Exercising your rights
Each right has its own process:
- Access: write to the organization's privacy officer with proof of identity.
- Correction: identify the inaccuracy and provide supporting evidence.
- Portability: request information in a commonly used technological format.
- De-indexing: a request to stop dissemination or de-index links where publication contravenes the law or a court order, or causes serious injury to reputation or privacy that clearly outweighs the public interest (s.28.1).
- Automated decisions: where a decision was based exclusively on automated processing, the person can obtain the reasons and principal factors and submit observations to someone able to review the decision (s.12.1).
Timelines
Organizations must respond within 30 days. If they refuse, they must give written reasons. If you do not receive a response or are unsatisfied, you can apply to the CAI.
CAI complaints and penalties
Complaints can be filed online with the CAI. The CAI can investigate, order corrective action, and impose administrative monetary penalties.
Penalties can reach $10 million or 2% of worldwide turnover for administrative violations, and penal fines (provincial offences, not criminal charges) of up to $25 million or 4% under s.91.
Privacy impact assessments for organizations
The Act requires organizations to conduct a PIA for any project to acquire, develop or overhaul an information system involving personal information (s.3.3), proportionate to the sensitivity of the information. Organizations commonly engage privacy counsel for this.