How to respond if your personal information has been stolen, and your rights under Canadian privacy, consumer reporting, and criminal law.
TL;DR
If your identity has been stolen, contact Equifax and TransUnion for fraud alerts, report to the Canadian Anti-Fraud Centre, file a police report, and notify affected institutions. You may also have rights to complain to the OPC or a provincial commissioner.
Immediate steps
If you suspect identity theft:
Place fraud alerts on your credit files with Equifax and TransUnion.
Contact your bank and credit card companies to freeze or cancel compromised accounts.
File a report with the Canadian Anti-Fraud Centre (CAFC) at 1-888-495-8501.
File a police report with your local police service.
Keep a detailed record of all correspondence and actions.
Your rights against the source of the breach
If a specific organization's breach exposed your data, they must notify you under PIPEDA or applicable provincial law.
You may be able to file a privacy complaint, and in some cases join a class action.
You can sue for intrusion upon seclusion in provinces that recognize the tort (Ontario and several others).
Criminal Code provisions
Sections 402.2 and 403 of the Criminal Code criminalize identity theft (obtaining and possessing identity information to commit an offence) and identity fraud (fraudulently using identity information).