Making a privacy complaint

Step 1: Contact the organization

Privacy laws provide the right to file a complaint about improper collection, use and disclosure of your personal information by a public or private sector organization, or about a decision made by an organization concerning a personal information request.

If you have a concern about the information handling practices of an organization, your first step is to contact the organization’s privacy officer and discuss your concern, or put your concern in writing as a complaint, and send the complaint to the organization’s privacy officer. The organization should have a process in place to receive and respond to complaints.

If the matter is not resolved to your satisfaction, you can contact the Office of the Privacy Commissioner of Canada or the Information and Privacy Commissioner of BC to make a complaint directly to that office. Remember that those Offices have authority over different types of organizations; if you are not sure which Office has authority in your circumstances, simply ask them and they will be able to tell you.

If you have not given the public or private body an opportunity to respond to and attempt to resolve your complaint, the Office of the Information and Privacy Commissioner (OIPC) will normally refer you back to the organization you are complaining about before the office examines your complaint.

Step two: Make a complaint to the Privacy Commissioner

To make a formal complaint about an improper collection, use or disclosure of your personal information or a decision that was made by a government or private sector organization concerning your personal information request, you will need to determine if the target of your complaint is a government body or private sector organization. This will help to identify the appropriate legislation under which to file your complaint, which you should cite if submitting a complaint in writing. If you wish to use a fillable form for a complaint in British Columbia, you do not need to cite legislation – just be sure you complete and send the correct form.

The following links will take you to websites that provide the steps to make a complaint about (1) the misuse of your personal information and or (2) a decision that was made by a government concerning your personal information request.

Making a privacy complaint about a federal organization

You have the right to make a complaint to the Privacy Commissioner of Canada if:

Your personal information has been collected, used or disclosed in a way that is not allowed under the Privacy Act (Canada);
You have been refused access to your personal information or the government has refused to make a correction you asked for, or you have any other complaint about requesting or obtaining access to your personal information;
You believe time limits for responding to your request have been extended unreasonably;
You have not been given access to your personal information in the official language or alternative format in which you requested it; or
You wish to make a complaint about any other matter relating to the collection, use, disclosure, retention or disposal of personal information by the government institution, or about a personal information index under s. 11 of the Privacy Act.

You have a right to authorize another person to submit a complaint on your behalf.

The Office of the Privacy Commissioner of Canada is responsible for investigating complaints under the Privacy Act. The investigators from the Investigations and Inquiries Branch of the Office do the investigations. Investigators consider the complaint, investigate the facts, including interviewing individuals and reviewing documents and other records, and, on that basis, will determine whether the complaint is “well-founded” or not.

If the investigation shows that your privacy has been violated, the investigator will try to find a remedy and prevent further violations. As an ombudsman, the Privacy Commissioner seeks to resolve disputes through mediation and other cooperative approaches.

If you were refused access to your personal information and you complained and have received the Commissioner`s report, you may apply to the Federal Court for a review. Generally, the time limit to apply for a review is within 45 days of receiving the Commissioners report, but that time may be extended by the Court.

You can obtain forms for submitting a complaint from the Privacy Commissioner under how to make a complaint under the Privacy Act. Alternatively, you may send a letter by mail to the Office of the Privacy Commissioner of Canada, explaining your problem and, if possible, the name of the government institution, the title and number of the information banks and other relevant details. Include copies of all letters you wrote or received about your request. Include a return address and phone number so the Commissioner’s office can contact you.

The Office of the Privacy Commissioner does not accept complaints by email.

Making a privacy complaint about a provincial organization

The BC Commissioner’s overriding policy is for you to attempt to settle your dispute with the public body first, before involving the Commissioner’s office. You may use the fillable forms here to submit your dispute to a public body.

Generally, complaints and requests for review should be in writing, but if you have difficulty reading or writing in English, the Commissioner’s office will assist you.

For personal information held by the provincial government or municipal governments and other public bodies in British Columbia, click here.

See below for other provinces:

Northwest Territories

Make a privacy complaint about a private sector organization

At this time (May 2014), there are four personal information protection acts covering private sector organizations in Canada. To file a complaint, please click on the relevant link for information on the Act and filing a complaint.

It is the BC Office of the Information and Privacy Commissioners (OIPC) policy to refer individuals back to the organization to try to resolve with the organization directly any disputes about how the individual’s personal information is being treated by the organization.

A pdf form to send a complaint to a Public Body is available here.

If you are not satisfied with how the organization responded to your complaint, you may launch a formal complaint to the OIPC. The OIPC does not accept complaints via e-mail. A pdf form to send a complaint to the OIPC about a public body is available here.

Further information about the complaints process can be found through these links:

The Office of the Privacy Commissioner of Canada guide to PIPEDA
Instructions on how to make a complaint with the OIPC
Instructions on how to make a complaint with the Office of the Privacy Commissioner of Canada

Make a privacy complaint regarding your personal health information

The following provinces in Canada have enacted legislation to deal specifically with the collection, use and disclosure of personal health information by provincial health care organizations and other approved individuals and agencies. Use these links to inquire about or to file a complaint concerning personal health information: Alberta, Saskatchewan, Manitoba, and Ontario.

If your province is not listed here, consult the section regarding complaints about public or private bodies.