Data breach compensation in Canada: your rights

What the organisation must do

Under PIPEDA, a breach that poses a real risk of significant harm must be reported to the OPC, and affected people must be told as soon as feasible. In Quebec, Law 25 requires notice to the Commission d'accès à l'information and to the people affected when there is a risk of serious injury.

Complaining

1. Raise it with the organisation first; otherwise the OPC may not accept your complaint.
2. File a complaint with the OPC. It investigates and reports, but cannot force an organisation to act or award money.
3. After the report, you can apply to the Federal Court, which can award damages.

Protect yourself

• Place a fraud alert with TransUnion Canada (free, 1-800-663-9980) and Equifax Canada.
• Report fraud to the Canadian Anti-Fraud Centre and your local police.