Guide to the PIPEDA complaint process

What happens when you file a complaint under PIPEDA?

If you have made or are thinking about making a complaint under the Personal Information Protection and Electronic Documents Act (PIPEDA), you might have questions about what comes next and what results you might expect from an investigation.  The following information will help to explain the process.

What can the Privacy Commissioner investigate?

With respect to PIPEDA, the Commissioner may investigate all complaints under PIPEDA except in the provinces that have adopted substantially similar privacy legislation, namely Québec, British Columbia, and Alberta. Ontario, New Brunswick and Newfoundland and Labrador, now fall into this category with respect to personal health information held by health information custodians under its health sector privacy law.

However, even in those provinces with substantially similar legislation, and elsewhere in Canada, PIPEDA continues to apply to personal information collected, used or disclosed by all federal works, undertakings and businesses (FWUBs), including personal information about their employees. Some examples of FWUBs are:

• Telecommunications;
• Broadcasting;
• Interprovincial or international trucking, shipping, railways or other transportation;
• Aviation;
• Banking (see Schedules 1 and 2 of the Bank Act);
• Nuclear Energy;
• Activities related to maritime navigation and shipping (including ports and long shoring);
• Local businesses in the Yukon, Nunavut and Territories (where all private sector activity is in federal jurisdiction);

PIPEDA also applies to all personal data that flows across provincial or national borders, in the course of commercial transactions.

What is the purpose of an investigation?

An investigation will serve to establish whether individuals' privacy rights have been contravened or whether individuals have been given their right of access to their personal information. The investigation will be conducted in an objective, fair, and impartial manner.

If there have been contraventions, the investigation process seeks to resolve complaints and to prevent contraventions from recurring.

What happens during the investigation process?

The Commissioner works independently to investigate complaints. Therefore, the Commissioner does not become your personal advocate when acting on your complaint. Rather, he exercises his powers and authority as an advocate for the privacy rights of Canadians.

Complaints for investigation will be handled by one or more investigators who will:

• Clarify the complaint to clearly identify the issues for investigation;
• Determine the best approach for dealing with the matter;
• Gather evidence relevant to the investigation, from the parties as well as third-parties;
• Communicate with the respondent organization to determine what action has been taken or is proposed by the organization;
• Examine relevant records, including at the OPC’s discretion, on site at the respondent organization, and carry out all necessary interviews;
• Conduct an analysis of the information obtained during investigation;
• Determine whether there is a basis for findings that there has been a contravention.  If so, the OPC may at its discretion contact the respondent to convey preliminary findings and associated recommendations, and provide an opportunity for further representations towards resolving concerns and securing commitments before concluding the investigation.

What happens at the end of an investigation?

If the complaint is substantiated or well-founded, there will be a Report of Findings that contains:

• A summary of both sides’ positions and what the investigation uncovered;
• The findings and recommendations;
• Any agreement reached by the parties;
• If appropriate, a request that the organization provide, within a specified time, notice of any action taken or proposed to be taken with respect to the recommendations; or reasons why no such action has been or is proposed to be taken; and
• The recourse, if any, that is available to the Federal Court under the Act.

The Commissioner may enter into a Compliance Agreement, enforceable by the Federal Court, whereby the respondent commits to implement certain measures with a view to resolving the complaint.

The Commissioner cannot impose fines for contraventions. However, the Federal Court, which is the next level of review, has the power to award damages to a complainant.

How long will an investigation take?

The OPC will conduct investigations in as timely a manner as possible. However, the following factors often determine how long an investigation will take:

• The volume of complaints and resource availability;
• The complexity of a case, or the number of issues to be investigated;
• The presentation of a legal issue, such as a matter of statutory or legal interpretation, that may need to be examined and settled;
• The level of cooperation or ease of communication with the parties; or
• Whether there are opportunities during the course of investigation for early resolution.

Under the Act, the Commissioner has one year to issue a report of findings.