Private investigators regularly handle information that most businesses would consider highly sensitive: addresses, photographs, vehicle information, employment details, online activity, personal relationships, financial indicators and evidence connected with disputes.

That access comes with significant responsibility.

In Ontario, a private investigation business is principally governed by two important legal frameworks:

1. Ontario’s Private Security and Investigative Services Act, 2005, commonly called PSISA; and
2. The federal Personal Information Protection and Electronic Documents Act, commonly called PIPEDA.

These laws serve different purposes. PSISA regulates who may provide private investigation services and establishes professional and operational standards. PIPEDA governs how private-sector organizations collect, use, disclose, safeguard and retain personal information in commercial activities.

Together, they help protect the public while establishing standards for legitimate professional investigations.

What Is a Private Investigator Under Ontario Law?

PSISA defines a private investigator as a person who performs work for remuneration that consists primarily of conducting investigations to provide information.

The Act specifically identifies information concerning:

• The character or actions of a person;
• A person’s business or occupation; and
• The whereabouts of people or property.

This definition covers many common investigative services, including skip tracing, surveillance, fraud investigations, insurance investigations, corporate due diligence and certain forms of online investigation or OSINT.

Individual and Agency Licensing Requirements

Ontario distinguishes between an individual investigator’s licence and a business or agency licence.

A person may not act or hold themselves out as a private investigator unless they hold the appropriate individual licence and meet the employment or business requirements established under PSISA.

Similarly, a person or business may not sell private investigation services or advertise that those services are available unless the person holds the appropriate agency licence or is acting as an employee of a properly licensed agency. An agency must also ensure that every private investigator it employs holds the appropriate individual licence.

This means that operating a private investigation business normally requires more than obtaining an individual PI licence. The business itself must be properly licensed to offer investigative services to the public.

A licensed agency must conduct business under the name appearing on its agency licence. When the public is invited to deal at a physical office, the agency licence must be displayed in a conspicuous location.

Identification and Representing Authority

When holding themselves out as a private investigator, an Ontario investigator must:

• Carry their PI licence;
• Identify themselves as a private investigator when requested; and
• Produce their licence when requested.

PSISA also prohibits a private investigator from possessing identification or a symbol of authority other than the licence issued under the Act when acting or holding themselves out as a PI.

A PI licence does not make an investigator a police officer or provide general police powers. Licensed investigators and agencies must not represent their services as being connected with the police.

PSISA also prohibits the use of certain terms and variations of those terms, including:

• Detective or private detective;
• Law enforcement;
• Police; and
• Officer.

These restrictions help prevent the public from being misled about the authority of a private investigator.

The Ontario Code of Conduct

Ontario Regulation 363/07 establishes a mandatory Code of Conduct for licensed private investigators and security guards.

Among other requirements, an individual investigator must:

• Act honestly and with integrity;
• Comply with federal, provincial and municipal laws;
• Treat people equally and without discrimination;
• Avoid abusive, insulting or uncivil conduct;
• Refrain from unnecessary force;
• Avoid behaviour that is prohibited or not authorized by law;
• Protect the privacy of others;
• Treat information received during an investigation as confidential, except where disclosure is required for the work or by law; and
• Cooperate with police when legally required.

The Code also prohibits investigators from misrepresenting the type, class or conditions of their licence. Limited identity concealment may be permitted when it is genuinely necessary for an investigator to perform lawful duties, but it does not authorize illegal impersonation, fraud or other prohibited conduct.

Insurance Requirements for PI Agencies

Every licensed private investigation business entity in Ontario must carry general liability insurance of at least $2 million.

Insurance does not replace proper investigative procedures, privacy safeguards or legal compliance. However, it provides an important layer of protection for the agency, its clients and members of the public.

Mandatory Recordkeeping

A professional investigation must create a reliable record of what was requested, what was done, what was observed and how the resulting information was handled.

Under Ontario Regulation 434/07, licensed business entities must maintain prescribed records, including:

• Lists of current investigators and guards;
• Lists of investigators and guards employed during the preceding two years;
• Investigators’ notes and reports;
• Photographs;
• Video and audio recordings; and
• Other electronic records produced or obtained while providing services.

These records must generally be retained for at least two years. When a record is relevant to an ongoing investigation, inspection, complaint, court proceeding or administrative proceeding, it must be retained until that matter has concluded.

Good recordkeeping also protects the integrity of evidence. Notes should be accurate, contemporaneous and sufficiently detailed to allow an investigator to explain their actions and observations if later called as a witness.

How PIPEDA Applies to a Private Investigation Business

PIPEDA applies to private-sector organizations that collect, use or disclose personal information in the course of commercial activities. A PI agency that accepts payment to investigate a person, business, claim or event will commonly be handling personal information as part of a commercial activity.

Personal information can include much more than a person’s name and address. Depending on the investigation, it may include:

• Photographs and video recordings;
• Licence plate information;
• Telephone numbers and email addresses;
• Online identifiers and social-media activity;
• Location or movement information;
• Employment and financial information;
• Statements made by witnesses;
• Family or relationship information; and
• Allegations contained in a client’s instructions.

PIPEDA establishes ten fair information principles:

1. Accountability;
2. Identifying purposes;
3. Consent;
4. Limiting collection;
5. Limiting use, disclosure and retention;
6. Accuracy;
7. Safeguards;
8. Openness;
9. Individual access; and
10. Challenging compliance.

It also requires that personal information be collected, used or disclosed only for purposes that a reasonable person would consider appropriate in the circumstances.

Can a PI Collect Information Without the Subject’s Consent?

In some investigations, notifying the subject would defeat the purpose of the investigation. PIPEDA therefore contains limited exceptions to the general requirement for knowledge and consent.

Section 7(1)(b) may permit collection without the individual’s knowledge or consent where:

• Obtaining the information with the individual’s knowledge or consent could compromise its availability or accuracy; and
• The collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of federal or provincial law.

Information properly collected under this provision may also be used without consent in the circumstances described in section 7(2). PIPEDA may also permit disclosure to another organization where the disclosure is reasonable for investigating an actual, ongoing or anticipated breach of an agreement or contravention of law, and informing the person would compromise the investigation.

However, this is not a blanket PI exemption from privacy law.

Before relying on an exception, the agency and its client should be able to demonstrate:

• A defined and legitimate investigative purpose;
• A reasonable factual basis for the investigation;
• A connection between the information sought and the suspected breach or violation;
• Why notifying the subject would compromise the investigation;
• Why less privacy-invasive methods would not be sufficient; and
• Why the proposed collection is proportionate to the issue being investigated.

A PI licence alone does not authorize unlimited surveillance, unrestricted database access or indiscriminate collection of personal information.

Covert Surveillance Must Be Necessary and Proportionate

The Office of the Privacy Commissioner of Canada considers covert video surveillance highly privacy-invasive.

Before conducting surveillance, there should be a demonstrable evidentiary need rather than mere curiosity or unsupported suspicion. The investigation should be connected to a legitimate objective, and there should be a reasonable likelihood that surveillance will produce information relevant to that objective.

Less intrusive methods should be considered first. The scope, location and duration of surveillance should be limited to what is reasonably necessary.

Investigators must also consider innocent third parties. A camera may capture neighbours, family members, children, passengers, employees or unrelated members of the public. Information concerning such individuals should not be retained merely because it was incidentally recorded.

The Privacy Commissioner recommends deleting, depersonalizing or blurring unrelated third-party information as soon as reasonably practicable.

In one PIPEDA finding, an investigation firm used a pretext to obtain a photograph of an insurance claimant. The Privacy Commissioner concluded that the photograph was unnecessary because the firm had already collected sufficient information through less intrusive methods. The case illustrates that a potentially available consent exception does not remove the obligation to limit collection.

Information Online Is Not Automatically Free to Use

OSINT frequently involves information found on websites, search engines, social-media accounts, directories and public records.

But information being visible online does not necessarily mean it is “publicly available” for every purpose under PIPEDA.

PIPEDA’s publicly available information exception is limited to categories specified by regulation. These include certain public telephone listings, professional or business directories, legally accessible public registries and records of judicial or quasi-judicial bodies, provided the information is used for purposes directly connected with the reason it was made public.

The Office of the Privacy Commissioner has emphasized that not everything in the public domain automatically qualifies as publicly available information under PIPEDA.

Therefore, responsible OSINT requires more than asking whether information can technically be found. An investigator must also consider:

• Why the information is being collected;
• Whether collection is lawful;
• Whether the source is reliable;
• Whether the information is relevant;
• Whether the information is being taken out of context;
• Whether access controls are being bypassed; and
• How the information will be used, stored and disclosed.

Investigators should never attempt to obtain information through hacking, stolen credentials, unauthorized access or other unlawful means.

The Client and the PI Agency Share Responsibility

Hiring a private investigator does not allow a client to avoid privacy responsibilities. Likewise, acting on a client’s instructions does not relieve a PI agency of its own obligations.

The Privacy Commissioner recommends a written service agreement between the hiring organization and the investigation firm. The agreement should identify:

• The client’s authority and lawful purpose;
• The specific issue being investigated;
• The type of information requested;
• The permitted investigative methods;
• Limits on collection;
• Who may receive the report;
• Security requirements;
• Retention and destruction requirements; and
• Procedures for responding to privacy incidents or complaints.

The Privacy Commissioner’s covert-surveillance guidance states that both the hiring organization and the investigation firm are responsible for ensuring that personal information is collected, used and disclosed in accordance with privacy legislation.

Safeguarding Investigation Files

PI files often contain information that could cause serious harm if lost, misdirected or accessed without authorization.

PIPEDA requires security safeguards appropriate to the sensitivity of the information. For a PI business, appropriate safeguards may include:

• Strong passwords and multifactor authentication;
• Encryption of computers, mobile devices and storage media;
• Secure client portals instead of ordinary unprotected email;
• Restricted access based on operational need;
• Locked physical storage;
• Secure backups;
• Controls over contractors and third-party service providers;
• Documented disposal procedures; and
• Staff training on privacy and confidentiality.

PIPEDA makes an organization responsible for personal information in its custody, including information transferred to a third-party processor. Contractual or other measures must provide a comparable level of protection while that information is being processed.

Privacy Breaches

A lost investigator’s notebook, stolen laptop, compromised email account, misdirected report or improperly shared surveillance video may constitute a breach of security safeguards.

Under PIPEDA, an organization must report a breach to the Privacy Commissioner of Canada and notify affected individuals when it is reasonable to believe that the breach creates a real risk of significant harm.

Significant harm may include identity theft, financial loss, bodily harm, humiliation, damage to reputation or relationships, loss of employment and damage to professional opportunities.

Organizations must also maintain a record of every breach of security safeguards involving personal information under their control, whether or not the breach reaches the reporting threshold.

Professional Investigation Is Lawful, Focused and Accountable

A professional private investigator is not simply someone who can find information.

Professional investigation requires the investigator to understand:

• Whether there is a lawful purpose;
• Whether the client has legitimate authority;
• Whether the investigative method is proportionate;
• Whether the information is accurate and relevant;
• Whether unrelated information is being collected;
• How evidence must be preserved;
• Who is permitted to receive the results; and
• When the information should be securely destroyed.

PSISA establishes the licensing, conduct, insurance and recordkeeping framework for Ontario investigators. PIPEDA establishes privacy obligations governing the personal information handled during commercial investigations.

Compliance with both is essential to protecting the public, preserving evidence and maintaining confidence in the private investigation profession.

Reference Documents

• Private Security and Investigative Services Act, 2005, S.O. 2005, c. 34.
• Ontario Regulation 363/07 — Code of Conduct.
• Ontario Regulation 434/07 — Recordkeeping Requirements for Licensed Business Entities.
• Ontario Regulation 462/07 — Insurance.
• Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5.
• Regulations Specifying Publicly Available Information, SOR/2001-7.
• Office of the Privacy Commissioner of Canada — PIPEDA Fair Information Principles.
• Office of the Privacy Commissioner of Canada — Guidance on Covert Video Surveillance in the Private Sector.

This article provides general information about the regulatory environment affecting private investigation businesses in Ontario. It is not legal advice, and the application of privacy or licensing legislation may depend on the facts of a particular investigation.