has experienced a breach involving your personal information and has failed to notify you as required by PIPEDA s.10.1 (because the breach creates a real risk of significant harm), a complaint to the OPC is appropriate. The OPC can investigate whether the notification was required and whether it was adequately handled.

Systemic Privacy Concerns: Complaints can also address systemic privacy practices — such as an organization collecting far more personal information than is necessary (violating the limiting collection principle under Schedule 1, Principle 4 of the Act 2000), or failing to maintain adequate security safeguards under Principle 7 of the Act 2000. The OPC has investigated and published Findings against major Canadian organizations including Equifax Canada, Facebook, WhatsApp, and Rogers Communications for systemic violations of multiple PIPEDA principles.

The Limitations Act 2002 (Ontario, S.O. 2002, c. 24, Sch. B) sets a two-year limitation period under Section 4 for civil claims; PIPEDA Section 14 complaints to the Federal Court must be filed within 45 days of receiving OPC Findings. Quebec's Act respecting the protection of personal information in the private sector 2021 (Law 25, S.Q. 2021, c. 25) provides a separate complaint mechanism through the Commission d'accès à l'information (CAI) under Section 90 of the Act 2021. British Columbia's Freedom of Information and Protection of Privacy Act 1996 (FIPPA, R.S.B.C. 1996, c. 165) and Ontario's Freedom of Information and Protection of Privacy Act 1990 (FIPPA, R.S.O. 1990, c. F.31) govern provincial government institution complaints through the respective provincial Information and Privacy Commissioners.

A well-prepared Privacy Complaint to the OPC should include the following elements to maximize the likelihood of a thorough and effective investigation.

Complainant Identification: Your full name, mailing address, telephone number, and email address. The OPC needs your contact information to communicate with you throughout the investigation. If you are filing on behalf of another person, provide the authority under which you are acting (written consent from the individual, or documentation of your legal representative status for a deceased individual).

Organization Identification: The full legal name of the private sector organization whose privacy practices are being challenged. Providing the organization's address helps the OPC notify and contact them. Identify the type of organization (bank, telecom, retailer, employer, health service provider, etc.) — this helps the OPC identify whether PIPEDA or a provincial privacy statute applies.

Prior Contact Attempt: Document any prior contact with the organization's Privacy Officer, including the date and method of contact, the response received (or absence of response), and why the response was unsatisfactory. Demonstrating that you attempted internal resolution before escalating to the OPC is recommended under PIPEDA Principle 10.

Nature of Complaint: Identify the specific PIPEDA principle(s) that you believe have been violated. Be specific about the type of complaint — access denied, unauthorized collection, unauthorized disclosure, failure to correct, breach notification failure, or excessive collection. The more precisely you identify the legal issue, the more efficient the OPC investigation will be.

Detailed Description: Provide a factual, chronological account of the privacy issue — when it occurred or was discovered, what personal information is involved, what specific actions the organization took (or failed to take), and the impact on you. Attach copies (not originals) of all relevant correspondence, contracts, privacy policies, account statements, or other evidence.

Harm Suffered: Describe the actual or potential harm resulting from the privacy issue — financial loss, reputational damage, emotional distress, loss of employment opportunity, identity theft, or denial of credit. The OPC considers harm in assessing complaint priority and may consider harm when reporting on Findings.

Resolution Sought: State clearly what outcome you are seeking — access to your personal information, correction of inaccurate data, deletion of unlawfully collected data, compliance order, public reporting by the OPC, or monetary compensation through Federal Court proceedings.

Declaration: Sign and date the complaint, certifying the accuracy of all information. Filing a knowingly false complaint is an offence under PIPEDA. The Personal Information Protection and Electronic Documents Act 2000 (PIPEDA), Section 11, is the statutory basis for the complaint. Section 8 of the Act 2000 governs access requests and the 30-day response obligation. Section 8(7) of the Act 2000 governs the right to correct inaccurate personal information. Section 10.1 of the Act 2000 governs breach notification obligations. Section 28 of the Act 2000 sets out the $100,000 maximum fine for knowingly contravening reporting obligations. Section 14 of the Act 2000 and Section 15 of the Act 2000 govern Federal Court applications following OPC Findings — complainants have 45 days from receiving Findings to apply to the Federal Court of Canada under the Federal Courts Act 1985 (R.S.C. 1985, c. F-7). The Privacy Commissioner of Canada is an independent officer of Parliament under the Parliament of Canada Act 1985 (R.S.C. 1985, c. P-1). The Office of the Privacy Commissioner of Canada (OPC) publishes Findings, guidance documents, and annual reports to Parliament. Schedule 1 of the Act 2000 codifies the ten fair information principles — accountability (Principle 1), identifying purposes (Principle 2), consent (Principle 3), limiting collection (Principle 4), limiting use (Principle 5), accuracy (Principle 6), safeguards (Principle 7), openness (Principle 8), individual access (Principle 9), and challenging compliance (Principle 10). Forms-legal.com provides this Privacy Complaint to OPC template to help individuals exercise their rights under the Act 2000 effectively and prepare a well-documented complaint submission.