Canada’s federal privacy regulator does not write big cheques; it writes findings, and the findings do the damage. The Office of the Privacy Commissioner operates on an ombudsman model under PIPEDA: investigate, recommend, publish, and escalate to the Federal Court when organizations refuse. Companies that read “no direct fines” as “no risk” misunderstand how the last decade of Canadian privacy enforcement actually played out.
| Authority | Office of the Privacy Commissioner of Canada |
|---|---|
| Direct fines | None under PIPEDA (offences to CAD 100,000 via prosecution) |
| Escalation path | Compliance agreements; Federal Court applications |
| Decisions database | priv.gc.ca actions and decisions |
The cases that define the OPC’s posture
Facebook (2019 finding; FCA 2024). The Cambridge Analytica investigation found meaningless consent for app-based disclosure of friends’ data. Facebook contested; the Federal Court of Appeal sided with the OPC in 2024, holding Facebook breached PIPEDA’s consent and safeguard duties, and a settlement with ongoing obligations followed. The lesson: findings are enforceable, just slowly.
Home Depot (2023). Sharing e-receipt email addresses and purchase data with Meta for ad measurement, relying on implied consent, failed: customers would not reasonably expect it, and the disclosure was invisible at collection. The finding reset Canadian expectations for retail data sharing with ad platforms.
Clearview AI (2021, joint). Scraping billions of face images was mass surveillance without consent for an inappropriate purpose; Clearview left the Canadian market and provincial orders followed. The companion RCMP finding put users of unlawful databases on notice too.
23andMe (2025, joint with the UK ICO). The credential-stuffing breach investigation found inadequate authentication safeguards; the ICO fined GBP 2.31 million on its side, while the OPC issued findings and recommendations, a clean illustration of the penalty gap between regimes.
What enforcement costs when there is no fine
Remediation programs (consent redesign, deletion, monitoring), compliance agreements with reporting duties, and above all litigation: Canadian class-action counsel treat OPC findings as pre-built liability roadmaps. Add the multi-regulator reality: joint investigations pull in Quebec’s CAI, which can fine up to CAD 25 million or 4% of turnover under Law 25, and the coming PIPEDA successor is expected to add federal penalties in the same range (Bill C-27’s CPPA proposed 5% of global revenue).
The defensible position is the one the OPC’s findings keep describing: consent people would recognize, disclosures that match reality, and safeguards proportionate to sensitivity, verifiable on your own site with a free scan. The baseline duties are in the PIPEDA principles guide.