Personal Health Information Protection Act, 2004, offences and damages for breach of privacy
S.O. 2004, c. 3, Sched. A, ss. 65, 72
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Attorney General of Ontario, whose consent a prosecution requires
- Obligation class
- Prohibition, Governance
- Audit expectation
- none
As of .
What it requires
- These offences reach any person, including a custodian, an agent, a supplier to a custodian and a person who holds a health number or de-identified information.
- Do not wilfully collect, use or disclose personal health information in contravention of the Act or its regulations, and do not wilfully dispose of a record in contravention of the secure disposal duty.
- Do not contravene the health number rules in section 34 (2), (3) or (4), and do not wilfully use de-identified information to identify an individual.
- Do not make a request for access to or correction of a record of personal health information under false pretences, and do not wilfully obstruct or mislead the Commissioner or fail to comply with the Commissioner's order.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Subsection 72 (1) lists the offences, among them wilfully collecting, using or disclosing personal health information in contravention of the Act, and subsection 72 (2) sets the penalty for a natural person at a fine of not more than $200,000 or imprisonment for not more than one year, or both.
Penalty structure
Section 72 (2) sets a fine of not more than $1,000,000 for a person that is not a natural person, and for a natural person a fine of not more than $200,000 or imprisonment for not more than one year, or both.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 1,000,000
What this law does
A person is guilty of an offence if the person wilfully collects, uses or discloses personal health information in contravention of the Act or its regulations.
The offences also include contravening the health number rules in subsection 34 (2), (3) or (4), wilfully contravening the limit on using de-identified information to identify an individual, wilfully disposing of a record in contravention of the secure disposal duty, wilfully failing to comply with an order of the Commissioner, and making a request under the Act for access to or correction of a record under false pretences.
A person who is a natural person and is convicted is liable to a fine of not more than $200,000 or to imprisonment for not more than one year, or to both, and a person that is not a natural person is liable to a fine of not more than $1,000,000. An officer, member, employee or other agent of a corporation who authorized the offence, or who had the authority to prevent it and knowingly refrained from doing so, is a party to and guilty of the offence.
A prosecution may not be commenced without the consent of the Attorney General or the Attorney General's agent. The penalties in subsection 72 (2) are as amended by chapter 5 of the Statutes of Ontario, 2020, in force from . If the Commissioner has made an order that has become final, a person affected by the order may commence a proceeding in the Superior Court of Justice for damages for actual harm suffered as a result of a contravention of the Act or its regulations.
A person affected by the conduct that gave rise to an offence of which a person has been convicted may commence a proceeding for damages for actual harm once the conviction has become final. If the harm was caused by a contravention or offence that the defendants engaged in wilfully or recklessly, the court may include in its award of damages an award, not exceeding $10,000, for mental anguish.
When LexLint raises it
When your app profile says your app handles health records, trains models or crawls the web.