Request a Review / File a Complaint

Note: We ask you to read the following information before downloading, completing and submitting Request for Review or Privacy Complaint form to the OIPC. The forms are available at the bottom of this page. We do not accept a request for review or privacy complaint over the phone.

This page outlines what you may ask the OIPC to review or investigate.

Please note that our office made some adjustments to our procedures on April 1, 2024 in the interest of creating greater efficiencies in our work. This section has been updated to reflect those changes.

Requesting a review

You may ask the OIPC for a review:

• if you made an access to information request and you disagree with the response you received from the public body, health custodian or private sector organization;
• if you asked for a correction of your personal or health information and you disagree with the response you received from the public body, health custodian or private sector organization, or;
• if a public body advised you that it had made a decision to give access to your personal or business information. In this type of review you will be referred to as a “Third Party”.

Each of these is referred to as a “request for review”.

However, effective April 1, 2024, for reviews where the only concern is that you believe the public body, organization or custodian holds more responsive records than what were processed in the request (the OIPC calls this an ‘adequate search concern’), you will be required to submit the concern directly to the entity first, along with supporting evidence as to why you believe additional records exist. Please allow the entity at least 30 working days to respond to your concerns. After you attempt to resolve this matter directly with the entity, if you still have reason to believe the response does not comply with the relevant law, you may submit your complaint to our office.

Making a privacy complaint

You may also submit a complaint if you believe your personal or health information was collected, used or disclosed improperly by a public body, health custodian or private sector organization. This is typically referred to as an “investigation” into a “privacy complaint”.

However, effective April 1, 2024, the OIPC requires that you first provide the public body, health custodian or private sector organization a reasonable opportunity to respond to the details of a privacy complaint before engaging our process. Please contact the entity directly, in writing, and provide sufficient details for the entity to understand your privacy complaint. Complaints directed to the OIPC where this step has not been done will not be accepted. Please allow the entity at least 30 working days to respond to your concerns, from the date they receive your complaint. After you attempt to resolve this matter directly with the entity, if you have reason to believe the response does not comply with the relevant law, you may re-submit your complaint to our office.

Timeline for requesting a review or making a privacy complaint

Generally, you must submit a request for review or privacy complaint to the OIPC:

• within 20 days of being notified, as a third party, about a public body’s decision to give access to your personal or business information;
• within 60 days of being notified about a public body’s or health custodian’s decision on your access request or your correction request;
• within 30 days of being notified about a private sector organization’s decision on your access request or your correction request;
• within 60 days of being notified about/becoming aware of the collection, use or disclosure of your personal information by a public body or a health custodian, or;
• within a reasonable time for a privacy complaint made against a private sector organization.

What We Cannot Do

• We cannot issue monetary awards and we do not issue fines if we find your request for review or privacy complaint was valid.
• We cannot force anyone to be disciplined, suspended or fired from their job. Decisions related to job discipline are made by the employer – the public body, health custodian or private sector organization. We cannot change those decisions.
• We cannot change a decision made by another body or administrative tribunal about providing a benefit or issuing a penalty, such as decisions made by the Workers’ Compensation Board, Assured Income for the Severely Handicapped (AISH), Ombudsman, Maintenance Enforcement, and so on.
• We are not an advocate. We cannot represent you in your request for review or privacy complaint. We also do not represent the public body, health custodian or private sector organization.

Important Things to Consider When Submitting a Request for Review or Privacy Complaint to the OIPC

• Check whether the public body, health custodian or private sector organization is covered by Alberta’s laws.

We can only look into public bodies, health custodians or private sector organizations that are subject to Alberta’s access to information and privacy laws. For more information on public bodies, visit Freedom of Information and Protection of Privacy (FOIP) – Overview | Alberta.ca.

Generally, examples of custodians include Alberta Health, Alberta Health Services, Covenant Health, physicians, pharmacists, dentists, optometrists, chiropractors, and so on.

Private sector organizations are typically any business that collects, uses or discloses personal information in Alberta. However, the federal private sector privacy law applies to banks (but not Alberta credit unions), airlines, telecommunications companies, and other federally-regulated businesses. The federal private sector privacy law is called The Personal Information Protection and Electronic Documents Act. The Office of the Privacy Commissioner of Canada is responsible for reviewing privacy complaints under that law.

Certain non-profit organizations are subject to Alberta’s private sector privacy law only when the non-profit organization collects, uses or discloses personal information in connection with a commercial activity.

• Provide a completed single submission

You must provide a completed Request for Review/Complaint Form and all supporting documents in one submission.  Otherwise, the submission(s) will be returned.

• Please only provide the information that we initially ask for.

Do not send a large amount of materials, as this will delay processing, cause uncertainty in understanding your concerns, and may result in your request for review or privacy complaint being returned. Typically, submissions should not exceed 15 pages including the Request for Review/Complaint Form and all attachments. We enforce this page limit. Your comments and attachments must be relevant to your request for review or privacy complaint and to what our office does. If we require more information from you, we will ask for it.

If you submit an extremely large number of documents or if it is not clear that the information you provided falls within our area to review, your submission will not proceed to a review or investigation and you will be asked to re-submit your request for review or privacy complaint.

• Talk to the public body, health custodian or private sector organization.

It may be possible to address and resolve your concern and complaint by calling the public body, health custodian or private sector organization and speaking with someone who can help you with your specific concern. This may be the best option before submitting a matter to us, as your concern may be resolved more quickly.

As noted above, if you are asking for a review solely on the adequacy of a search or you are making a privacy complaint, you must first ask the public body, health custodian or private sector organization to address the matter, and allow them at least 30 working days to respond to you. We will return the form to you if this has not been done.

If, after reaching out to the public body, health custodian or private sector organization, you still believe your review concern or privacy complaint has not been properly addressed, and you submit a Request for Review/privacy complaint form to this office, we will ask you for a copy of the response you received (if there was one).  We will then determine whether further investigation by the OIPC is warranted.

• Please provide contact information for timely communications

Our new case resolution process involves us trying to settle matters under review or investigation in as short a time as is possible. For this reason, you must be available to participate in our process and respond to requests in a timely manner, usually by phone and/or email. Otherwise, a file may not be opened or may be discontinued. If you cannot meet this requirement, you may name an agent to represent you.

Please ensure you provide our office with an email address and phone number, in addition to a mailing address whenever possible. We will use secure email for any communications containing sensitive information.

• Learn about our process.

The OIPC’s Review and Investigation Procedures document will give you an idea of what you can expect to happen after you submit a request for review or privacy complaint.

Because our office is currently dealing with a backlog of privacy complaints and requests for review, it may take several months to open and then activate your file. Once activated, we will attempt to settle the matter within 90 days.

In respect of inquiry matters, it may take 18 months or more to conduct an inquiry (adjudicate) and make a formal decision on a request for review or privacy complaint, if your concern is not resolved through investigation or mediation. Please note the Commissioner may or may not decide to conduct an inquiry. Formal decisions are made through the OIPC’s inquiry process. More information on inquiries is available here.

• Other relevant information before making a request for review or privacy complaint.
  • There is no charge to request a review or file a complaint. You do not need legal counsel, but can choose to use one if you want to.
  • A copy of your completed request for review or privacy complaint form, and attached documents, will be shared with the public body, health custodian or private sector organization that you are contacting the OIPC about. It may not be possible to investigate or mediate without sharing your name and the details of your concerns. Anonymous complaints are rarely accepted. Only in special circumstances may this be considered.
  • The OIPC has a Disability Accommodation Policy on the website. Please contact us if you would like more information about using this policy.