How the OPC protects and promotes privacy

Mandate and mission

The mandate of the Office of the Privacy Commissioner of Canada (OPC) is overseeing compliance with both the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law.

The mission of the Office of the Privacy Commissioner of Canada (OPC) is to protect and promote the privacy rights of individuals.

Investigating complaints

The Commissioner works independently from any other part of the government to investigate complaints from individuals with respect to the federal public sector and the private sector. In public sector matters, individuals may complain to the Commissioner about any matter specified in Section 29 of the Privacy Act. This Act applies to personal information held by Government of Canada institutions.

For matters relating to personal information in the private sector, the Commissioner may investigate all complaints under Section 11 of PIPEDA except in the provinces that have adopted substantially similar privacy legislation, namely Québec, British Columbia, and Alberta. Ontario, New Brunswick and Newfoundland and Labrador now fall into this category with respect to personal health information held by health information custodians under health sector privacy laws in those provinces. However, even in those provinces with substantially similar legislation, and elsewhere in Canada, PIPEDA continues to apply to personal information collected, used or disclosed by all federal works, undertakings and businesses, including personal information about their employees. PIPEDA also applies to all personal data that flows across provincial or national borders, in the course of commercial transactions involving organizations subject to the Act or to substantially similar legislation.

The Commissioner’s powers

The Commissioner focuses on resolving complaints through negotiation and persuasion, using mediation and conciliation if appropriate. However, if voluntary co-operation is not forthcoming, the Commissioner has the power to summon witnesses, administer oaths and compel the production of evidence.

In cases that remain unresolved, particularly under PIPEDA, the Commissioner may take the matter to Federal Court and seek a court order to rectify the situation.

Activities the OPC undertakes in support of its mandate

As a public advocate for the privacy rights of Canadians, the Commissioner carries out the following activities:

• Investigating complaints and issuing reports with recommendations to federal government institutions and private sector organizations to remedy situations, as appropriate;
• Pursuing legal action before Federal Courts where matters remain unresolved;
• Assessing compliance with obligations contained in the Privacy Act and PIPEDA through the conduct of independent audit and review activities, and publicly report on findings;
• Advising on, and review, privacy impact assessments (PIAs) of new and existing government initiatives;
• Providing legal and policy analyses and expertise to help guide Parliament’s review of evolving legislation to ensure respect for individuals’ right to privacy;
• Responding to inquiries of Parliamentarians, individual Canadians and organizations seeking information and guidance and taking proactive steps to inform them of emerging privacy issues;
• Promoting public awareness and compliance, and fostering understanding of privacy rights and obligations through: proactive engagement with federal government institutions, industry associations, legal community, academia, professional associations, and other stakeholders; preparation and dissemination of public education materials, positions on evolving legislation, regulations and policies, guidance documents and research findings for use by the general public, federal government institutions and private sector organizations;
• Providing legal opinions and litigate court cases to advance the interpretation and application of federal privacy laws;
• Monitoring trends in privacy practices, identify systemic privacy issues that need to be addressed by federal government institutions and private sector organizations and promoting integration of best practices; and
• Working with privacy stakeholders from other jurisdictions in Canada and on the international scene to address global privacy issues that result from ever-increasing trans-border data flows.

What the OPC doesn’t do

The OPC is required to work within the limits of its legislative mandate. Generally speaking, we cannot investigate:

• Private sector organizations regarding their collection, use and disclosure of personal information within provinces with substantially similar privacy legislation—namely in Quebec, Alberta or British Columbia, unless they are federally regulated organizations, such as banks, airlines and telecommunications companies^{Footnote *};
• Health information custodians (for example, doctors providing health care and pharmacies) with respect to their collection, use and disclosure of personal health information within a province with substantially similar health privacy legislation—namely in Ontario, New Brunswick, Newfoundland and Labrador, or Nova Scotia^{Footnote *};
• A private sector organization’s collection, use or disclosure of personal information solely for journalistic, artistic or literary purposes;
• The Courts, the House of Commons, the Senate, the Prime Minister’s Office or Members of Parliament, as they are not subject to federal privacy law;
• A private sector organization’s handling of personal information of employees and job applicants, unless it is a federally regulated organization (for example, a bank, airline or telecommunications company);
• Individuals who collect, use or disclose personal information strictly for personal and non-commercial purposes;
• The core activities of municipalities, universities, schools and hospitals;
• The personal information handling practices of charities, non-profit organizations, associations, political parties and unions to the extent that they are not engaged in a commercial activity (Note: fundraising is generally not considered a commercial activity).

See our Privacy laws in Canada  page for more information about privacy legislation in Canada.

If you need help with a privacy issue and aren’t sure what privacy law applies to your situation, try our Find the right organization to contact about your privacy issue tool.