How Privacy Law is Enforced in Canada

The roles of commissioners, courts, tribunals, and individuals in Canadian privacy enforcement.

TL;DR

Canadian privacy enforcement combines commissioner investigations, court applications, civil torts, and criminal prosecution. Enforcement has historically been weak compared to jurisdictions like the EU, but Bill C-27, Law 25, and new provincial reforms are adding order-making powers and significant penalties.

Commissioner investigations

The OPC and provincial commissioners investigate complaints and issue reports. Some commissioners have order-making power; others can only make recommendations.

Commissioners also audit organizations proactively and issue public guidance.

Courts and tribunals

PIPEDA complainants can apply to the Federal Court for orders, including damages.

Bill C-27 (if enacted) would create a new Personal Information and Data Protection Tribunal to hear appeals of OPC orders and impose administrative monetary penalties.

Provincial superior courts hear privacy tort claims and class actions.

Criminal prosecution

Criminal Code sections cover voyeurism, non-consensual distribution of intimate images, interception of private communications, and identity theft. Prosecution is typically led by Crown counsel following a police investigation.

Administrative monetary penalties

Quebec's Law 25 allows penalties up to the greater of $10 million or 2% of worldwide turnover. Bill C-27 proposes similar penalties federally (up to $10 million or 3% of global revenue, with higher caps for serious violations).

Sources & References

Personal Information Protection and Electronic Documents Act (PIPEDA)—Federal private-sector privacy law governing the collection, use, and disclosure of personal information.Justice Laws Website
Quebec Law 25 (Act respecting the protection of personal information in the private sector)—Quebec's modernized privacy regime introducing mandatory breach notification, privacy impact assessments, data portability, right to be forgotten, and automated decision-making transparency.Publications du Québec
Bill C-27 / Consumer Privacy Protection Act (CPPA)—Proposed federal reform that would replace PIPEDA with the Consumer Privacy Protection Act, create a Personal Information and Data Protection Tribunal, and introduce the Artificial Intelligence and Data Act (AIDA).Parliament of Canada
Office of the Privacy Commissioner of Canada (OPC)—Oversees compliance with PIPEDA and the Privacy Act, investigates complaints, and promotes privacy rights.Government of Canada

All sources link directly to official government websites. This page provides legal information, not legal advice. Consult a qualified professional before acting on any information presented here.