Federal privacy complaints jump as business breaches touch 20 million Canadians
Complaints to the Office of the Privacy Commissioner of Canada under the federal private sector privacy law more than doubled in 2025-26, and businesses filed nearly 700 breach reports affecting more than 20 million Canadians, according to the commissioner's annual report tabled in Parliament on June 4.
The report, titled Championing privacy in the age of AI, gives the clearest annual measure of how often Canadians' data is exposed and how much pressure the federal regulator is under while it still lacks the power to fine companies.
The numbers
According to the Office of the Privacy Commissioner:
- PIPEDA complaints rose to 3,044, up 109 per cent from 2024-25.
- Privacy Act complaints about federal institutions rose 62 per cent to 3,146.
- Complaints about federal institutions missing legal deadlines to answer personal information requests rose 121 per cent.
- Federal institutions filed about 450 breach reports affecting more than 48,000 Canadians.
- Businesses filed almost 700 breach reports affecting more than 20 million Canadians.
The office closed 975 Privacy Act complaints and 302 PIPEDA complaints through early resolution, a shorter process that ends with a brief report.
A separate bulletin on federal institutions said mishandling of information was by far the leading cause of public sector breaches, ahead of cyber incidents, employee snooping and security vulnerabilities.
Why complaints are rising
The office suggested the jump in PIPEDA complaints may reflect greater awareness of its complaint process and easier access to it after AI-enhanced search engines launched in Canada, Lexpert reported.
Priorities
The report highlights the joint investigation with provincial counterparts into TikTok, work on children's privacy, and the office's own internal AI tool. Commissioner Philippe Dufresne was also elected chair of the Global Privacy Assembly. "Prioritizing privacy is essential to enabling innovation in Canada's best interests," Dufresne said.
What it means
A breach count affecting more than 20 million people in a country of about 41 million means most Canadians should assume some of their information has been exposed in the past year. The figures also add weight to the commissioner's long-standing calls for order-making powers and monetary penalties, which the government's Bill C-36, tabled later in June, would give to a new regulator.
What to do
- Treat breach notification letters seriously and follow their instructions, including credit monitoring offers.
- Consider placing a fraud alert with Equifax Canada and TransUnion Canada if government ID numbers were exposed.
- Organizations should review breach records, which PIPEDA requires them to keep for every breach of security safeguards.
