Know Your Rights

Organizations must notify you when a breach creates a real risk of significant harm to you.

Since November 2018, PIPEDA requires private sector organizations to report any breach of security safeguards involving personal information that creates a real risk of significant harm (RROSH) to the Privacy Commissioner, to notify affected individuals, and to maintain records of all breaches for 24 months. Similar mandatory breach reporting exists under Alberta PIPA, Quebec Law 25, PHIPA (Ontario health), and the Privacy Act for federal institutions. If you received a breach notification, you are entitled to specifics about what was exposed and what containment measures are in place.

If an organization mishandles your data, you can file a free complaint with the appropriate Privacy Commissioner.

Every Canadian has the right to complain to a Privacy Commissioner without cost. The federal OPC handles PIPEDA and Privacy Act complaints. Provincial commissioners (OIPC BC, OIPC Alberta, IPC Ontario, CAI Quebec, and others) handle provincial public and private sector complaints. Commissioners investigate, mediate, and in some provinces issue binding orders. After a federal OPC report you may apply to the Federal Court for damages under PIPEDA s.14 or the Privacy Act s.41.

Your personal health information is protected by dedicated health privacy statutes in every Canadian province.

Health records carry enhanced privacy protection. In Ontario, PHIPA governs every hospital, clinic, physician, pharmacy, and long-term care home. Other provinces have parallel legislation: HIA (Alberta), HIPA (Saskatchewan), PHIA (Manitoba, Newfoundland, Nova Scotia), and PHIPAA (New Brunswick). You have the right to access your chart, correct errors, lock specific information within your circle of care, and be notified when snooping or unauthorized access occurs. Staff who access records without a business reason can be individually reported to the Commissioner and may face prosecution.

The Charter protects you from unreasonable state searches and informational privacy violations.

Section 8 of the Charter guarantees the right to be secure against unreasonable search or seizure. The Supreme Court has applied it to police requests for ISP subscriber data (R v. Spencer, 2014), text messages (R v. Marakah, 2017), and workplace recordings (R v. Jarvis, 2019). Section 7 protects informational privacy where disclosure would cause serious psychological harm. These Charter rights limit what police, border officers, tax authorities, and other state agents can do with your digital devices, accounts, and records. Private companies are not directly bound by the Charter, but state demands for their customer data are.