Complaint by Individual - s. 11(1)

• An individual may file a complaint with the Commissioner in writing against an organization for contravening sections 5-10 or for not following a recommendation in Schedule 1.
• In order for someone else to file a complaint on behalf of the individual, the individual must provide consent in writing before the Commissioner will proceed.
• Individuals may seek access to all their personal information held by organizations covered by PIPEDA. However, individuals can only complain of improper collection, use, disclosure or safeguarding practices that occurred as of January 1, 2001 for FWUBs, or January 1, 2004 in the case of non-FWUBs.
• Before filing an official complaint with the Commissioner, individuals are encouraged to bring their concerns to the organization and the organization is encouraged to address them.
• A complaint arising from a refusal to grant access must be filed within 6 months after the refusal by the organization or the expiry of the time limit for responding. The Commissioner has discretion to allow for a longer period of time.
• The Commissioner will notify the organization against which the complaint is made.

Individuals are asked to send their complaints in writing to the following address:

Office of the Privacy Commissioner
Investigations and Inquiries
112 Kent Street
Ottawa ON K1A 1H3

Ensure that full contact information is included. Please note that complaints submitted by email cannot be accepted at this time.

Commissioner-Initiated Complaint - s.11 (2)

If the Commissioner is satisfied that there are reasonable grounds to investigate a matter under Part 1 of PIPEDA, the Commissioner herself may initiate a complaint against an organization pursuant to subsection 11(2).

In order to initiate a complaint based on reasonable grounds, the Commissioner must believe, in good faith, and on the basis of some credible evidence, that there is a serious possibility that an investigation would disclose a contravention or intended contravention of the Act. Four criteria are typically applied to determine whether this threshold has been met:

• The Commissioner must exercise this discretionary enforcement authority in an honest and non-abusive manner;
• The Commissioner's discretion must be exercised on the basis of a clear record of facts and analyses which exists at the time the complaint is initiated;
• The information must be capable of being believed and the Commissioner must not be aware of any cogent reason for rejecting the information as lacking credibility;
• The Commissioner must be able to assert that, at a minimum, the information available is such that it could realistically lead investigators on a focussed train of enquiry which would reveal a contravention or intended contravention of the Act.

Investigation - s.12

• Once a complaint has been accepted (see inquiries), an investigator is assigned to the file.
• The investigator writes to the parties notifying them that a formal complaint file has been opened and outlining the substance of the complaint.
• The investigator gathers the facts related to the complaint.
• The investigator has the delegated authority to receive evidence from witnesses including on oath or by affidavit, may converse in private with any person, may enter premises at any reasonable time, and may examine or obtain copies of records found on the premises.
• Where necessary, the Privacy Commissioner or her delegate may order individuals to appear before her and compel them to give oral or written evidence and to produce any records she considers necessary for the investigation.
• Once the necessary evidence has been gathered, the investigator may contact both parties to review the facts and seek their input, as necessary and appropriate.
• The investigator analyses the facts; the investigator may request internal consultations with the Legal and Policy or the Research and Analysis Branches, as necessary.
• The investigator will inform the parties what s/he will likely be recommending to the Privacy Commissioner, based on the facts and analyses, at which point the parties may make further representations for the investigator's consideration.
• Based on all of the above, the investigator prepares an investigation report containing his/her recommendations to the Privacy Commissioner.

Report not required - s. 13(2)

The Commissioner is not required to prepare a report of findings if she is satisfied that:

• The complainant could ought first to exhaust grievance or other review procedures before proceeding under PIPEDA;
• The complaint could more appropriately be dealt with, initially or completely, under another provincial or federal law;
• The length of time that has elapsed between the date when the subject matter of the complaint arose and the date that the complaint is filed is such that a report would serve no useful purpose; or
• The complaint is trivial, frivolous or vexatious or is made in bad faith.

If no report is prepared, the Commissioner shall inform the complainant and the organization and give reasons.

Early Resolution or Settled

Early resolution applies to situations where the issue has already been addressed before a formal investigation is undertaken. For example, the issue may already have been fully dealt with in the context of another complaint and the organization has corrected its information management practices to the satisfaction of the complainant and the Commissioner.

A complaint may likewise be settled during the course of the investigation, where the investigator has helped negotiate a mutually-agreeable solution that satisfies all the parties. Both the Commissioner and the complainant must be satisfied with the actions taken by the organization in order for a complaint to be considered settled.

The Commissioner does not issue formal findings in these instances. For more information on Settled and Early Resolution cases, see http://www.privcom.gc.ca/ser/index_e.asp

Complaint is Withdrawn or Discontinued

• A complainant may withdraw a complaint if, for example, s/he decides not to pursue it any further.
• A complaint may be discontinued if a complainant cannot be contacted because of re-location for example.
• In such cases, no formal findings are issued, and the organization is so notified.

Commissioner's Report and Findings - ss. 13(1) & (3)

The Privacy Commissioner reviews the investigator's report, together with the complete file of related documents. Ultimately, it is the Privacy Commissioner (not the investigator) who decides what her findings in a case will be.

Where the results of the investigation indicate that the complaint is indeed well-founded, the Privacy Commissioner will typically, before issuing her final letter of findings, send a preliminary letter to the organization setting out her recommendations on how the matter may be resolved. The Privacy Commissioner gives the organization thirty (30) days in which to implement these recommendations, or indicate how it intends to do so. Upon expiry of this time period, the Privacy Commissioner will consider the organization's response to her preliminary letter before finalizing her letter of findings.

The Commissioner decides the ultimate outcome and prepares a final letter of findings for both parties that contains:

• The basis of the complaint, the facts, and the analyses;
• Any early settlement that may have been reached by the parties on any related portion of the complaint;
• The Commissioner's findings;
• The Commissioner's recommendations in well-founded cases, taking into consideration the organization's response to her preliminary letter;
• Further recourse available to the individual complainant under section 14 of PIPEDA which allows him or her to apply to the Federal Court for a hearing of the matter; and,
• In well founded cases, that remain unresolved despite the Commissioner's recommendations to the organization, the Commissioner may indicate her intention to further pursue the matter in accordance with her authority under the Act.

Not well-founded

The investigation did not uncover sufficient evidence to conclude that the organization violated its responsibilities under PIPEDA.

Well-founded

The investigation found sufficient evidence to conclude that the organization contravened a provision in sections 5-10 or did not follow a recommendation in Schedule 1 of PIPEDA.

Resolved

During the course of the investigation and prior to its conclusion, the organization took or committed to take corrective action to remedy the situation to the satisfaction of the Commissioner.

Well-founded and resolved

The investigation found sufficient evidence to conclude that PIPEDA was indeed breached; the Commissioner made a recommendation to the organization for corrective action in her preliminary letter, which the organization took or committed to take to the satisfaction of the Commissioner.