For the Public: Privacy / Correction Complaint

The OIPC can examine if public bodies, custodians and private sector organizations have collected, used or disclosed personal or health information in accordance with Alberta’s access to information and privacy laws.

The OIPC can review decisions made about correction requests made to public bodies, custodians and private sector organizations that are subject to Alberta’s access to information and privacy laws.

Before you submit your privacy complaint or correction review, it is important to know what our office can and cannot do, steps you should follow, and our office's review process.

What the OIPC Cannot Do

• We cannot issue monetary awards and we do not issue fines.
• We cannot force anyone to be disciplined, suspended or fired from their job. Decisions related to job discipline are made by the employer – the public body, health custodian or private sector organization. We cannot change those decisions.
• We cannot change a decision made by another body or administrative tribunal about providing a benefit or issuing a penalty, such as decisions made by the Workers’ Compensation Board, Assured Income for the Severely Handicapped (AISH), Ombudsman, Maintenance Enforcement, and so on.
• We are not an advocate. We cannot represent you in your complaint. We also do not represent the public body, health custodian or private sector organization.

Back to top of the page

What The OIPC Can Do

The OIPC can review decisions concerning correction requests or examine if personal or health information is handled in compliance with the following laws:

• Protection of Privacy Act (POPA) which in June 2025 replaced the Freedom of Information and Protection of Privacy Act (FOIP) – applies to the public sector or “public bodies.” For example, provincial government bodies, municipalities, school divisions, police.
• The Health Information Act (HIA) applies to “custodians”, such as the four government departments responsible for health services in Alberta or the provincial health agencies (Recovery Alberta, Assisted Living Alberta, Acute Care Alberta, Primary Care Alberta), hospital services (Alberta Health Services, Covenant Health, Lamont Health Care Centre), pharmacies and pharmacists, physicians, optometrists, registered nurses, dentists, and their health service providers or employees.
• Personal Information Protection Act (PIPA) applies to private sector “organizations”.

You may submit a privacy complaint if you believe your personal or health information was collected, used or disclosed improperly by a public body, health custodian or private sector organization that are subject to Alberta’s privacy laws.

Under PIPA, Alberta’s private sector privacy law, we also investigate complaints about whether an organization is in compliance with the Act, such as enquiries into an organization’s general practices.

You may submit a request for a review concerning a decision made by a public body, custodian or private sector organization to refuse a request you made to correct your personal or health information.

Back to top of the page

What you need to know before submitting a privacy complaint

Before you submit your privacy complaint, it is a requirement under OIPC processes, and a legal requirement with respect to privacy complaints about a public body under the Protection of Privacy Act (POPA), to make the complaint FIRST to the public body, custodian or private sector organization BEFORE asking our office for a review or submitting a complaint. 

This gives the public body, health custodian, or private organization a chance to respond to your concerns. Please allow at least 30 business days for the entity to respond after it receives your complaint.

After you attempt to resolve this matter directly with the entity, if you still have reason to believe the response has not complied with the applicable law, or you have received no response, you may submit your complaint to our office.

If you have taken this step and want to submit a complaint to our office go to “Forms” below.

If you have not taken this step, go to “Tips on how to submit a privacy complaint to a public body, custodian or private organization” below.

Back to top of the page

What you need to know before requesting a correction review

After making a correction request to public body, health custodian or private organization, those entities must tell you if they are going to make the correction. If the requested correction is refused, the entity will either annotate or link the requested correction with the personal or health information that is relevant to the requested correction.

If you are asking for a correction to an opinion, including a professional opinion, Alberta’s privacy laws do not permit this.

If you want to request a review of a decision you have received that refused to make a correction request or you have not received a response, go to the next section “Forms”.

Back to top of the page

Forms

Making a privacy complaint or requesting a review of a correction decision concerning a public body

NOTE: The Freedom of Information and Protection of Privacy Act (FOIP) was repealed and replaced with the Protection of Privacy Act (POPA) on June 11, 2025. If your correction request was made under FOIP or you believe the public body collected, used or disclosed your personal information in contravention of the FOIP Act prior to the date the FOIP Act was repealed, use the following ATIA form for a review.

If your review concerns the response or lack of response to your privacy complaint or your correction request was denied or you received no response, use this form here: POPA Privacy/Correction Request form

Making a privacy complaint or requesting a review of a correction decision concerning a health custodian

If your review concerns the response or lack of response to your privacy complaint or your correction request was denied or you received no response, use this form here: HIA Request for Review/Complaint Form

Making a privacy complaint or request a review of a decision concerning a private organization

If your review concerns the response or lack of response to your privacy complaint or your correction request was denied or you received no response, use this form here: PIPA Request for Review/Complaint form

Back to top of the page

Timelines for requesting a correction review or making a privacy complaint

For matters involving public bodies

Privacy complaints:

POPA requires that you submit your complaint to us no sooner than the expiry of the 30 business days the public body has to answer your privacy complaint AND within 60 business days after you have received a response from the public body. If you have not received a response within at least 30 business days to your complaint, you may submit your review.

Correction reviews:

Under POPA, correction request reviews must be submitted within 60 business days after you have received been notified of the decision, act or failure to act by the public body.

For matters involving health custodians

Privacy complaints:

HIA requires that you submit your complaint to us within 60 days of being notified about or become aware of the collection, use or disclosure of your health information by a custodian that you believe is not compliant with the HIA.

Correction reviews:

Under HIA, correction request reviews must be submitted to us within 60 days of being notified about a health custodian’s decision to act or failure to act that is the subject of the correction request,

For matters involving private organizations

Privacy complaints:

PIPA requires that you submit your complaint to us within a reasonable time period. What is ‘reasonable’ will be determined by the Commissioner.

Correction requests:

Under PIPA, correction request reviews must be submitted to us within 30 days of being notified about a private sector organization’s decision or act or failure to act concerning the correction request.

Back to top of the page

Who is subject to Alberta’s Privacy Laws?

Public bodies under the FOIP Act and POPA

Public bodies were governed by the Freedom of Information and Protection of Privacy Act (FOIP) until June of 2025. The FOIP Act was repealed and replaced with the Protection of Privacy Act (POPA).  POPA applies to protection of privacy of personal information held by public bodies. Public bodies are generally government bodies, for example provincial government departments, municipalities, school divisions, and municipal police services. The Protection of Privacy Act (POPA) also applies to correction requests made to public bodies after June 2025.

Health custodians under the HIA

The Health Information Act (HIA or Act) applies to “custodians”, such as the four government departments responsible for health services in Alberta or the provincial health agencies (Recovery Alberta, Assisted Living Alberta, Acute Care Alberta, Primary Care Alberta), hospital services (Alberta Health Services, Covenant Health, Lamont Health Care Centre), pharmacies and pharmacists, physicians, optometrists, registered nurses, dentists, and their health service providers or employees.

HIA also applies to correction requests made to custodians.

Private Sector organizations under PIPA

Private sector organizations are governed by the Personal Information Protection Act (PIPA). PIPA requires organizations to protect personal information, and it also applies to corrections requests made to an organization. Private sector organizations are typically any business that collects, uses or discloses personal information in Alberta.

Certain non-profit organizations are subject to Alberta’s private sector privacy law only when the non-profit organization collects, uses or discloses personal information in connection with a commercial activity.

Back to top of the page

Tips on how to submit a privacy complaint to a public body, custodian or private organization

• Contact the entity and ask who you should direct your complaint to. It might have a privacy officer, or a person dedicated to addressing your concerns.

• If your complaint concerns an Alberta government department (for a listing see https://www.alberta.ca/ministries) that you believe inappropriately collected, used or disclosed your personal information, you can submit your complaint to this email address: privacy@gov.ab.ca.

• Make your complaint in writing and keep a copy. You will be asked to provide this to our office if you come to us for a review or submit a privacy complaint.

• Clearly and briefly explain the circumstances around the collection, use or disclosure of your personal or health information and why you believe those circumstances contravene Alberta’s privacy laws.

You may find it helpful to follow the WHAT - WHEN - HOW - WHO - WHY method to explain your circumstances:

WHAT - Identify what personal or health information you believe was collected, used or disclosed by the public body in contravention of the applicable law.

WHEN – did the collection, use or disclosure occur?

HOW – did the collection, use or disclosure occur? For example, was an email with your personal information sent to the wrong person (e.g. misdirected email)?

WHO – collected, used or disclosed your personal information?

WHY – Describe why the collection, use or disclosure of your personal information was in contravention of the applicable law.

• Provide information or evidence to support that the collection, use or disclosure of your personal information occurred contrary to the applicable law.

• Write down names of people you speak with, when you spoke to them and what they said.

Back to top of the page

Important Things to Consider

Provide a completed single submission

You must provide a completed form and all supporting documents in one submission.  Otherwise, the submission(s) will be returned.

Please only provide the information that we initially ask for.

Do not send a large amount of materials, as this will delay processing, cause uncertainty in understanding your concerns, and may result in your request for review or privacy complaint being returned. Typically, submissions should not exceed 15 pages including the form and all attachments. We enforce this page limit. Your comments and attachments must be relevant to your request for review or privacy complaint and to what our office does. If we require more information from you, we will ask for it.

Talk to the public body, health custodian or private sector organization about your concerns with the correction request or your privacy complaint before submitting a review.

It may be possible to address and resolve your concern by calling the public body, health custodian or private sector organization and speaking with someone who can help you with your specific concern. This may be the best option before submitting a review or complaint to us, as your concern may be resolved more quickly.

It is a requirement under our processes, and a legal requirement under POPA, that you submit a privacy complaint to the public body involved before you submit a review with the OIPC.

Please provide contact information for timely communications

Our new settlement process involves us trying to settle a complaint or review in as short a time as is possible. For this reason, you must be available to participate in our process and respond to requests in a timely manner, usually by phone and/or email. Otherwise, a file may not be opened or may be discontinued. If you cannot meet this requirement, you may name an agent to represent you.

Please ensure you provide our office with an email address and phone number, in addition to a mailing address whenever possible. We will use secure email or any other form of secure electronic delivery for any communications containing sensitive information.

Learn about our process.

You can learn more about the OIPC review process here.

How long will a review take?

FOIP Act, HIA and PIPA Complaints and Reviews:

Because our office is currently dealing with a backlog of privacy complaints and requests for reviews under FOIP Act, HIA and PIPA, it may take several months to open and then activate your file at the settlement phase. Once activated, we will attempt to settle the matter within 90 days.

If the matter is not settled, unsettled matters may proceed to the inquiry phase if the Commissioner decides to conduct an inquiry.

In respect of inquiry matters, it may take 18 months or more to conduct an inquiry (adjudicate) and make a formal decision on a request for review or privacy complaint, if your concern is not resolved through the settlement process.

Please note the Commissioner may or may not decide to conduct an inquiry. Formal decisions are made through the OIPC’s inquiry process. More information on inquiries is available in the Practice Note - Inquiry Procedures.

POPA Complaints and Reviews:

Under the new POPA, the OIPC has shorter timelines to complete a review or investigate a complaint, including both the settlement and inquiry phases of a review.  Both laws state that the Commissioner has 180 business days to complete the review or investigation, with the ability to extend this time by an additional 180 business days.

If POPA applies to your complaint or review, it is imperative that all parties provide requested information and be available for discussions about the matter in a timely fashion at the case resolution stage. Requests to extend deadlines for providing information or discussing settlement must be reasonable with consideration for the reduced timelines.

Back to top of the page

Other relevant information to consider before making a request for review

• There is no charge to request a review or file a complaint. You do not need legal counsel, however, you can choose to use one if you want to.
• A copy of your completed request for review or privacy complaint and attached documents will be shared with the public body, health custodian or private sector organization that you are contacting the OIPC about. It may not be possible to conduct a review or investigate a complaint without sharing your name and the details of your concerns. Anonymous complaints are rarely accepted. Only in special circumstances may this be considered.
• The OIPC has a Disability Accommodation Policy on the website. Please contact us if you would like more information about using this policy.

Back to top of the page

June 2025