Language selection

OPC Logo Office of the Privacy Commissioner of Canada

Search

Investigations into businesses

The Office of the Privacy Commissioner of Canada (OPC) conducts independent and impartial investigations into the personal information handling practices of businesses subject to the Personal Information Protection and Electronic Documents Act (PIPEDA).

The OPC publishes a selection of case summaries and findings from its investigations to provide concrete examples of how PIPEDA applies to the day-to-day management of personal information by businesses.

For each case, the Office indicates the outcome using a set of defined terms for findings and dispositions.

For more information about the complaint and investigation process, read How the OPC Enforces PIPEDA.

Note: Complainants are not named in the summaries or reports. The organizations are not identified unless the Privacy Commissioner of Canada has deemed it to be in the public interest to do so.

Disclaimer: Typographical errors have been corrected from the original version of the report of findings. They are indicated in [brackets].

PIPEDA findings #2022-005

Hotel chain discovers breach of customer database following acquisition of a competitor

Date of findings:
PIPEDA findings #2022-003

Telecommunications firm failed to obtain appropriate consent for voiceprint authentication program

Date of findings:
PIPEDA findings #2020-005

Investigation into Desjardins’ compliance with PIPEDA following a breach of personal information between 2017 and 2019

Date of findings:
PIPEDA findings #2018-007

Online marketplace needs consent from members before contacting them to join advocacy network

PIPEDA findings: Online marketplace needs consent from members before contacting them to join advocacy network

Date of findings:
PIPEDA findings #2017-010

Reasons for retaining customer credit card data explained

PIPEDA findings: Reasons for retaining customer credit card data explained

Date of findings:
PIPEDA Case Summary #2017-005

Insurance company required to delete individual’s personal information after individual withdraws consent

PIPEDA Case Summary: Insurance company required to delete individual’s personal information after individual withdraws consent

Date of findings:
Early resolved case summary #5

Web posting that was removed by individual retained by Internet search engine

PIPEDA Case Summary: Web posting that was removed by individual retained by Internet search engine

Date of findings:
PIPEDA Case Summary #2013-014

Online dating service used former customer’s personal information without consent and failed to provide him access to his personal information

Date of findings:
PIPEDA Report of Findings #2009-008

Report of Findings: CIPPIC v. Facebook Inc.

PIPEDA Report of Findings: Complaint Filed by the Canadian Internet Policy and Public Interest Clinic (CIPPIC) against Facebook Inc. under PIPEDA.

Date of findings:
Settled case summary #24

Company revises privacy policy to clarify why it keeps personal information for a specific length of time, and designates privacy officer (July 21, 2006)

Date of findings:

Showing items 1 through 10 of 10.

Filter these results

  • Active Complaint Types Filters

    • Retention and Disposal
Clear all

Search by key word or choose from the filter options below to narrow the results.

Dispositions

Complaint Types

Sectors

Topics

Principles

Date of Findings
Date modified: