Privacy complaints process
When an individual feels that a government institution, a health information custodian, or child welfare service provider has contravened Ontario’s privacy laws, they should call, write or visit the person or organization to try to resolve the matter. If they can’t resolve it directly with the person or organization, they may file a privacy complaint with our office.
IPC jurisdiction
Under the Freedom of Information and Protection of Privacy Act (FIPPA) and the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), The IPC has jurisdiction over access to information and privacy concerns, including related to:
- all provincial ministries
- most provincial agencies, boards, and commissions
- universities and colleges of applied arts and technology
- local government institutions, such as municipalities, police, library, health and school boards, and transit commissions
Under the Personal Health Information Protection Act (PHIPA), the IPC has jurisdiction concerning the collection, use, and disclosure of personal health information by hospitals and other health care providers.
Under Part X of the Child, Youth and Family Services Act (CYFSA), the IPC has jurisdiction over access and privacy matters relating to child welfare service providers, among others.
Summary of IPC privacy complaint procedures
Privacy complaint files are reviewed by a team of early resolution analysts. The Early Resolution Department is tasked with attempting to resolve privacy complaints with the parties. If a resolution is not possible, the analyst will decide whether or not the file should be dismissed or proceed to another stage in the tribunal.
If a privacy complaint file is not resolved, the analyst will decide if the file should move to another stage in the tribunal or may provide the complainant with a letter that outlines their preliminary view of the file including the reasons the complaint should be dismissed. The complainant may be granted an opportunity to make written submissions to the analyst to explain why the file should proceed further and not dismissed. If a complaint is not dismissed or resolved at the early resolution stage, it may proceed to the mediation, investigation or adjudication stage.
Please note that as of July 1, 2025, the IPC has new review powers under FIPPA that include making orders regarding Institutions’ information practices.
Please note that if you wish to submit a complaint under FIPPA, and the Institution did not notify you that your personal information was involved in a privacy breach, it may not be possible to process your complaint. Also, given the IPC’s lack of review power’s under MFIPPA, we may decide not to process your complaint under this legislation at the outset. You will be advised in writing if the IPC decides not to process your complaint.