Privacy Claims and Privacy Advisory in Alberta

Privacy problems tend to arrive from one of two directions. An organization discovers it has lost or mishandled personal information and has to decide what the law requires it to do in the next few days. Or an individual discovers that information about them, or images of them, have been collected, shared or published without their consent and wants it stopped, and the firm acts in both situations.

Obligations on Alberta organizations

Most private sector organizations in Alberta are governed by the Personal Information Protection Act, with federally regulated businesses such as banks, airlines and telecommunications companies falling under the federal statute instead. PIPA governs how personal information is collected, used and disclosed, requires consent in most circumstances, gives individuals a right of access to their own information, and obliges organizations to protect the information they hold.

The provision that matters most in a crisis is breach notification. Where personal information is lost or accessed without authorization and there is a real risk of significant harm to an individual, the organization must notify the Information and Privacy Commissioner without unreasonable delay, and the Commissioner can require that affected individuals be notified as well. Alberta was the first province to make that mandatory, and the assessment of what counts as a real risk of significant harm is one the firm is regularly asked to make.

Access requests and complaints

An individual can ask an organization for their own personal information, and the organization has to respond within the statutory period, subject to limited exceptions. Where a request is refused or a person believes their information has been mishandled, they can complain to the Commissioner, who can investigate and issue orders. Employees, former employees and customers use this route more than organizations expect, and the response to a request is the point at which most privacy complaints are either avoided or created.

Civil claims by individuals

Alberta courts have recognized a civil claim for public disclosure of private facts, where genuinely private information is published in a way that would be highly offensive to a reasonable person and there is no legitimate public interest in it. Where the information is an intimate image, Alberta’s Protecting Victims of Non-Consensual Distribution of Intimate Images Act makes the distribution a tort that can be sued on without proof of damage, with remedies that include damages, an accounting of profits and an injunction, and distribution is also a criminal offence.

Related claims often travel with these, so where the conduct is repeated and targeted, the tort of harassment recognized by the Court of King’s Bench may apply; where it involves false statements, defamation does. The tort of intrusion upon seclusion, recognized in Ontario, has been raised in Alberta but its status here is less settled, and the firm advises on which claims the facts actually support rather than pleading everything.

What to do in the first days

For an organization, contain the incident, record what is known, assess the risk of harm and take advice on notification before the statutory clock becomes the problem. For an individual, preserve the evidence with screenshots showing the account, the content and the date, do not engage with the person responsible, report to the platform and, where the material is intimate or the conduct is criminal, to police.

Where the firm can act

Privacy compliance, breach response, access requests and advice are available to organizations and individuals anywhere in Alberta. Civil claims are taken where the file proceeds through the Calgary Courts Centre. The practice is virtual, so meetings happen by video, telephone and email, with in-person meetings available on request in Cochrane or in Calgary.

If your organization has had a privacy incident, or your own information or images have been shared without consent, call (587) 328-3328.

Book a Confidential Consultation

Frequently Asked Questions

Do we have to report a data breach in Alberta?

Yes, where there is a real risk of significant harm to an individual. The organization must notify the Information and Privacy Commissioner without unreasonable delay, and the Commissioner can require notice to the individuals affected.

Can I get a copy of the information a company holds about me?

Yes. PIPA gives you a right of access to your own personal information, subject to limited exceptions, and the organization must respond within the statutory period.

Someone shared private photos of me. What can I do?

Alberta legislation makes distributing an intimate image without consent a tort that can be sued on without proof of damage, and it is a criminal offence. Preserve the evidence, report to the platform and police, and get advice on an injunction.

Can I sue for invasion of privacy in Alberta?

Alberta recognizes a claim for public disclosure of private facts and the intimate image tort. Intrusion upon seclusion, the Ontario tort, has been raised here but is less settled. Which claim fits depends on what was done.