Naming & shaming: Understanding the implications of privacy complaints
As a privacy strategist, I was consulted by a company that received a Notice from the Office of the Privacy Commissioner of Canada (“OPC”). The Notice outlined that someone had filed a complaint against the company. The company felt the complaint was frivolous. Perplexed by the ordeal, the company reached out to me with a burning question: why would someone bother filing a complaint with a privacy regulator, especially if the complaint seemed frivolous?
The company was convinced that the complainant had ulterior motives, perhaps seeking monetary compensation. To their surprise, they learned that, contrary to popular belief, complainants don't receive financial rewards if their grievances are deemed valid by the privacy regulator.
Of course, this led them to ask the next obvious question: Why anyone would go through the trouble of filing a complaint with the OPC, especially if it appears baseless? The answer is simple: to name and shame.
Behind every complaint lies a sense of injustice or wrongdoing felt by the complainant. The OPC provides individuals with an avenue to file a complaint when they feel their privacy was breached. In many cases, the complaint is justified and so are the OPC’s investigation and resultant regulatory orders. This process has resulted in many positive changes in protecting consumers’ privacy.
However, when a frivolous complaint is filed, even if the OPC finds the complaint to be unsound, there may be some residual implications for the company, as discussed below.
Once a complaint is filed, the OPC may investigate it to determine if the individual’s privacy rights have been contravened. The OPC will conduct an objective, fair, and impartial investigation to resolve the complaint and prevent contraventions from recurring.