1. I Have a Privacy Complaint
Your privacy complaint must involve personal information (pi) or personal health information (phi). Please see subsection 24(1) of FOIP and subsection 2(m) of HIPA for full definitions of pi and phi.
The following are examples of what might constitute a breach: employee snooping, over collection, unauthorized use or disclosures, inadequate safeguards, inaccurate pi or phi.
2. Submit Your Complaint to the Public Body
3. Wait a Reasonable Period for Response
Allow the public body a reasonable period to respond to your complaint. OIPC suggests a minimum of 30 days for an initial response, however, based on the nature of your alleged breach of privacy complaint, it may take longer for the public body to look into your concerns and respond.
Not Satisfied?
If you do not receive a response in a reasonable period, reach an impasse, or are dissatisfied with the public body’s response, you can make your complaint to the OIPC.
4. Outline Your Complaint
Your complaint must be made in writing and include a detailed description of the alleged breach, including dates/timelines, name of the public body against whom the complaint is made and any documentation or other evidence that supports your allegations. Please use the following form to outline your complaint: Alleged Breach of Privacy Reporting Form for Affected Individuals/Complainants. In addition, the OIPC also would need the following from you to consider if we are able to open an investigation file:
- A copy of the written complaint you submitted to the public body and evidence of when and how it was sent to the public body (such as covering email in which you submitted the complaint as an attachment).
- A copy of the response you received from the public body regarding your complaint. If you have not received a response in a reasonable period, advise as such when submitting your complaint to OIPC.
- Evidence you have to support a privacy breach may have occurred.
If instead you were notified by a public body that your privacy was breached and are dissatisfied with how the breach was handled, if you wish for the OIPC to conduct an investigation, the OIPC needs you to provide a copy of the communication the public body sent to you which notified you of the breach of privacy involving your personal information and/ or personal health information.
Once the above is received, the OIPC will consider if we have jurisdiction and if you have provided sufficient evidence to support that a breach may have occurred. Unsupported allegations will not be investigated. OIPC also takes into consideration if the public body has been given a reasonable period to respond to the complaint and if the public body and you (as the Complainant) have reached an impasse. Your complaint should also confirm that you understand that we will need to share your name and details of your complaint with the public body so the matter may be fully investigated. If you object to being named, please be advised that we most likely will be unable to proceed with an investigation. In addition, the OIPC typically does not investigate a matter that is more than two years old for a number of reasons including the unavailability of witnesses or failing memories. Once you submit your complaint and relevant documentation to the OIPC (see step 6), we will take these factors into consideration to determine if we are to proceed with an investigation file.
5. Submit Your Complaint to the IPC
It is our office’s preference that complaints be submitted by email to: intake@oipc.sk.ca. You can also submit your complaint by mail or in person to:
Saskatchewan Information and Privacy Commissioner
Regina SK S4P 4B4
503 – 1801 Hamilton Street
Please include copies of any correspondence with the public body relevant to the complaint.
6. IPC Investigates
Once it is determined that the IPC has jurisdiction and grounds to investigate, an Analyst will be assigned to the file. The Analyst will gather information from the public body and the complainant to determine the relevant facts and define the issues.
The Analyst will attempt to mediate, or informally resolve, the complaint.
7. Report and Response
8. Appeal to Court
If you are not satisfied with the Commissioner’s recommendations related to FOIP/LA FOIP and/or the public body’s response, you can appeal to the Court of King’s Bench.
There may be a limited right to appeal to the Court of King’s Bench by an aggrieved complainant if the complaint was handled under HIPA pursuant to section 42(1)(c).
The IPC is not involved in this step. You may consult a lawyer.