How do I resolve a privacy complaint?
1. I Have a Privacy Complaint
- Your privacy complaint must involve personal information (pi) or personal health information (phi). Please see subsection 24(1) of FOIP and subsection 2(m) of HIPA for full definitions of pi and phi.
- The following are examples of what might constitute a breach: over collection, unauthorized use or disclosures, inadequate safeguards, inaccurate pi or phi.
2. Submit Your Complaint to the Public Body
- Send your complaint, in writing, directly to the appropriate public body.
Please note: our office is an office of last resort. Your privacy complaint must first be submitted to the public body. If you require the contact name of the privacy officer for a specific public body, please contact our office at 306-787-8350 or toll-free at 1-877-748-2298.
3. Wait (approximately) 30 Days
- The public body has (approximately) 30 days to respond. The 30 day deadline gives the public body a reasonable amount of time to conduct its internal investigation which can sometimes involve interviewing witnesses, reviewing audit logs, policies, procedures, etc.
If you do not receive a response, or are dissatisfied with the public body’s response, you can make your complaint to the IPC. Please note that the IPC generally does not investigate a matter that is more than two years old for a number of reasons including the unavailability of witnesses or failing memories.
4. Outline Your Complaint
- Your complaint must be made in writing and include a detailed description of the alleged breach, including dates/timelines, name of the public body against whom the complaint is made and any documentation that supports your allegations.
- Your complaint should also confirm whether or not you wish to be treated anonymously with the public body. Note: this may not always be possible.
5. Submit Your Complaint to the IPC
- It is our office’s preference that complaints be submitted by email to: email@example.com. You can also submit your complaint by mail or in person to:
Saskatchewan Information and Privacy Commissioner
Regina SK S4P 4B4
503 – 1801 Hamilton Street
- Please include copies of any correspondence with the public body relevant to the complaint.
6. IPC Investigates
- Once it is determined that the IPC has jurisdiction and grounds to investigate, an Analyst will be assigned to the file. The Analyst will gather information from the public body and the complainant to determine the relevant facts and define the issues.
- The Analyst will attempt to mediate, or informally resolve, the complaint.
7. Report and Response
- If no mediated settlement is possible, the Commissioner will issue a report with findings and recommendations. Usually the report focusses on prevention.
- The identity of the complainant will not be disclosed.
- We ask the public body to respond to the report and indicate if it will comply with the Commissioner’s recommendation(s).
Still Not Satisfied?
If you are not satisfied with the Commissioner’s recommendations, and/or the public body’s response, you may have a limited right to appeal to the Court of Queen’s Bench.
8. Appeal to Court
- The IPC is not involved in this step. You may consult a lawyer.
- There may be a limited right to appeal to the Court of Queen’s Bench by an aggrieved complainant if the complaint was handled under HIPA pursuant to section 42(1)(c).
- There is no right of appeal from a report dealing with a breach of privacy under FOIP or LA FOIP.