Step 1: raise the issue with the organization
PIPEDA requires you to first raise the issue with the organization. Identify the privacy officer and put your complaint in writing. Keep copies of all correspondence.
Step 2: file with the OPC
If the organization does not resolve the issue, you can file a complaint online at priv.gc.ca, by mail, or by fax.
The complaint should include: the name of the organization, what happened, when it happened, what you have already done to address it, and what outcome you want.
Your complaint must generally be filed within 12 months of becoming aware of the issue.
Step 3: OPC investigation and report
The OPC will acknowledge receipt, assign an investigator, and typically contact the organization for a response.
The OPC may attempt mediation or early resolution.
If the matter is not resolved, the OPC will issue a Report of Findings that states whether the complaint is well-founded, and may include recommendations.
Step 4: Federal Court
If you are not satisfied with the OPC's report, or the organization refuses to implement recommendations, you can apply to the Federal Court for an order. The Federal Court has the power to award damages and order corrective measures.