Investigations into businesses
The Office of the Privacy Commissioner of Canada (OPC) conducts independent and impartial investigations into the personal information handling practices of businesses subject to the Personal Information Protection and Electronic Documents Act (PIPEDA).
The OPC publishes a selection of case summaries and findings from its investigations to provide concrete examples of how PIPEDA applies to the day-to-day management of personal information by businesses.
For each case, the Office indicates the outcome using a set of defined terms for findings and dispositions.
For more information about the complaint and investigation process, read How the OPC Enforces PIPEDA.
Note: Complainants are not named in the summaries or reports. The organizations are not identified unless the Privacy Commissioner of Canada has deemed it to be in the public interest to do so.
Disclaimer: Typographical errors have been corrected from the original version of the report of findings. They are indicated in [brackets].
Overview of the Joint Investigation of OpenAI OpCo, LLC
..., including publicly accessible Internet sources (which represent the vast majority of OpenAI’s training... of information collected from publicly accessible Internet sources and licensed third parties. At the time... that violated its policies – from the raw public data to reduce the processing of personal information...
Joint Investigation of OpenAI OpCo, LLC
...Overview Will only be included in the report to be sent to OpenAI / Separate document for publication... the completion of the recapitalization of its for-profit enterprise, which is now a public benefit... a better understanding of OpenAI’s threshold for determining who is a public individual, and more generally interacting...
Compliance Letter to the Office of the Privacy Commissioner of Canada (“OPC”) By Nova Scotia Power
...that he receives on the matter. This letter, or part thereof, may be disclosed or made public by the Commissioner... information, but no evidence has yet emerged that this sensitive data has been made public or sold..., three days after discovering the breach, Nova Scotia Power informed the public about the breach...
Investigation into the personal information retention practices of Loblaw for the PC Optimum Loyalty Program
...and public network IP address as well as frequency, duration and time of logins); Browsing behaviour... sufficient anonymization for the following reasons: First, Loblaw retains public IP address data... given that an individual’s public IP address can be used to approximate their physical location, which, when cross...
Joint investigation of TikTok Pte. Ltd. by the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the Office of the Information and Privacy Commissioner for British Columbia, and the Office of the Information and Privacy Commissioner of Alberta
...on public policy issues at the federal and provincial levels. TikTok explained to the Offices... that does not publicly report its global revenue, unconfirmed estimates placed global revenue... of public facing documents, age ratings and informational publications, in addition to in-platform tools...
Investigation and recommendations concerning Google search engine service’s compliance with its obligations under PIPEDA
...after the charge was laid as the relevant Public Health Authority was satisfied that the Complainant did not pose a current risk to public health. The federal, Quebec, Ontario, and British Columbia Attorneys..., as we have found in this case, harms to their safety or dignity – that outweigh any public interest...
Joint investigation into a data breach at 23andMe by the Privacy Commissioner of Canada and the UK Information Commissioner
...This joint investigation was publicly announced on June 10, 2024,Footnote 10 and is a demonstration... appropriate security alerts, for review by the security operations team; and a public bug bounty...
Investigation into Aylo (formerly MindGeek)’s Compliance with PIPEDA
...According to its public-facing “Insights” reports, Pornhub claims that it had a billion visits.... MindGeek acted, usually within a day or less after receiving the takedown requests, to disable public... on certain publicly available information cited in this report and our own technical analysis...
Investigation into Agronomy’s privacy practices related to safeguards, accountability valid consent for the collection and use of personal information
..., in June 2020. Following this publication, Agronomy was able to recover a copy of the stolen data.... There are many publicly available standards, guidance documents and benchmarks available from organizations...
Investigation into Home Depot of Canada Inc.’s compliance with PIPEDA
...an internal miscommunication. Return to footnote 3 Footnote 4 Meta indicated that it publicly...
Showing items 1 through 10 of 68.
- Date modified: