File a privacy complaint about a business
Notice
We encourage complainants to use the OPC’s electronic on-line complaint filing service.
Learn how to file a complaint about how a business mishandled your personal information.
The Personal Information Protection and Electronic Documents Act (PIPEDA) sets out the rules for how private sector organizations collect, use or disclose your personal information. It also gives you the right to see the information held about you, with a few exceptions, and to request corrections.
If you think an organization covered by this Act is not living up to its legal responsibilities, you have the right to file a formal complaint.
To file a privacy complaint
- Check whether the PIPEDA applies
- Give the organization a chance to address your concern
- Learn about the complaint process
- Read the complaint form’s privacy statement
- Access the privacy complaint form
1. Check whether the PIPEDA applies
PIPEDA applies to many private-sector organizations in Canada, but not all. For example, Alberta, British Columbia and Quebec have private-sector legislation similar to PIPEDA. These acts may apply if the information is collected, used and disclosed entirely within the province.
PIPEDA only applies when personal information is collected, used or disclosed by an organization during a commercial activity, except in a few rare cases.
PIPEDA does not apply to not-for-profit and charity groups, associations or political parties unless the organization is conducting a commercial activity. Fundraising is not considered a commercial activity.
More information
- Find the right organization to contact about your privacy issue
- Provincial laws that may apply instead of PIPEDA
- The application of PIPEDA to charitable and non-profit organizations
- Summary of privacy laws in Canada
- Personal Information Protection and Electronic Documents Act (PIPEDA)
- Businesses and your personal information
2. Give the organization a chance to address your concern
We encourage you to try to resolve the concern directly with the organization before filing a complaint. We suggest raising your concern with the individual at the organization assigned to handle privacy matters, often called the Privacy Officer. Many issues can be quickly and effectively addressed this way.
More information
3. Learn about the complaint process
There is no charge for filing a complaint with our office. You also don’t need to hire a lawyer to help you. For information on filing a complaint:
- read the Guide to the PIPEDA complaint process
- call our office at 1-800-282-1376 (toll-free)
If you decide not to make a formal complaint, you still have the option to report your privacy concern to the OPC by:
- calling our office at 1-800-282-1376 (toll-free)
- filling out the online form to share a privacy comment or concern with the OPC
4. Read the complaint form’s privacy statement
When you fill out a complaint form, you are providing personal information. Please take a few moments to read our privacy statement before completing the form.
The following sections explain how we handle your personal information.
Why and how your information is collected
The information provided in the complaint form is collected to process your complaint. In order to investigate your complaint, we may also collect personal information about you from other parties to the complaint, including the organization your complaint is against. The information is collected under the authority of PIPEDA and the Privacy Act.
How your information is used
Your personal information is used to respond to, and investigate, your complaint. The information will be provided only to members of our staff who need it for this purpose.
Information about your complaint may also be used in:
- statistics used for reporting and managing our privacy compliance and promotion programs
- reports to Parliament, for example, annual reports with case summaries of investigations (with personal identifiers redacted)
- findings from investigations that are published on our website (with personal identifiers redacted)
- conducting audits and identifying and addressing general privacy issues
- quality control to ensure consistency in investigations
- training materials for investigators
- research and litigation
Your information will be used by Microsoft systems in order to enable the OPC staff to respond and investigate your complaint through Microsoft’s cloud services.
If you do not provide all the information required on the complaint form, we will not be able to process your complaint.
More information
- OPC sources of federal government information, Personal Information Banks OPC PPU 005 and OPC PPU 001
- Standard personal information banks (held by government institutions in general)
When your personal information is disclosed
The personal information you provide on our complaint form is protected by the Access to Information Act and the Privacy Act.
Please note that your name and the details of your complaint will be shared with the organization that is the subject of the complaint, except in extraordinary cases.
In accordance with s. 8(2) of the Privacy Act, the OPC may disclose your personal information without your consent, including to a Canadian or foreign investigative body in the context of a lawful investigation. Personal information in the custody of Microsoft may be accessed by law enforcement or national security authorities, including foreign authorities, without notice to you or the OPC.
Accessing or correcting your information
You have the right to request access to your personal information held by the OPC and also to request corrections to it if you believe that the information is erroneous or incomplete.
Where your information is stored
The information gathered in processing complaints is stored electronically on OPC servers, or on OPC premises in approved secure physical storage or on Microsoft data centers located in Canada. The data will be processed by Microsoft or its authorized third party subprocessors, both in Canada and the United States.
How your information is protected
We are committed to protecting the privacy of individuals. All personal information you provide on the complaint form, whether through our secure website or by mail, is protected under the Privacy Act.
All information that is stored on the Microsoft cloud is protected in accordance with contractual arrangements that are generally constrained to automated processing by Microsoft systems. Your personal information is not accessed by Microsoft employees (or by subprocessor employees) unless they have been given explicit, temporary, and limited access. This access is governed and controlled through technical means by OPC staff, and only required, as determined by the OPC (such as to provide the OPC with technical support).
For more information, including with respect to Microsoft’s retention practices, you can refer to Microsoft Products and Services Data Protection Addendum and Microsoft’s Product Terms.
Please note that all ways of communicating involve some risk that information may be misdirected or intercepted and manipulated. To protect personal information, we take security measures as described in the Policy on Government Security.
How long your information is kept
Information provided to file a complaint is kept for 10 years after a file is completed (including any court action). It is then destroyed.
Information provided for complaints that were not accepted for investigation is kept for 3 years after the file is completed. It is then destroyed.
If you have questions about this privacy statement
You may send questions about privacy issues to the Information Centre.
Toll-free line: 1-800-282-1376
Postal address:
Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, QC K1A 1H3
Please also read
- Our terms and conditions of use for our website privacy statement
- Our corporate Privacy Policy for our information management practices
You also have the right to file a complaint with the Ad Hoc Privacy Commissioner regarding the OPC’s handling of your personal information.
5. Access the privacy complaint form
Please choose one of these ways to file your complaint about an organization under PIPEDA. We encourage complainants to use the OPC’s electronic on-line complaint filing service.
File a complaint online
File a complaint by mail
- Download and complete either one of these forms:
- Type your information on the form and then print it
- Mail your complaint to the address on the form.
Accommodations
We are committed to ensuring that clients with disabilities can equally access all our public services. See the section, Accommodating clients with disabilities in our website terms and conditions of use for more information. If you need help filing a complaint:
Note
If you’re filing a complaint for someone else, you will need written approval from that person:
If you are not ready to file a complaint, but still have a question or concern:
- Date modified: