Step 1: raise the issue with the organization
The OPC asks that the issue be raised with the organization first (PIPEDA s.12(1)(a) lets the Commissioner decline a complaint where the organization's own process was not used). A written complaint to the organization's privacy officer, with copies kept, is the usual starting point.
Step 2: file with the OPC
If the organization does not resolve the issue, a complaint can be filed online at priv.gc.ca or by mail.
The complaint should include: the name of the organization, what happened, when it happened, what you have already done to address it, and what outcome you want.
PIPEDA sets no fixed filing deadline, but the Commissioner may decline a complaint not filed within a reasonable period (s.12(1)(c)).
Step 3: OPC investigation and report
The OPC will acknowledge receipt, assign an investigator, and typically contact the organization for a response.
The OPC may attempt mediation or early resolution.
If the matter is not resolved, the OPC will issue a Report of Findings that states whether the complaint is well-founded, and may include recommendations.
Step 4: Federal Court
If the OPC's report does not resolve the matter, or the organization refuses to implement the recommendations, an application to the Federal Court can be made within one year of the report (s.14). The Federal Court has the power to award damages and order corrective measures (s.16).