I've Been Notified of a Privacy Breach
If you have been notified of a privacy breach, you can contact our Office for guidance with respect to how to file a complaint. If you require additional information with respect to the details of the breach, and how the Public Body is responding to the breach, you should contact the Public Body that notified you of the breach.
When you file a privacy complaint PDF document opens in new window (1,006 KB) with the OIPC, we contact the Public Body to determine how and why the breach happened, what can be done by the Public Body to help prevent the breach from happening again and what the Public Body or Custodian has already done in response to the breach.
Under ATIPPA, 2015, the Commissioner has no authority to impose disciplinary action on the person or body who committed the breach or award damages to an individual whose privacy has been breached. Upon completion of a privacy investigation, the Commissioner may make a recommendation as follows:
- that the Pubic Body stop collecting, using or disclosing personal information in contravention of this Act;
- that the Public Body destroy personal information collected in contravention of the ATIPPA, 2015;
- that an information practice, policy or procedure be implemented, modified, stopped or not commenced; or
- on the privacy aspect of the matter that is the subject of the privacy complaint.
However, if the Commissioner believes that an offence under section 115 of the ATIPPA, 2015 has been committed, the Commissioner can take steps that could lead to a prosecution by the Attorney General. An offence under section 115 of the ATIPPA, 2015 is punishable by a fine of not more than $10,000 or imprisonment for up to six months.Learn More About Privacy Breaches