Question 1

What is PIPEDA and when does it apply to me?

Accepted Answer

PIPEDA is Canada's federal Personal Information Protection and Electronic Documents Act. It applies to private sector organizations that collect, use, or disclose personal information in the course of commercial activity anywhere in Canada except where a province has enacted substantially similar legislation (British Columbia, Alberta, and Quebec). PIPEDA also applies to all businesses that move personal information across provincial or national borders, to federally regulated industries (banks, airlines, telecommunications, interprovincial transportation), and to federal works, undertakings, and businesses. It gives you the right to know what personal information a company holds about you, to access and correct it, to withdraw consent, and to complain to the Office of the Privacy Commissioner of Canada if an organization mishandles your data.

Question 2

What is the difference between the Privacy Act and PIPEDA?

Accepted Answer

The Privacy Act governs how the federal government handles personal information. It covers over 250 federal institutions including the Canada Revenue Agency, Immigration Refugees and Citizenship Canada, Service Canada, the RCMP, and CSIS. PIPEDA governs how private sector organizations handle personal information during commercial activity. In short, the Privacy Act is for the federal public sector and PIPEDA is for the private sector. If you want to access records held by a federal ministry, you file a Privacy Act request (also known as an ATIP request). If you want to access records held by a company, you file an access request under PIPEDA or the applicable provincial private sector law. Different Commissioners, timelines, and appeal routes apply.

Question 3

Which law applies if I live in British Columbia, Alberta, or Quebec?

Accepted Answer

If you live in British Columbia, Alberta, or Quebec, your province has its own private sector privacy law that is recognized as substantially similar to PIPEDA. BC and Alberta use the Personal Information Protection Act (PIPA). Quebec uses An Act respecting the protection of personal information in the private sector, substantially modernized by Law 25 (formerly Bill 64) in 2022 to 2024. These provincial laws apply to most private sector activity in each province, so you complain to your provincial Commissioner (OIPC BC, OIPC Alberta, or CAI Quebec) rather than the federal OPC. PIPEDA still applies to federally regulated industries (banks, airlines, telecoms) and to interprovincial or international data flows.

Question 4

How do I request a copy of my personal information from a company?

Accepted Answer

To request a copy of your personal information from a private company, submit a written access request to the organization's Privacy Officer or Chief Privacy Officer. Include your full legal name, any account numbers or identifiers the company uses for you, your contact information, and a clear description of the records you want. You may request a specific category (account notes, marketing communications, call recordings, security camera footage) or all personal information held about you. The organization has 30 days under PIPEDA to respond; provincial laws may vary (BC and Alberta 30 days, Quebec Law 25 requires 30 days). Most organizations cannot charge a fee for a first access request. If access is refused, partially redacted, or ignored, escalate to the applicable Privacy Commissioner.

Question 5

How do I file an ATIP request for records held by the federal government?

Accepted Answer

An Access to Information and Privacy (ATIP) request is the formal way to request records held by federal institutions. Use the Access to Information and Personal Information (ATIP) Online Request Service at canada.ca, or submit the Access to Information Request Form (for general records) or the Personal Information Request Form (for your own personal file) directly to the institution's ATIP office. The fee is typically 5 dollars, waived in some circumstances. The federal institution has 30 days to respond and may extend for good reason. If you are refused, receive heavy redactions, or face unreasonable delays, you can complain to the Office of the Information Commissioner (for general records) or the Office of the Privacy Commissioner (for personal information) within 60 days.

Question 6

Can I correct inaccurate information in my file?

Accepted Answer

Yes. Under every Canadian privacy law, you have the right to request correction of personal information that is inaccurate, outdated, or incomplete. Submit a written request to the organization or institution identifying the specific errors and the correct information with any supporting documentation. The organization must either make the correction or, if it disagrees, attach your statement of disagreement to the record and notify any third parties to whom the information has been disclosed. This applies to credit reporting agencies (Equifax and TransUnion), health records under PHIPA, immigration files, and any other personal information database. If the organization refuses to correct obvious errors, escalate to the applicable Privacy Commissioner.

Question 7

Are Canadian websites required to obtain my consent for cookies?

Accepted Answer

Canadian law does not impose a blanket cookie consent requirement equivalent to the EU's ePrivacy Directive, but PIPEDA does require meaningful consent for the collection and use of personal information, which often includes cookie-based tracking that identifies or profiles you. The Office of the Privacy Commissioner has issued guidance stating that for tracking cookies used for behavioural advertising or profiling, organizations should obtain opt-in consent, clearly explain the purposes, and provide a meaningful opt-out. Strictly necessary cookies (session authentication, cart functionality) generally do not require separate consent. Quebec Law 25 applies stricter rules requiring explicit consent and clear purpose disclosure for any identification or profiling technology.

Question 8

Can a company share my information with third parties without my consent?

Accepted Answer

Generally no. Under PIPEDA and all provincial privacy laws, an organization must obtain your knowledgeable consent before sharing your personal information with a third party, unless a specific statutory exception applies. Common exceptions include: disclosure required by law (court order, subpoena), disclosure to a government institution for an investigation, disclosure to a service provider performing functions on the organization's behalf with equivalent protections, or disclosure with de-identification that prevents re-identification. Even where an exception applies, organizations must limit disclosure to what is necessary for the stated purpose. Mass data-sharing agreements, data broker sales, or affiliate marketing typically require your specific consent.

Question 9

What is CASL and how does it protect my inbox?

Accepted Answer

CASL is Canada's Anti-Spam Legislation, in force since 2014. It prohibits sending commercial electronic messages (emails, texts, social media DMs, push notifications) to Canadian recipients without consent, requires every message to identify the sender and include a working unsubscribe mechanism for at least 60 days, and prohibits installing computer software on your device without informed consent. Violations carry administrative penalties up to 10 million dollars per violation for organizations and 1 million for individuals. You can report suspected violations to the CRTC Spam Reporting Centre at fightspam.gc.ca. Unsubscribe requests must be honoured within 10 business days or the sender commits a separate violation.

Question 10

What should I do if I receive a data breach notification?

Accepted Answer

If you receive a breach notification from a company or government institution, do the following: First, read the notice carefully to understand what categories of your personal information were exposed (name, email, financial data, health data, government ID). Second, change any passwords associated with the breached account and enable two-factor authentication. Third, if financial data was exposed, place a free fraud alert on your credit file with Equifax and TransUnion Canada, and monitor your accounts for unauthorized activity. Fourth, ask the organization what credit monitoring or identity protection they are offering at no cost. Fifth, preserve the breach notification in case you later file a complaint with the Privacy Commissioner or seek damages in Federal Court. Under PIPEDA s.14 you can apply to the Federal Court for damages after the Commissioner has issued findings.

Question 11

When must a company notify me about a breach of my data?

Accepted Answer

Under PIPEDA since November 2018, a private sector organization must notify you of any breach of security safeguards involving your personal information where the breach creates a real risk of significant harm (RROSH) to you. RROSH factors include the sensitivity of the information, the probability it has been misused, and the bodily or emotional harm, humiliation, damage to reputation, loss of employment, financial loss, or identity theft that could result. The notification must include enough information for you to understand what happened and to take protective steps. Similar mandatory breach notification exists under Alberta PIPA, Quebec Law 25, PHIPA for health records, and the Privacy Act for federal institutions. Breach reporting to the applicable Privacy Commissioner is also mandatory in these regimes.

Question 12

Someone shared my intimate images without my consent. What can I do?

Accepted Answer

Sharing intimate images of a person without their consent is a criminal offence under Section 162.1 of the Criminal Code, carrying up to five years imprisonment on indictment. Do the following: preserve evidence (screenshot URLs, save messages, do not forward the image), report to local police (most major police services have cybercrime or internet child exploitation units that investigate these offences), request takedown from the platform (most major platforms have dedicated non-consensual intimate image removal forms, and the Canadian Centre for Child Protection operates NeedHelpNow.ca for minors), and consider a civil action (Ontario courts recognize intrusion upon seclusion per Jones v. Tsige 2012 and public disclosure of private facts as torts with damages). Several provinces also have specific civil legislation (Manitoba's Intimate Image Protection Act, Alberta's Protecting Victims of Non-Consensual Distribution of Intimate Images Act).

Question 13

How do I get a copy of my medical records?

Accepted Answer

To access your medical records, submit a written request to the health information custodian's Privacy Office or Health Information Management department. Custodians include hospitals, physicians, pharmacists, long-term care homes, and community clinics. Under Ontario's PHIPA you are entitled to receive a copy within 30 days, usually at no cost for the first copy. Similar rights exist under Alberta's HIA, Saskatchewan's HIPA, Manitoba's PHIA, Nova Scotia's PHIA, and other provincial health privacy statutes. The custodian can only refuse access in limited circumstances (risk of serious harm to you or a third party, confidential information about a third party, or ongoing legal proceedings). If refused or delayed, escalate to the provincial Information and Privacy Commissioner.

Question 14

What is the lockbox and how does it work under PHIPA?

Accepted Answer

The lockbox (a Section 20 express instruction under PHIPA in Ontario and similar provisions in other provinces) allows you to instruct a health information custodian not to disclose specified personal health information to other providers. For example, you can instruct your family doctor not to share your mental health history with a specialist. The custodian must honour the instruction subject to exceptions such as emergency care where withholding information would harm you. When a custodian is asked to disclose and you have used the lockbox, they will advise the requesting provider that information is being withheld at your instruction without disclosing the specifics. To use the lockbox, write to the custodian identifying exactly what PHI should be withheld from which providers.

Question 15

Can hospital staff get in trouble for looking at my chart without a reason?

Accepted Answer

Yes. Unauthorized access to electronic medical records, commonly called snooping, is a serious offence under Canadian health privacy laws. Under Ontario's PHIPA, custodians must report privacy breaches including unauthorized access to the Information and Privacy Commissioner, and the Commissioner can prosecute the individual employee. Penalties include fines up to 200,000 dollars for individuals and 1 million for organizations, plus professional discipline through regulatory colleges (College of Nurses, College of Physicians and Surgeons). If you believe your record was accessed without authorization, request an audit trail from the custodian showing who viewed your chart and when, and if unexplained access appears, report it to the IPC Ontario. Similar protections and reporting obligations exist under Alberta's HIA and other provincial health privacy statutes.

Question 16

Can my employer monitor my email, files, or internet use at work?

Accepted Answer

Employers generally can monitor workplace communications and devices, but only with reasonable notice, a legitimate business purpose, and proportionality between the monitoring and the purpose. Under Alberta PIPA and BC PIPA, employers must collect, use, and disclose employee personal information only for reasonable purposes, give notice, and minimize collection. Federally regulated employers are subject to PIPEDA. In Ontario, the Working for Workers Act, 2022 requires employers with 25 or more employees to have a written policy disclosing all electronic monitoring. If your employer monitors without notice, monitors content unrelated to work, or uses surveillance to target specific individuals, this may breach privacy law and you can complain to the applicable Privacy Commissioner (provincial OIPC for PIPA provinces, federal OPC for PIPEDA-covered employers).

Question 17

Can my employer require me to provide a medical note or see a specific doctor?

Accepted Answer

Employers have a legitimate interest in confirming fitness for duty and validating sick leave absences, but this interest is limited. Generally, employers can ask for a medical note confirming that you were unable to attend work and when you can return, but they cannot demand your diagnosis, medical history, or treatment details unless you are seeking an accommodation. In that case, information provided must be limited to what is necessary to assess accommodation needs. Employers who collect more medical information than reasonably required, or who fail to keep it confidential, may violate PIPEDA or provincial equivalents. Mandatory employer-selected doctors (independent medical exams) are only permissible in limited circumstances typically under workers' compensation, disability management, or collective agreements.

Question 18

What can I do if my workplace has hidden cameras?

Accepted Answer

Hidden or covert surveillance in the workplace is only permissible in very narrow circumstances (active investigation of specific wrongdoing, reasonable alternatives exhausted, narrowly tailored in time and scope). General hidden surveillance of employees violates privacy law in almost every Canadian jurisdiction. If you discover hidden cameras: document the location and any evidence of monitoring without disturbing the device; report to the workplace health and safety committee and to HR in writing; if you are unionized, file a grievance; complain to your provincial Privacy Commissioner (OIPC BC and Alberta have explicit jurisdiction over employee information, IPC Ontario covers public sector employees, federal OPC covers federally regulated employees). Workplace surveillance of washrooms, change rooms, or rest areas is essentially never permissible and may also engage Criminal Code voyeurism provisions.

Question 19

How do I file a privacy complaint with a Privacy Commissioner?

Accepted Answer

Filing a privacy complaint is free. First, try to resolve the issue directly with the organization through its Privacy Officer. If the issue is not resolved within a reasonable time, file a written complaint with the appropriate Commissioner. The Office of the Privacy Commissioner of Canada (priv.gc.ca) handles PIPEDA and Privacy Act complaints. Provincial Commissioners handle provincial public and private sector matters: OIPC British Columbia (oipc.bc.ca), OIPC Alberta (oipc.ab.ca), IPC Ontario (ipc.on.ca), CAI Quebec (cai.gouv.qc.ca), and others. Your complaint should include: your name and contact information, the name of the organization, a description of what happened with dates and documents, and the resolution you are seeking. Most Commissioners investigate and mediate; some provincial Commissioners (Alberta, BC, Ontario, Quebec) can issue binding orders.

Question 20

Can I sue an organization that mishandled my personal information?

Accepted Answer

Yes, in some circumstances. Under PIPEDA Section 14, after the OPC has issued a finding, you may apply to the Federal Court of Canada for damages, an order to correct a practice, or other remedies. Under the Privacy Act Section 41, similar Federal Court recourse is available for federal institutions. At common law, Ontario recognizes intrusion upon seclusion as a tort (Jones v. Tsige, 2012) that allows damages up to 20,000 dollars typically, with higher awards available for serious cases. BC, Saskatchewan, and Manitoba have statutory privacy torts under their Privacy Acts. Quebec permits civil claims under the Civil Code. Class actions have been certified in Canadian courts for major data breaches. Consult a privacy lawyer to assess the specific route that applies to your situation.

Frequently Asked Questions

Didn't find your answer?