Report a Municipal Data Breach in London, Ontario

Technology and Data Ontario 3 Minutes Read · published February 12, 2026 Flag of Ontario

Introduction

London, Ontario residents who suspect the City has exposed personal information should act quickly. Municipal privacy obligations in Ontario fall under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) and the Office of the Information and Privacy Commissioner of Ontario (IPC) offers guidance on breach notification. This article explains how to report a municipal data breach to the City of London, what immediate evidence to preserve, how investigations and enforcement proceed, and where to find official contacts and forms. Official sources are cited and the guidance below is current as of February 2026.

What to do immediately

  • Secure copies of any affected records, emails, screenshots and dates/times of the incident.
  • Note when you first learned of the breach and any communications from the City or third parties.
  • Report the incident to the City of London Access & Privacy office using the official contact page.[1]
Report suspected breaches promptly to preserve evidence and response timelines.

Penalties & Enforcement

The City of London and provincial bodies handle municipal privacy breaches. Specific monetary fines or daily penalties for municipal privacy breaches are not specified on the cited municipal pages; see the provincial statute for applicable offences and the IPC for procedural remedies.[3] [2]

  • Fine amounts: not specified on the cited City of London pages; consult MFIPPA and IPC guidance for statutory offences.[3]
  • Escalation: details for first, repeat or continuing offences are not specified on the cited City pages.
  • Non-monetary sanctions: the City may issue orders, require corrective actions, or matters may be referred to provincial bodies or courts; specific remedies are not listed on the cited municipal page.
  • Enforcer: primary municipal contact is the City of London Access & Privacy office; provincial oversight and complaint review go through the Information and Privacy Commissioner of Ontario.[1][2]
  • Appeals and review: complaint and review routes are handled by the IPC where applicable; exact time limits for filing appeals or complaints are not specified on the cited City pages.
If the City does not publish a penalty schedule on its Access & Privacy pages, refer to MFIPPA and IPC notices for legal remedies.

Applications & Forms

The City publishes Freedom of Information request procedures and an Access & Privacy contact page for reporting concerns. The City of London does not publish a dedicated municipal "privacy breach" form on the cited access pages; residents should use the Access & Privacy contact path to report breaches or submit an FOI/access request if seeking records.[1]

How-To

  1. Identify and preserve evidence: collect emails, screenshots, filenames and timestamps.
  2. Notify the City of London Access & Privacy office describing what data was affected and when.[1]
  3. Ask the City what containment steps and notifications they will perform and request a point of contact.
  4. If you believe statutory obligations apply or you cannot resolve the matter with the City, submit a complaint or report to the Information and Privacy Commissioner of Ontario.[2]
  5. Keep records of all communications, deadlines and any remediation the City provides for future appeal or legal steps.
Keep copies of all reports and responses in case you need to escalate to the IPC.

FAQ

Who do I contact at the City of London to report a breach?
The City of London Access & Privacy office; use the official Access & Privacy contact page to submit your report and preserve evidence.[1]
Should I also notify the Information and Privacy Commissioner?
If you cannot resolve the issue with the City or statutory review is required, you may file a complaint or report with the IPC as described on their site.[2]
Are there published fines for municipal data breaches in London?
Specific fines or daily penalty amounts are not specified on the cited City of London pages; consult MFIPPA for statutory offences and the IPC for remedies.[3]

Key Takeaways

  • Report suspected municipal breaches to the City of London Access & Privacy office immediately.[1]
  • Preserve evidence and keep detailed records of communications and timelines.
  • If unresolved, consider filing a complaint with the Information and Privacy Commissioner of Ontario.[2]

Help and Support / Resources

  1. [1] City of London — Access & Privacy
  2. [2] Information and Privacy Commissioner of Ontario — Report a privacy breach
  3. [3] Municipal Freedom of Information and Protection of Privacy Act (MFIPPA)

Categories

General Governance and Administration Public Safety Public Health and Welfare Land Use and Zoning Housing and Building Standards Transportation Environmental Protection Parks and Public Spaces Business and Consumer Protection Taxation and Finance Labor and Employment Education Civil Rights and Equity Elections and Campaign Finance Events and Special Uses Signs and Advertising Utilities and Infrastructure Technology and Data