Information & Data Protection

Privacy Law

Privacy n. [From Latin privatus, "set apart; not public"]

The right to control access to one's personal information and to be free from unreasonable intrusion, with remedies and obligations arising from legislation, common law, and regulatory frameworks.

Grigoras Law acts for clients across Ontario in privacy and data matters, including access-to-information requests, breach response, and disputes involving the collection, use, and disclosure of personal information. We advise on compliance and investigations, act on intrusion-upon-seclusion and related claims, and pursue targeted remedies—injunctions, takedown or de-indexing requests, and regulatory engagement—aimed at efficient, practical outcomes.

What We Do

Privacy Law Services

Your Legal Team

Your Privacy Counsel

Denis Grigoras

Denis Grigoras

Counsel, Civil & Appellate Litigation

  • Privacy compliance and investigations (PIPEDA / PHIPA; policies, access & correction requests)
  • Breach response and remedies (injunctions, takedown / de-indexing requests, regulator engagement)
  • Intrusion upon seclusion and misuse-of-information claims; proportional, efficient motion practice
View Profile

Representative Work

Selected Privacy Matters

  • PHIPA access complaint — IPC Ontario

    Health Information

    Office of the Information and Privacy Commissioner of Ontario · Personal health information

    Represented a client in a PHIPA-related access complaint, addressing scope, timeliness, and corrections.

  • Freedom of information appeal — IPC Ontario

    Access to Information

    Office of the Information and Privacy Commissioner of Ontario · Municipal/Provincial FOI

    Represented a client on appeal concerning access, exemptions, and severance under applicable legislation.

  • Intrusion upon seclusion — defence of civil claim

    Privacy Tort

    Ontario Superior Court of Justice · Privacy tort

    Defended an action alleging unreasonable intrusion; focused on proportional discovery and early resolution.

  • False light publicity & public disclosure of private facts

    Privacy Torts

    Ontario Superior Court of Justice · Privacy torts

    Acted for a client in claims arising from alleged misuse and dissemination of personal information.

ON THIS PAGE

PRIVACY LAW IN CANADA

Canada’s privacy regime is built on a hybrid statutory and common-law model, combining federal and provincial data protection laws with judge-made torts that protect personal dignity and autonomy. The principal statute, the Personal Information Protection and Electronic Documents Act (PIPEDA), governs private-sector organizations engaged in commercial activities across Canada, except in provinces with substantially similar legislation, namely Alberta, British Columbia, and Québec.

Each law embodies the Fair Information Principles (FIPs): accountability, identifying purposes, consent, limiting collection, limiting use and retention, accuracy, safeguards, openness, individual access, and challenging compliance. These principles shape how organizations collect, use, and disclose personal information in a manner consistent with what a reasonable person would consider appropriate under the circumstances.

Violations of these statutes can result in regulatory investigations, civil suits, and fines of up to $100,000 under PIPEDA. In addition to statutory enforcement, courts have recognized a suite of privacy torts, such as intrusion upon seclusion and public disclosure of private facts, that provide recourse even where no legislation applies.

The notion of meaningful consent sits at the heart of Canadian privacy law. Originally designed for an era of paper records, the traditional “notice and choice” model struggles in today’s complex data environment. Modern technologies, from cloud services and the Internet of Things (IoT) to algorithmic profiling, require consent mechanisms that are comprehensible, prominent, and ongoing.

The Office of the Privacy Commissioner of Canada (OPC) has issued extensive guidance, including its Guidelines for Processing Personal Data Across Borders and its 2018 Guidelines for Meaningful Consent. These emphasize layered privacy notices, context-sensitive consent, and proactive communication about data uses involving profiling or automated decision-making.

Recent modernization proposals to PIPEDA, set to become the Consumer Privacy Protection Act, seek to strengthen consent by requiring disclosure of automated decision logic and ensuring that individuals have real control over their personal information.

CROSS-BORDER DATA TRANSFERS AND ORGANIZATIONAL ACCOUNTABILITY

Canadian law allows personal data to be transferred abroad for processing, provided the transferring organization ensures a comparable level of protection through contractual, technical, and procedural safeguards. While Parliament chose not to impose EU-style restrictions, the OPC expects organizations to notify individuals if their data may be processed outside Canada and to identify applicable foreign laws.

Alberta’s PIPA mandates explicit notice where service providers operate outside the country, whereas Québec’s reformed privacy law (Law 25) requires a written assessment of privacy risks before any cross-border communication. In practice, privacy lawyers advise clients to incorporate cross-border transfer clauses, breach notification triggers, and audit rights into service agreements to ensure defensible compliance and mitigate liability exposure.

INDIVIDUAL RIGHTS: ACCESS, CORRECTION, AND COMPLAINTS

Under the FIPs and PIPEDA’s Division 1, individuals have the right to access personal information held about them, challenge its accuracy, and withdraw consent. Organizations must respond within 30 days, subject to limited exceptions. Refusals can be reviewed by the OPC or the relevant provincial commissioner.

The OPC’s online resources provide templates for access requests and complaints, emphasizing transparency and accountability. Repeated non-compliance can lead to naming and shaming reports, compliance agreements, or Federal Court orders compelling compliance and awarding damages.

PRIVACY TORTS IN CANADIAN LAW

Parallel to the statutory regime, Canadian courts have recognized a suite of common-law privacy torts, following the taxonomy first proposed by William Prosser and adapted to Canadian jurisprudence. These torts fill gaps left by legislation and offer remedies for intentional intrusions and disclosures that violate personal dignity

Intrusion Upon Seclusion

Recognized in Jones v. Tsige, 2012 ONCA 32, this tort applies where a defendant intentionally or recklessly intrudes upon another’s private affairs in a way that a reasonable person would find highly offensive. No proof of economic harm is required – damages up to $20,000 are typical for non-pecuniary loss. It cannot be used to sidestep defamation defences like qualified privilege.

Public Disclosure of Private Facts

In Jane Doe 464533 v. D., 2018 ONSC 6607, the Ontario Superior Court formally recognized this tort. Liability arises when a defendant publicizes truthful but intimate and non-newsworthy information that would be highly offensive to a reasonable person. The plaintiff in Jane Doe received $100,000 in combined damages for the unauthorized publication of intimate images.

Publicity Placing the Plaintiff in a False Light

Adopted in Y. (V.M.) v. G. (S.H.), 2019 ONSC 7279, this tort protects individuals from misleading portrayals that damage reputation and dignity, even where the statements are not strictly defamatory.

Appropriation of Personality

This longstanding tort prohibits the unauthorized commercial exploitation of an individual’s name, likeness, or image, protecting both economic and personal interests. It has been applied in Ontario, Québec (under civil law), and Nova Scotia to cases involving endorsements and image use.

STATUTORY PRIVACY TORTS AND REMEDIES

Several provinces, Manitoba, Saskatchewan, Newfoundland and Labrador, and British Columbia, codify privacy torts under their respective Privacy Acts. Plaintiffs must show a wilful and unjustified violation of privacy, and defendants may rely on good-faith or legal authority defences. Remedies include damages, injunctions, and orders for the delivery or destruction of unlawfully obtained information.

Courts routinely tailor remedies to the seriousness of the invasion, awarding aggravated and punitive damages where conduct is malicious or repeated. In Nova Scotia’s Cyber-safety Act and successor legislation, courts also consider factors such as the content of the image, the age of victims, and the scope of distribution when assessing harm

JURISDICTION, ENFORCEMENT, AND INTERNATIONAL DIMENSIONS

Canadian courts assert jurisdiction over privacy claims with a real and substantial connection to Canada, even against foreign defendants. The Supreme Court’s ruling in Douez v. Facebook Inc., 2017 SCC 33 refused to enforce a forum-selection clause favouring California, citing privacy’s quasi-constitutional character.

Similarly, Québec courts have permitted local actions against foreign corporations such as Target following major data breaches. The OPC encourages technical measures like geo-fencing to balance global data flows with Canadian jurisdictional expectations.

REMEDIES, DAMAGES, AND LITIGATION STRATEGY

Under both statute and common law, damages for privacy violations may include:

  • General damages for emotional distress and loss of dignity.

  • Aggravated damages for humiliation or reputational harm.

  • Punitive damages for malicious or high-handed conduct.

Courts may also issue injunctions to prevent further disclosure or order the destruction of misused data. In Jane Doe 464533, the court emphasized deterrence and expressive harm, signalling that privacy violations are not merely technical breaches but affronts to human dignity.

PRACTICAL STEPS FOR ORGANIZATIONS

Businesses operating in Canada must treat privacy compliance as a core governance issue. Recommended measures include:

  • Mapping personal data flows and identifying lawful bases for processing.

  • Drafting layered privacy notices in plain language and updating them annually.

  • Implementing breach response protocols aligned with the Breach of Security Safeguards Regulations (SOR/2018-64).

  • Conducting privacy impact assessments for cross-border transfers and new technologies.

  • Engaging with the OPC’s Interpretation Bulletins on consent and accountability.

A privacy lawyer in Ontario or other provinces can help organizations navigate enforcement risks and align practices with evolving statutory reforms.

PRACTICAL STEPS FOR INDIVIDUALS

Individuals can enhance their privacy protection by:

  • Exercising their right to access and correct personal information.

  • Filing complaints with privacy commissioners when consent or access rights are denied.

  • Being vigilant about social-media privacy settings and public disclosures.

  • Seeking legal advice if facing online harassment, non-consensual image sharing, or data misuse.

For those affected by data breaches or privacy torts, Canadian courts recognize both compensatory and symbolic damages. The OPC’s consumer guidance pages provide tools to lodge complaints and request the removal of harmful online content.

THE LEGISLATIVE LANDSCAPE OF PRIVACY LAW IN CANADA

Canada’s privacy framework is built on a layered and cooperative system of federal, provincial, and sector-specific privacy laws that govern how personal information is collected, used, and disclosed across the country. Together, these laws form one of the most comprehensive systems of personal information protection in the world.

While the Canadian Charter of Rights and Freedoms guarantees basic expectations of privacy under sections 7 and 8, the Charter mainly protects against state intrusion. The modern body of privacy legislation, on the other hand, establishes clear statutory rights and obligations for private organizations, health custodians, and public institutions that handle personal information.

Public, Private, and Health Sector Privacy Laws

Canada’s privacy statutes can be grouped into three main categories:

  1. Public-Sector Privacy Laws regulate how government bodies collect, use, and disclose personal information. Examples include the Privacy Act (R.S.C. 1985, c. P-21) at the federal level and provincial laws such as Ontario’s Freedom of Information and Protection of Privacy Act.

  2. Private-Sector Privacy Laws govern organizations engaged in commercial activity. The cornerstone is the Personal Information Protection and Electronic Documents Act (PIPEDA), which applies across most of Canada. Alberta, British Columbia, and Québec have enacted substantially similar private-sector laws that operate within their jurisdictions.

  3. Health Information Privacy Laws protect patient data and other health information. Ontario’s Personal Health Information Protection Act (PHIPA) and Alberta’s Health Information Act are prominent examples. These laws govern the obligations of health information custodians, such as hospitals, clinics, and healthcare professionals.

Each of these frameworks sets out key requirements for collection, consent, disclosure, safeguards, accuracy, retention, and access. They also establish independent oversight bodies (Privacy Commissioners) that investigate complaints and issue recommendations or binding orders.

Federal and Provincial Interplay in Privacy Protection

Canada’s privacy legislation reflects its federal constitutional structure. The federal government’s authority to legislate privacy arises under its trade and commerce power, while the provinces regulate under property and civil rights. This overlap allows both levels of government to enact privacy laws that coexist.

For example, PIPEDA applies to private-sector organizations engaged in commercial activity, while Alberta’s and British Columbia’s Personal Information Protection Acts cover businesses operating solely within those provinces. Québec’s Act Respecting the Protection of Personal Information in the Private Sector provides a similar regime under civil law principles.

This cooperative framework ensures that all Canadians benefit from privacy protection, regardless of jurisdiction, while minimizing duplication through mutual recognition of substantially similar laws.

Scope and Harmonization of Canadian Privacy Laws

Unlike the sector-based approach found in the United States, Canadian privacy law follows a comprehensive, principles-based model. Federal and provincial statutes share core features, but their form and terminology differ.

PIPEDA is structured around ten Fair Information Principles that include accountability, consent, accuracy, and safeguards.

Provincial statutes typically convert these principles into enforceable statutory obligations.

The result is a harmonized system of rules designed to ensure reasonable, transparent, and accountable handling of personal information across sectors.
Emerging provincial reforms, such as Québec’s Law 25 and Ontario’s modernization efforts, continue to align Canadian privacy protection with international standards like the EU’s General Data Protection Regulation (GDPR).

Balancing Privacy Rights and Organizational Necessity

Canadian privacy laws strive to balance individual privacy with legitimate organizational and societal interests such as fraud prevention, security, and business operations. Statutes include specific exceptions for law enforcement, contractual necessity, emergencies, and legal proceedings.

The guiding standard is reasonableness: organizations must collect and use personal information only for purposes that a reasonable person would consider appropriate. This test ensures that privacy rights remain adaptable and contextual rather than absolute.

Common Questions

F.A.Q.

Disclaimer: The answers provided in this FAQ section are general in nature and should not be relied upon as formal legal advice. Each individual case is unique, and a separate analysis is required to address specific context and fact situations. For comprehensive guidance tailored to your situation, we welcome you to contact our expert team.

Confidential consultation

09000 00000

65 Queen Street west, Suite 1240, toronto, Ontario M5H 2M5

Requeast a Consulastion

our team of experienced lawyers are at your service