PIPEDA Compliance Framework

Whistleblowing - s. 27

• An individual who has reasonable grounds to believe that a person has contravened or intends to contravene sections 5-10 of PIPEDA may notify the Commissioner of the matter and ask that his/her identity be kept confidential.
• Based on this and other relevant, available information, the Commissioner may initiate a complaint against the organization if she believes there are reasonable grounds to do so pursuant to section 11(2).
• The Commissioner must protect the identity of a whistle-blower who notified the Commissioner of the possible contravention and to whom the Commissioner has given an assurance of confidentiality.

Incident

Incidents are matters that the Commissioner may learn of from various sources. The source can be the media or an organization that chooses to self-disclose a major privacy concern, e.g. pursuant to an accidental data spill or an incident of data theft. Typically, incidents involve systemic issues that individuals do not necessarily know about or may not lend themselves as well to the individual complaint mechanism.

The Commissioner often works with the organization involved to try to mitigate damages and resolve the situation. Congruent with her power to disclose information in the public interest, the Commissioner may post incident summaries on the web-site. Should the incident not be resolved, the Commissioner may initiate a complaint against the organization, if she is satisfied that there are reasonable grounds to do so pursuant to section 11(2).

Retaliation - s. 27.1(1)

No employer shall dismiss, suspend, demote, discipline, harass or disadvantage an employee*:

• Who, acting in good faith and on the basis of reasonable belief, discloses to the Commissioner that a person has contravened or intends to contravene sections 5-10 of PIPEDA;
• Who, acting in good faith and on the basis of reasonable belief, refuses to do something that is a contravention of sections 5-10 of PIPEDA;
• Who, acting in good faith and on the basis of reasonable belief, has done or stated an intention of doing anything required to be done in order to avoid contravening sections 5-10 of PIPEDA; or
• Whom the employer believes will do any one of these things.

For the purpose of this prohibition, an employee includes an independent contractor.

An employer who knowingly retaliates against an employee contrary to this provision is guilty of an offence under section 28 of PIPEDA.

An employee who believes that they have been retaliated against by their employer on any of these grounds may notify the Commissioner and set out the facts. The Commissioner may initiate an investigation into the matter if she believes there are reasonable grounds to do so under section 11(2).

If, in the course of her investigation, or on completion thereof, the Commissioner is of the opinion that there is evidence of retaliation, she may disclose information she has uncovered relating to this offence to the Attorney General pursuant to subsection 20(5).