Effective January 1, 2024, the Information Privacy Commissioner
of Ontario (IPC) gained the enforcement power of imposing
administrative monetary penalties (AMP) on organizations and
individuals that contravene PHIPA or its
regulations.1 An AMP may be issued for the purpose
of encouraging compliance with PHIPA, or to prevent a person from,
directly or indirectly, deriving an economic benefit from
contravening PHIPA.
The IPC is able to order an AMP to a maximum of $50,000 for an
individual and $500,000 for an organization. If the offender
received an economic benefit that is in excess of the AMP maximum,
the IPC can order that they pay that amount.
In its
Administrative Monetary Penalties: Guidance for the Health Care
Sector, the IPC provided a non-exhaustive list of examples of
contraventions of PHIPA that could attract an AMP as an appropriate
enforcement option:
