How do I resolve a complaint?

Your privacy complaint must involve your personal information or personal health information as defined by FOIP, LA FOIP or HIPA, not someone else’s.

A privacy breach most often occurs when an individual’s personal information or personal health information is collected, used or disclosed without authority.

The OIPC is an appeal body. If you have a privacy concern, the starting point is for you to reach out to the organization you believe is responsible for the breach and ask for the Privacy Officer or whoever is designated responsibility for FOIP, LA FOIP or HIPA compliance. For instance,

• For a list of contact information for Privacy Officers within the Government of Saskatchewan, please click here.
• If you require the contact name of the privacy officer for a specific public body not listed in the link above, please contact our office toll free at 1-877-748-2298, 306-787-8350 or email us at www.oipc.sk.ca.

Submit your concerns in writing to the appropriate person. Keep a copy of all materials submitted and any subsequent correspondence related to the matter.

Received notice of a privacy breach?

If a public body/trustee notified you that you were subject to a breach (affected by), before submitting a complaint to the OIPC, you should first direct your questions or concerns to the public body/trustee who notified you of the breach to see if they can address to your satisfaction. If afterwards concerns remain unaddressed, you may request the OIPC intervene. To do so, make your request in writing and provide the OIPC with a copy of the breach notification you received from the public body/trustee.

Allow the public body/trustee time to fully investigate and to respond to your privacy complaint. Based on the nature of your allegations, patience is required as it may take considerable time for the public body/trustee to investigate and respond accordingly.

Not Satisfied?

If you:

• do not receive a timely initial response indicating an investigation has been initiated;
• reach an impasse whereas the public body/trustee ceases efforts to investigate or address your privacy concerns; or
• are dissatisfied with the public body/trustee’s response provided after the conclusion of its investigation,

you may submit your formal complaint to the OIPC for consideration.

Please use the following form to outline your complaint: Alleged Breach of Privacy Reporting Form for Affected Individuals/Complainants.

The OIPC also requires the following items from you:

• A copy of the written complaint you submitted to the public body and evidence of when and how it was sent to the public body/trustee (such as covering email in which you submitted the complaint as an attachment);
• All correspondence between you and the public body/trustee regarding the matter including a copy of the final response you received from the public body/trustee regarding your complaint (if one was provided); and
• Evidence that supports your claim that a privacy breach may have occurred. Unsupported allegations will not be investigated.

Once assessed, we will be in further contact if more is needed and when ready, will let you know if we can proceed with an investigation or not.

Your complaint should also confirm that you understand that we will need to share your name and details of your complaint with the public body/trustee so the matter may be fully investigated. If you object to being named, we most likely will not be able to proceed with an investigation. In addition, the OIPC typically does not investigate a matter that is more than two years old.

Please be advised that as an independent oversight body, OIPC determines the scope and direction of any investigation to be undertaken, not any external party.

It is our office’s preference that complaints be submitted by email to: intake@oipc.sk.ca.  You can also submit your complaint by mail or in person to:

Saskatchewan Information and Privacy Commissioner
Regina SK S4P 4B4
503 – 1801 Hamilton Street

Please include copies of any correspondence with the public body relevant to the complaint.

An OIPC Intake Officer will first assess what you have provided, gather additional relevant documentation as required, clarify scope and look for early resolution opportunities if we have jurisdiction and sufficient evidence to proceed.

If the matter proceeds and early resolution is not reached, an OIPC Analyst will be assigned to lead the investigation and notices of investigation will be sent to the parties. What is required at that point will be spelled out in the notice of investigation.

The Analyst will attempt to mediate, or informally resolve, the matter if possible.

If a breach has been confirmed and the matter cannot be mediated, the Commissioner will most likely issue a public investigation report with findings and recommendations where appropriate. Please note that the Commissioner does not have rule-making authority.

Your name (complainant) will not be disclosed in the investigation report. Note, however, those familiar with the matter may be able to identify who the complainant is; therefore, OIPC is not able to guarantee the complainant’s anonymity.

We ask the public body/trustee to respond to the investigation report within 30 days of receipt and indicate if it will comply with the Commissioner’s recommendation(s).

If you are not satisfied with the Commissioner’s recommendations related to FOIP/LA FOIP and/or the public body/trustee’s response, you can appeal to the Court of King’s Bench.

There may be a limited right to appeal to the Court of King’s Bench by an aggrieved complainant if the complaint was handled under HIPA pursuant to section 42(1)(c).

The OIPC is not involved in this step. You may consult a lawyer.

Download Flowchart