Perhaps I could just provide a quick answer to this question, and then I'm afraid I am going to have to leave. I apologize for that.
Similarly to Quebec, in Ontario, if information was disclosed improperly, we would have the ability to conduct an investigation, either because we received a complaint or on our own initiative, and having conducted that investigation, we could issue a report commenting on its inappropriateness.
I think the more common scenario for us, though, is cases where institutions may have collected information for one purpose and then are repurposing that information for a secondary purpose that is not permitted by law.