Privacy complaints process

When an individual believes that a provincial or municipal government institution, a health information custodian, children's aid society or other child and family service provider has contravened Ontario’s privacy laws, they should call, write or visit the person or organization to try to resolve the matter. If they can’t resolve it directly with the person or organization, they may file a privacy complaint with our office.

IPC jurisdiction 

Under the Freedom of Information and Protection of Privacy Act (FIPPA) and the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), the IPC has jurisdiction over privacy breaches by provincial and municipal government institutions, including:

  • provincial ministries
  • most provincial agencies, boards, and commissions
  • universities and colleges of applied arts and technology
  • hospitals
  • local government institutions, such as municipalities, police services boards, libraries, boards of health, school boards, and transit commissions

Under the Personal Health Information Protection Act (PHIPA), the IPC has jurisdiction over privacy complaints in the health sector, including related to the collection, use, retention and disclosure of personal health information by health information custodians such as hospitals, pharmacies, laboratories, health care practitioners (e.g. doctors, nurses, etc.), as well as other health care providers.

Under Part X of the Child, Youth and Family Services Act (CYFSA), the IPC has jurisdiction over privacy complaints related to the collection, use, retention, and disclosure of personal information by children’s aid societies and other child and family service providers.

Summary of IPC privacy complaint procedures 

Privacy complaint files are initially reviewed by a team of early resolution analysts who are tasked with attempting to resolve privacy complaints with the parties. If a resolution is not possible, the analyst will decide whether or not the file should be dismissed or proceed to another stage in the tribunal process.

If a resolution is possible that is satisfactory to all of the parties including the IPC, the file can be closed with a letter to the parties regarding the outcome. 

If a resolution is not possible and the analyst determines on a preliminary basis that the file should not move to another stage in the tribunal process, the complainant (with a few exceptions) will be provided with a letter that outlines the analyst’s preliminary view of the file, including the reasons the complaint should be dismissed. The complainant will (with a few exceptions) be granted an opportunity to make written submissions to the analyst to explain why the file should proceed and not be dismissed. 

If a resolution is not possible and the analyst determines that the file will move to another stage in the tribunal process (investigation, mediation or adjudication stages), the parties to the complaint will be advised.

Please note that as of July 1, 2025, the IPC has new review powers under FIPPA that include making orders regarding the information practices of provincial government institutions. Equivalent review powers for municipal government institutions under MFIPPA take effect on January 1, 2027.

Please note that if you wish to submit a complaint under FIPPA/MFIPPA, and the institution did not notify you that your personal information was involved in a privacy breach, it may not be possible to process your complaint.

You will be advised in writing if the IPC decides not to process your complaint.

Resources