Ensuring Your Privacy is Protected


Protecting your privacy means protecting your personal information from misuse by others. While the IPC holds Ontario public sector institutions accountable for the personal information in their care, there are steps that you can take to protect yourself, such as, minimizing the exposure of your personal information available to others, both online and off, and recognizing the signs of being a victim.

When providing your information in any context, keep in mind the five Ws:

  • Who wants it and who will have access to it?
  • Why do they want it?
  • What will it be used for?
  • Where will it be stored?
  • When will it be used and when will it be discarded?



Identity theft is any unauthorized acquisition, possession or trafficking of personal information, or, the unauthorized use of information to assume/takeover an existing identity in order to obtain financial gain, goods or services, or to conceal criminal activities. Besides basic information like your  name, date of birth, and contact information, identity thieves look for social insurance, driver’s license and passport numbers, as well as sensitive  information about credit and bank cards, online accounts and mobile devices. This information may enable the identity thief to commit numerous forms of fraud: to go on spending sprees under your name, to take over your financial accounts, open new accounts, divert your mail to the thief’s address, apply for loans, credit cards, social benefits, rent apartments, establish services with utility companies, and more.

It is a common crime that continues to claim thousands of victims each year, with serious consequences. In most cases, victims of identity theft have no idea they have become victims until it is too late and the damage is done.


The theft of your identity can leave you with a poor credit rating and a ruined reputation which may take months or even years to correct. Meanwhile, you may be denied jobs, credit and other financial privileges, or the ability to rent or buy accommodation, or travel. You may even risk false arrest and have your story viewed with suspicion.


The best strategy for prevention starts with awareness of the steps you can take to avoid becoming a victim and holding institutions accountable for their collection, use and disclosure of your personal information. While individuals may not be responsible for the poor data management practices of institutions, the following steps are widely believed to be helpful for protecting yourself.


  • Minimize the amount of personal information you give out, especially online.
  • Shred all personal records and financial statements instead of just throwing them into the recycling bin or wastebasket.
  • Do not give out your Social Insurance Number or other government-issued identity card information, unless absolutely necessary. Never use them as a password.
  • Keep items containing personal information, such as your birth certificate, passport, and citizenship card in a safe place.
  • Minimize the use of personal information when using social media. Understand the privacy and security settings and use them.
  • Be very wary of any email or telephone request to provide sensitive personal information. Instead, contact the sender or institution through other means such as the telephone to confirm the request.
  • Always use strong passwords on your mobile devices and when accessing online accounts and services. Never write down passwords or share them with others. Change them regularly. Consider using a password manager.
  • Ensure your computing devices are kept up to date with the latest security updates and patches. Use encryption to secure device content and to access websites or online services. Avoid using public wifi.
  • Be cautious when downloading or using third-party applications on your devices and/or social media outlets. Third-party applications come with their own set of privacy policies and may be able to access and distribute your personal information upon installation.
  • Pay attention to your billing cycles of credit cards. Carefully review bills and statements on a regular basis. Monitor your account balances and activities frequently.
  • Obtain and review your full credit report every year.
  • Notify creditors immediately if your cards are lost or stolen.



  • Immediately report the crime to the police. Keep a copy of the police/occurrence report.
  • Armed with the police occurrence report, advise all businesses with which you have a relationship of the possible loss, theft, or misuse of your identity. Have a fraud alert placed on your accounts.
  • Report the theft to credit bureaus.
  • Cancel your existing cards and accounts, and open new ones.
  • Document all the steps you have taken and your expenses to clear your name and re-establish your credit.
  • Have your credit reports annotated or “frozen.”
  • Contact the post office if you suspect that someone is diverting your mail through false change of address forms.
  • Consider telling your employer, as an added precaution, particularly if you are paid via direct deposit.
  • Keep a log of all your contacts and make copies of all documents.
  • In some cases, it may be advisable to seek the assistance of a lawyer.

For information held by the federal government or collected by private sector companies please contact the Office of the Federal Privacy Commissioner.


  • The Canadian Identity Theft Support Centre offers free, expert advice to Canadians who have become victims of identity theft. The Centre is staffed by highly-skilled Case Advisors, who have in-depth knowledge of the kinds of identity theft that occur in Canada, and how to deal with the issues that arise when a person is victimized. Phone: 1-866-436-5461
  • The Identity Theft 911 Knowledge Center helps consumers understand and detect the many forms of identity theft and fraud by providing answers to common questions.
  • The Canadian Anti-Fraud Centre is the central agency in Canada that collects information and criminal intelligence on such matters as mass marketing fraud (i.e. telemarketing), Internet fraud and identity theft complaints.