- Guidance for Organizations
-
Access to information
- Open government
- Responding to access requests
- Appeals
- Annual Statistical Reporting FAQ
- Interpretation bulletins
- Tribunal and Dispute Resolution Division policies
- Code of Procedure
- Part X of the Child, Youth and Family Services Act: A Guide to Access and Privacy for Service Providers
- CYFSA FAQ: Information for service providers
- Protection of privacy
- Health privacy
- Policy Consultations
Privacy complaints
When an individual feels that their personal information has been collected, used or disclosed by a government institution in contravention of privacy and access laws, they should call, write or visit the government office that has possession of the information to try to resolve the matter. If they can’t resolve it directly, they may file a privacy complaint directly with our office.
IPC jurisdiction
The IPC has jurisdiction over access to information and privacy concerns related to:
- all provincial ministries
- most provincial agencies, boards and commissions
- universities and colleges of applied arts and technology
- local government institutions, such as municipalities, police, library, health, and school boards, and transit commissions
The IPC has jurisdiction concerning the collection, use, and disclosure of personal health information by hospitals and other health care providers.
Intake
Privacy complaint files are reviewed by the IPC Registrar and a team of analysts, who will ensure that the complaint falls within IPC’s jurisdiction. If it doesn’t, the complaint may be screened-out at the intake and early resolution stage. A complaint may be screened out for other reasons.
Before deciding if a file should be screened out, the analyst will:
- contact the complainant to clarify the details of the privacy complaint
- explain the IPC procedures
- contact the institution to discuss the complaint and gather additional information
Early resolution
Some privacy complaints can be resolved quickly without having to go through a formal investigation. In these cases, the Registrar will refer the case to an analyst who will work on an informal settlement with the parties involved
Investigation
If the privacy complaint is not dismissed or settled through Early Resolution, it will be assigned to an investigator. The investigator will clarify the complaint, contact the parties, gather information, and attempt a settlement. If a settlement is not possible, the investigator may issue a Draft Privacy Complaint Report to the parties.
Draft privacy complaint report
After reviewing the facts, an investigator may send a Draft Privacy Complaint Report to the parties, which includes:
- a summary of the complaint
- a discussion of the information collected as part of the investigation
- the investigator’s conclusions and recommendations (if any) to the parties
The parties can comment on any factual errors and/or omissions in the Draft Privacy Complaint Report.
Final privacy complaint report
Final privacy complaint report
At the end of the investigation, the investigator will send the finalized Privacy Complaint Report to the parties under his/her signature, with the endorsement of the Assistant Commissioner or Commissioner.
The investigator will also follow-up with the institution to ensure that any recommendations have been implemented.