Office of the Privacy Commissioner of Canada

The OPC is led by the Privacy Commissioner of Canada, an officer of Parliament. For private-sector organizations, its main roles are investigating complaints under PIPEDA, receiving reports of breaches of security safeguards that create a real risk of significant harm, conducting audits, publishing guidance and reporting findings publicly.

Under PIPEDA, the OPC's powers are mostly investigative and persuasive. It can issue findings and recommendations, enter into compliance agreements and take matters to Federal Court, but it does not have broad authority to impose administrative fines on businesses. This is one area that federal privacy reform has repeatedly aimed to change.

For a Canadian business, interaction with the OPC most often follows a data breach. The OPC provides an online breach report form and expects organizations to report as soon as feasible after determining that the threshold is met. It may follow up with questions about the cause, the safeguards in place and the steps taken to notify individuals and prevent recurrence. Its published investigation findings are a useful guide to what it considers reasonable safeguards.