I85PREP
⌘ K
CIPP/C study materials
CIPP/C study resources

CIPP/C: Canadian Privacy Regulation and Enforcement

CIPP/C · Work through your exam, one topic at a time.

All guide sections

Canadian Privacy Regulation and Enforcement

What this domain tests

Regulation and enforcement focuses on who investigates, what orders they can make, breach-reporting thresholds, and penalties. Know the federal Office of the Privacy Commissioner (OPC), provincial commissioners (CAI in Quebec, OIPC BC, OIPC Alberta, IPC Ontario), and the CRTC's CASL role.

Core rules

  • Under PIPEDA, the OPC investigates complaints and can audit, but it cannot issue binding orders. It may apply to the Federal Court for a compliance order or damages, and individuals may also apply.
  • Breach reporting: PIPEDA s. 10.1 requires organizations to report to the OPC as soon as feasible any breach of security safeguards involving personal information that creates a real risk of significant harm (RROSH), notify affected individuals, and keep records for 24 months. RROSH assessment considers sensitivity, volume, cause, and likelihood of misuse.
  • Offences: knowingly failing to report or maintain records can attract fines up to $100,000.
  • Quebec's CAI can issue orders and administrative monetary penalties; the BC and Alberta OIPCs have order-making powers. Ontario's IPC can issue orders under PHIPA.
  • CASL is enforced by the CRTC; administrative monetary penalties can reach $10 million per violation for businesses, and unsubscribe requests must be honored within 10 business days.

Worked example

A federally regulated bank loses an unencrypted backup drive with 12,000 client records. Because it is a federal work, PIPEDA applies. The privacy officer assesses RROSH: sensitive financial data, large volume, unencrypted, and no evidence of misuse. The bank reports to the OPC as soon as feasible, notifies affected clients, and logs the incident for 24 months. If it knowingly fails to report, it risks an offence fine. The OPC may investigate and, if needed, seek a Federal Court order. Reasoning: federal jurisdiction leads to PIPEDA, then s. 10.1 reporting, record-keeping, and the enforcement route.

Traps

Believing the OPC can directly fine or order compliance under PIPEDA; notifying every breach regardless of harm; forgetting the 24-month record; missing the separate individual-notification duty; overlooking provincial order-making powers; ignoring CRTC and CASL when marketing is involved.