Protecting your Private Information in Ontario

Privacy Law in Ontario
by Shaya Silber

As we move forward into an age where growing portions of our lives are becoming digitized, many holes are becoming apparent in these new information systems. A lot of these holes revolve around issues of personal information and privacy. Because this scenario is relatively new, many people including policy makers, academics, lawyers and so on, are grappling with the consequences; and more importantly, with avenues by which to remedy apparent wrongs.

Privacy Complaints

Generally speaking, a complaint can be launched where someone’s personal information was collected, used or disclosed in an improper manner. There are two approaches that Ontario residents can take with regards to complaints relating to violations of their privacy.

Ontario – Information and Privacy Commissioner

The first avenue is Ontario’s Information and Privacy Commissioner (IPC). Ontario’s Commissioner hears complaints that violate the Freedom of Information and Protection of Privacy Act (FIPPA), Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), and in some circumstances Personal Health Information Protection Act (PHIPA).

When a complaint is filed with the IPC, one of three things may happen. The complaint can be settled, dismissed or launched into an investigation. If an investigation is launched, the IPC will examine the situation and prepare a “Privacy Complaint Report.” The report is provided to the parties, and may contain recommendations. However, the Commission does not have the authority to award damages, nor is the report binding on the parties.

At the moment, Ontario’s Information and Privacy Commissioner only deals with violations of privacy where the alleged violation was made by a government body.

It is expected that the Information and Privacy Commissioner’s will be expanded to examine beyond the scope of government violations. But for now, it does not apply to violations of privacy between individuals or businesses.

Federal – Office of the Privacy Commissioner of Canada

The second avenue is the Federal Office of the Privacy Commissioner of Canada (OPC). The OPC primarily overseas the implementation of the Personal Information Protection and Electronic Documents Act (PIPEDA), and the Privacy Act.

Unlike its Ontario counterpart, the Privacy Commissioner of Canada’s mandate extends beyond privacy violations by government bodies. The Federal Office of the Privacy Commissioner examines complaints that allege violations by private organizations and individuals, with a few exceptions. PIPEDA provides the right for individuals to know when and why their personal information is being collected, used or disclosed. It also provides recourse for any use of personal information for a purpose other than what was consented to.

When a complaint is filed with the Federal Office of the Privacy Commissioner, an investigation may be launched. The Privacy Commissioner’s investigation is impartial with respect to the parties involved. Upon concluding the investigation, the Privacy Commissioner will prepare a report. The report may contain recommendations for the parties, and request that the organization provide notice of any action taken with respect to the recommendations. Finally, in some circumstances, the report may discuss the recourses, if any, that may be able available at the Federal Court.

In most cases, courts are unwilling to award any monetary damages pursuant to violations of PIPEDA. However, in a recent case, the Federal Court awarded $5,000.00 to an individual who was denied a loan due to incorrect information provided by the credit bureau. This seems to indicate a new approach to privacy law in Canada. It will be interesting to see how future cases apply damages in these circumstances.