What to expect during a complaint investigation under the Privacy Act
If you have made or are thinking about making a complaint under the Privacy Act, you might have questions about what comes next and what results you might expect from an investigation.
This guide will help answer your questions about the process, what an investigation can (and can't) achieve, what to expect from the Office of the Privacy Commissioner of Canada (OPC) and what's expected from you and the federal institution about which the complaint was made.
What is the Privacy Commissioner's role?
As an Officer of Parliament, the Privacy Commissioner of Canada conducts independent and impartial investigations of complaints received under section 29 of the Privacy Act against federal government institutions. In broad terms, complaints can be related to denial of access to personal information, or to matters relating to the protection of personal information, such as improper collection, use, disclosure, retention or disposal.
The OPC is committed to carrying out its mandate in a manner that ensures the fair and equitable distribution of available resources amongst all complainants.
We use a calibrated approach when assessing and investigating complaints, giving consideration to the impact on the complainant and on the public. When, for example, a complaint raises important systemic issues that affect large numbers of individuals, it will be given a higher priority and greater resources. This enables the Office to best serve the public interest by responding effectively to privacy matters of greatest and emerging concern.
As an ombudsman, the Commissioner takes a cooperative and conciliatory approach to investigating complaints whenever possible and encourages resolution through voluntary cooperation to satisfactorily address your concerns.
What organizations fall under the Privacy Act?
The Privacy Act applies to federal "government institutions", which include departments, ministries, agencies or offices listed in the Privacy Act Schedule of Institutions, as well as most Crown corporations and their wholly-owned subsidiaries. It applies to all of the personal information that these institutions collect, use and disclose — be it about members of the public or federal employees.
If you submit a complaint to our Office under the Privacy Act about an organization to which the Act does not apply, we will be unable to proceed with any action. In order to help determine where to turn to address a concern with an organization outside the scope of the Privacy Act, please refer to our fact sheet, Overview of privacy legislation in Canada.
How does the OPC conduct investigations?
The Commissioner has flexibility in determining how investigations will be conducted, and where possible encourages that complaints be resolved at an early stage of the investigation process.
This "early resolution" approach is consistent with the Commissioner's role as an ombudsman in overseeing the federal government's compliance with its obligations under the Act. For those complaints resolved through an "early resolution" investigation, a complainant's concern can be addressed quickly and no formal findings are issued.
Where early resolution is not suitable or possible, a standard investigation will be conducted. This process requires more time than early resolution, and may require extensive consultations and analysis to determine whether a complainant's privacy rights have been contravened under the Privacy Act. When a standard investigation is conducted, the individual and the institution involved in the complaint will receive a Report of Findings.
What are the benefits of early resolution?
A fair, timely and resolution-oriented complaint process benefits complainants and government institutions. When successful, early resolution is the best possible outcome for all concerned. For individuals who lodge a complaint under the Privacy Act, it means getting the answers they seek quickly. For government institutions, it means avoiding an often lengthy and resource-consuming process.
How does the early resolution process work?
Upon receipt, all complaints are examined to see if they could be candidates for early resolution. Considerations include the apparent complexity of the case, whether it appears to involve issues previously examined and addressed by the OPC, and whether the allegations could be easily remedied.
With early resolution, the OPC seeks to provide a timely resolution of the complainant's concerns, without conducting an extensive investigation or issuing a standard Report of Findings.
For example, an individual may complain about an issue the OPC has already investigated and found to be compliant with the Privacy Act, and we explain this to the individual. If departments were found in similar circumstances to have complied with the Act, potential complainants often agree there is little point in going ahead with an extensive investigation. Or, a government institution, on learning of allegations against it, may address them immediately to the satisfaction of the complainant and the OPC.
We also receive complaints in which proceeding with a standard investigation could have adverse implications for the individual. For example, in order to enable the institution to understand and respond to a complaint, the OPC may need to provide it with information that a complainant would prefer not to share with the institution. We discuss this with the individual and should he or she choose not to proceed further, the file is closed.
In all cases, the OPC aims to ensure that government institutions are acting in accordance with the Privacy Act, and that the complainant is satisfied with the explanation or outcome.
What can a standard investigation and Report of Findings ultimately achieve?
A standard investigation resulting in a Report of Findings seeks to establish whether your privacy rights have been contravened under the Privacy Act. If there have been contraventions, the investigation process seeks to address your specific concerns and prevent contraventions from recurring.
As an ombudsman, the Commissioner does not have order-making powers under the Privacy Act, and, as a result, cannot force a government institution to take any specific action. The Commissioner makes findings and recommendations where appropriate and works with government institutions towards implementing improvements to their personal information management practices.
Recommendations are limited to achieving compliance with the Privacy Act, and may be related either to the institution's privacy management practices or to the specific matter involving the individual complainant. Broader forms of individual redress cannot be obtained through the Privacy Act complaint investigation process. For example, the Privacy Act does not give our Office the ability to fine organizations or seek damages on behalf of individuals. Furthermore, we do not address criminal or civil culpability on the part of federal government institutions, or employees.
Since an investigation is limited to establishing whether an individual's privacy rights have been violated under the Privacy Act, it may not resolve all issues which are important to the complainant. Other avenues may need to be pursued where the issue relates to matters outside of the Privacy Act.
Is any kind of court action possible following an investigation?
Upon completion of the Privacy Commissioner's investigation, the Privacy Act provides a limited right to court review. This is available only in situations involving denial of access to personal information.
For further information see: Court Applications under section 41 of the Privacy Act
What is the investigator's role?
If early resolution is possible, the investigator will discuss the issue with the complainant and institution and help identify a solution that satisfies both parties without the need for a standard investigation being undertaken.
Under a standard investigation, the investigator's job is to gather and analyze the facts related to the complaint and prepare a Report of Findings for consideration by the Privacy Commissioner or the Commissioner's delegate. This Report is based on an analysis of the facts within the framework of the Privacy Act.
Investigation of a complaint will usually be handled by a single investigator who will:
- clarify the complaint with the complainant where necessary to clearly identify the issues for investigation;
- determine the best approach for conducting the investigation;
- communicate with the complainant and the respondent government institution as necessary to gather the facts and obtain representations from both parties;
- examine relevant records and carry out all necessary interviews;
- conduct an analysis of the information obtained during the investigation;
- determine the basis for findings and recommendations for consideration by the Privacy Commissioner or delegate.
As an ombudsman, the Privacy Commissioner focuses on resolving complaints through negotiation and voluntary co-operation, rather than through use of the formal investigation powers contained in the Privacy Act. However, the investigator has the authority through the Privacy Commissioner to receive evidence, enter premises where appropriate, and examine or obtain copies of records found on any premises during the course of an investigation.
What is your role as a complainant?
Before filing a complaint with us, we encourage you to first try resolving the matter with the help of the Access to Information and Privacy (ATIP) Coordinator of the institution responsible for the personal information at issue. To find the right contact, consult this list provided by Treasury Board Secretariat.
The OPC has flexibility in determining how a complaint investigation will unfold. This includes both the investigation process and timelines. The OPC will request that you provide clear information where needed and to participate in the investigation process by:
- ensuring that the complaint is concise, clear and complete, and that all relevant supporting documentation has been provided - for example, for denial of access or time limit complaints, you should include a copy of the response letter received from the government institution. If you are unclear about the documentation that may be required, we encourage you to contact our Office or the investigator assigned;
- further clarifying the issues in the complaint when requested by the investigator, or asking for help from the investigator if needed to do this;
- providing the OPC with the requested information in an organized and timely manner; and
- cooperating and assisting the investigator as needed throughout the investigation process.
Is there a limit to the number of complaints I can submit?
The Privacy Act gives individuals a right to file complaints, and under section 29 of the Act, the Commissioner shall receive and investigate those complaints. However, the OPC may not be able to give equal priority to all of your complaints.
Section 32 of the Act allows the Commissioner to determine the procedures to be followed in a complaint investigation. Where a complainant has filed numerous complaints, the OPC will determine a suitable approach for managing the investigations while respecting your right to file complaints under the Act.
The OPC will work with you to prioritize complaints, as we may not be in a position to investigate all of your complaints immediately. On occasion, we may defer investigating new complaints you submit until your existing complaints have been completed. This enables the OPC to ensure fair distribution of resources amongst all complainants.
With this approach, our Office can better balance the needs of all complainants, ensuring that all Canadians have access to our services, and that complaints are treated in a fair and timely manner.
The OPC will work with you to ensure that your interests are being served as effectively as possible.
What is the government institution's role?
The respondent institution should provide, on a timely basis:
- a clear description of the relevant facts and circumstances related to the complaint;
- copies of any documentation relevant to the matter under investigation, including any correspondence between the institution and complainant, and relevant departmental policies or procedures;
- a clear statement of the institution's position concerning the allegations, through representations that have received proper consideration and consultation at the appropriate level within the institution; and
- specifics of any action taken to date, or planned to be taken, to address the subject matter of the complaint.
Early investment of effort and cooperation by the institution in responding to a complaint will facilitate the investigation process. Good representations may enable the investigator to fully address the complaint from the outset.
In cases where the respondent institution does not provide a timely or adequate response, the OPC may formally request representations from the head of the organization. This may also occur where the issue under investigation has high significance and potentially important implications for the complainant, the institution, or the Government of Canada as a whole.
Delays in providing relevant and focused information will cause greater investment of effort for all participants in the process. Where the institution has not represented its position fully and accurately, this may even result in an unfavorable finding for the institution.
When will the investigation be complete?
Some complaints can be easily resolved, whereas others may require extensive investment of time and resources. In all cases, the OPC investigates complaints in as timely a manner as possible. Every case is different, so it's difficult to predict the exact length of time. Typically, an investigation may take several months; however, the time required varies according to the complexity of the issues raised.
The following factors may determine how long an investigation will take:
- the volume of complaints and resource availability;
- the complexity of a case, or the number of issues to be investigated;
- the level of cooperation or ease of communication with the parties;
- the availability of witnesses and documentary evidence;
- the completeness and quality of the information provided by the parties;
- the presence of a legal issue that may need to be examined and settled; and/or
- the opportunity during the course of investigation for early resolution.
The timeliness of investigations is an issue we take very seriously and we are committed to completing a full and thorough investigation as quickly as possible.
- Date modified: