What to expect during a complaint investigation under the Privacy Act

As an Agent of Parliament, the Privacy Commissioner of Canada conducts independent and impartial investigations of complaints against federal government institutions received under section 29 of the Privacy Act. In broad terms, complaints can be related to denial of access to personal information, or to matters relating to the protection of personal information, such as allegations of improper collection, use, disclosure, retention or disposal.

The OPC is committed to carrying out its mandate in a manner that ensures the fair and equitable distribution of available resources amongst all complainants.

We use a calibrated approach when assessing and investigating complaints. We consider the impact on both the complainant and the public. For example, when a complaint raises important systemic issues that affect large numbers of individuals, it may be given a higher priority and greater resources. This enables our Office to best serve the public interest by responding effectively to privacy matters of the greatest or emerging concern.

The Privacy Act applies to federal government institutions, which include departments, ministries, agencies, as well as most Crown corporations and their wholly-owned subsidiaries. It applies to almost all of the personal information that these institutions collect, use and disclose—be it about members of the public or federal employees. To determine where to address a concern to a federal institution, please consult the list of access to information and privacy coordinators by institution.

If you submit a complaint to our Office under the Privacy Act about an organization that is not subject to the Act, we will be unable to proceed with any action^{Footnote 1}. To determine where to address a concern about an organization outside the scope of the Privacy Act, please read our summary of privacy legislation in Canada.

The Commissioner has flexibility in determining how investigations will be conducted, and where possible encourages that complaints be resolved at an early stage of the process. Here are the typical approaches we take when conducting investigations:

• Early resolution process: A fair, timely and resolution-oriented investigation process benefits complainants and government institutions. When successful, early resolution is the best possible outcome for all concerned. For individuals who lodge a complaint under the Privacy Act, it means getting their concerns addressed quickly. For government institutions, it means avoiding an often lengthy and resource-consuming process. The early resolution approach is consistent with the Commissioner's role as an ombudsman in overseeing the federal government's compliance with the Act. It is a voluntary process under which no formal findings are issued.
  
  Upon receipt, we will examine all complaints to see if they could be candidates for early resolution. Considerations include the complexity of the case, whether it involves issues previously examined by the OPC, and whether the allegations could be easily remedied. For example, an individual may complain about an issue the OPC has already investigated and found the institution to be compliant with the Privacy Act or, a government institution immediately addresses the allegations against it.
  
  In all cases, the OPC aims to ensure that government institutions are acting in accordance with the Privacy Act, and that the complainant understands the explanation or outcome. You will be contacted by our Office if we determine that your complaint could be resolved using the early resolution approach.
  
  
• Standard investigations: Where early resolution is not suitable, we will conduct a standard investigation. This process requires more time than early resolution, and may need extensive consultations and analysis to determine whether a complainant's privacy rights have been contravened under the Privacy Act. When we conduct a standard investigation, the complainant and the institution involved will receive a Report of Findings after the investigation. If there have been contraventions, the standard investigation process seeks to address the complainant’s specific concerns and prevent similar contraventions from recurring.

As an ombudsman, the Commissioner does not have order-making powers under the Privacy Act and, as a result, cannot force a government institution to take any specific action. The Commissioner makes findings and recommendations where appropriate and works with government institutions towards implementing improvements to their personal information management practices.

Recommendations are limited to achieving compliance with the Privacy Act, and may be related either to the institution's privacy management practices or to the specific matter involving the individual complainant. Broader forms of redress cannot be obtained through the Privacy Act complaint investigation process. For example, the Privacy Act does not give our Office the ability to fine organizations or seek damages on behalf of complainants. Furthermore, we do not address criminal or civil culpability on the part of federal government institutions, or employees.

Since an investigation is limited to establishing whether an individual's privacy rights have been violated under the Privacy Act, it may not resolve all issues which are important to the complainant. Other avenues may need to be pursued where the issue relates to matters outside of the Privacy Act.

To make the most of our limited investigative resources, the OPC has created an inventory of complaints awaiting assignment as a way of improving our service. Complaints will be reviewed by investigation managers who will assess, using the OPC’s established Risk Management Framework, whether the complaint should be immediately assigned or placed in the inventory pending assignment to an investigator.

Complaints from the inventory will be assigned to an investigator using criteria including:

• the date of the complaint,
• the rights at stake,
• the number of individuals affected,
• any potential threat to the intent, spirit or application of the law,
• the potential for litigation,
• as well as program or policy implications.

An investigator will be in touch with you when your complaint is assigned.

During the course of an investigation under the Privacy Act, you may provide our Office with any information or comments which you feel are relevant to your complaint.

After completing an investigation, the Commissioner may make a finding. Consult the definitions of findings and other dispositions under the Privacy Act to find out more about the five most common findings issued.

Upon completion of the Privacy Commissioner's investigation, the Privacy Act provides a limited right to court review. This is available only in situations involving denial of access to personal information.

For more information on court actions, please consult Federal Court applications under the Privacy Act.

If early resolution is possible, the investigator will discuss the issue with the complainant and institution to help identify a solution that satisfies both parties without the need for a standard investigation.

Under a standard investigation, the investigator's job is to gather and analyze the facts related to the complaint and prepare a Report of Findings for consideration by the Privacy Commissioner or the Commissioner's delegate. This report is based on an analysis of the facts within the framework of the Privacy Act.

Investigation of a complaint will usually be handled by a single investigator who will:

• clarify the complaint with the complainant where necessary to clearly identify the issues for investigation;
• determine the best approach for conducting the investigation;
• communicate with the complainant and the respondent government institution as necessary to gather the facts and obtain representations from both parties;
• examine relevant records and carry out all necessary interviews;
• conduct an analysis of the information obtained during the investigation;
• determine the basis for findings and recommendations for consideration by the Privacy Commissioner or delegate.

The investigator has the authority through the Privacy Commissioner to:

• receive evidence,
• enter premises where appropriate, and
• examine or obtain copies of records found on any premises during the course of an investigation.

Before filing a complaint with us, we encourage you to first try resolving the matter with the help of the Access to Information and Privacy (ATIP) Coordinator of the institution responsible for the personal information at issue. To find the right contact, please consult the list of access to information and privacy coordinators by institution provided by the Treasury Board of Canada Secretariat.

The OPC has flexibility in determining how an investigation will unfold. This includes both the investigation process and timelines. The OPC will request that you provide clear information and to participate in the process by:

• ensuring that the complaint is concise, clear and complete, and that all relevant supporting documentation has been provided(for example, for denial of access or time limit complaints, you should include a copy of the response letter received from the government institution). If you are unclear about the documentation that may be required, we encourage you to contact our Office or the investigator assigned;
• further clarifying the issues in the complaint when asked by the investigator, or asking for help from the investigator if needed;
• providing the OPC with the requested information in an organized and timely manner; and
• assisting the investigator as needed throughout the investigation process.

Please note that in all but very rare cases, regardless of the approach taken (such as early resolution or standard investigation), your name and the nature of the allegations raised in your complaint will be shared with the institution that is the target of the complaint in order to conduct an investigation.

The Privacy Act gives you a right to file complaints, and under section 29 of the Act, the Commissioner shall receive and investigate those complaints. However, the OPC may not be able to give equal priority to all of your complaints.

Section 32 of the Act allows the Commissioner to determine the procedures to be followed in a complaint investigation. If you have filed numerous complaints, the OPC will determine a suitable approach for managing the investigations while respecting your right to file complaints under the Act.

The OPC will work with you to prioritize complaints, as we may not be in a position to investigate all of your complaints immediately. On occasion, we may defer investigating new complaints you submit until your existing complaints have been completed. This enables the OPC to ensure fair distribution of resources amongst all complainants.

With this approach, our Office can better balance the needs of all complainants, ensuring that all individuals have access to our services, and that complaints are treated in a fair and timely manner.

The OPC will work with you to ensure that your interests are being served as effectively as possible.

The respondent institution should provide, on a timely basis:

• a clear description of the relevant facts and circumstances related to the complaint;
• copies of any documentation relevant to the matter under investigation, including any correspondence between the institution and complainant, and relevant departmental policies or procedures;
• a clear statement of the institution's position concerning the allegations, through representations that have received proper consideration and consultation at the appropriate level within the institution; and
• specifics of any action taken to date, or planned to be taken, to address the subject matter of the complaint.

Early investment of effort and cooperation by the institution in responding to a complaint will facilitate the investigation process. Good representations may enable the investigator to fully address the complaint from the outset.

In cases where the respondent institution does not provide a timely or adequate response, the OPC may formally request representations from the head of the organization. This may also occur where the issue under investigation has high significance and potentially important implications for the complainant, the institution, or the Government of Canada as a whole.

Delays in providing relevant and focused information will cause greater investment of effort for all participants in the process. Where the institution has not represented its position fully and accurately, this may even result in an unfavorable finding for the institution.

Some complaints can be easily resolved, whereas others may require extensive investment of time and resources. In all cases, the OPC investigates complaints in as timely a manner as possible. Every case is different, so it's difficult to predict the exact length of time. Typically, an investigation may take several months; however, the time required varies according to the complexity of the issues.

The following factors may determine how long an investigation will take:

• the volume of complaints and resource availability;
• the complexity of a case, or the number of issues to be investigated;
• the level of cooperation or ease of communication with the parties;
• the availability of witnesses and documentary evidence;
• the completeness and quality of the information provided by the parties;
• the presence of a legal issue that may need to be examined and settled; and/or
• the opportunity during the course of investigation for early resolution.

The timeliness of investigations is an issue we take very seriously and we are committed to completing a full and thorough investigation as quickly as possible, all the while respecting procedural fairness.