OPC Opens PIPEDA Probe Into Navigate360 Crime Stoppers Breach

OPC Opens PIPEDA Investigation Into Navigate360 Over Crime Stoppers Breach

Canada's Privacy Commissioner opened an investigation on October 27, 2026 into Navigate360, the commercial vendor behind the tip platform used by Canadian Crime Stoppers chapters. The OPC release notes that PIPEDA applies to organizations collecting, using or disclosing personal information in the course of commercial activities, and that it generally does not apply to not-for-profit organizations such as Crime Stoppers.

Information last verified on October 31, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This covers Canadian federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), as administered by the Office of the Privacy Commissioner of Canada. It does not cover provincial private-sector statutes, the federal Privacy Act that applies to government institutions, police handling of tips already passed to investigators, or any proceeding outside Canada.

What Happened

The Office of the Privacy Commissioner of Canada (OPC) issued a news release from Gatineau, Quebec on October 27, 2026 under the headline "Privacy Commissioner of Canada to investigate data breach involving Crime Stoppers." The page carries a date modified value of 2026-10-27. It says Privacy Commissioner Philippe Dufresne "has opened an investigation related to a cybersecurity incident involving tips shared with Crime Stoppers programs across Canada."

The release identifies the subject of the investigation and its scope in one paragraph.

"The Commissioner initiated the investigation into Navigate360, the commercial organization that provides and manages the tip management platform used by Canadian Crime Stoppers' chapters. The investigation will examine the security safeguards that Navigate360 had in place at the time of the breach to determine the organization's compliance with Canada's federal private-sector privacy law." Source: Office of the Privacy Commissioner of Canada, news release, October 27, 2026

That is the whole of the stated scope, and it is a question rather than a conclusion. No finding has been made, and nothing in the release says Navigate360 contravened PIPEDA or any other law.

The OPC also says it reached out to Crime Stoppers to offer expertise and guidance on responding to a privacy breach, and that it reached out to Navigate360. It describes that engagement as focused on breach containment, measures to reduce risks to those affected, and actions to prevent future breaches.

Then comes the jurisdictional line that makes this story legally interesting rather than routine.

"PIPEDA generally does not apply to not-for-profit organizations. Crime Stoppers is a not-for-profit organization." Source: Office of the Privacy Commissioner of Canada, news release, October 27, 2026

The release closes by saying that because the matter involves an active investigation, "the OPC is not in a position to provide further details at this time." The only contact given is the OPC communications address. No docket, file number or deadline is published. As of October 31, 2026 the OPC news and announcements index showed nothing newer on this matter; the next release after October 27 concerns artificial intelligence in health research.

Navigate360 has published a notice of data breach on its own website, dated in late October 2026. It says the company became aware of suspicious activity on one of its systems on or about March 18, 2026, instituted mitigation measures, and retained a cybersecurity firm whose investigation reached a conclusion the company states directly.

"an unauthorized third party accessed one of our systems and obtained copies of some data between November 21, 2025 to March 5, 2026" Source: Navigate360, Notice of Data Breach, navigate360.com

The same notice says potentially impacted information "may include name, address, date of birth, social security numbers, telephone numbers, email addresses, and other categories of sensitive information," and that "We have no evidence of misuse of any personal information for fraud or identity theft." It says Navigate360 reported the incident to law enforcement and notified regulatory bodies. The notice is written in United States terms, down to the reference to US national holidays on its support line, and it does not mention Canada, PIPEDA, the Privacy Commissioner, Crime Stoppers or the tip platform by name.

Individual chapters have published their own accounts. Toronto Crime Stoppers issued a statement dated October 21, 2026 from its chair, Sean Sportun, announcing that it had paused the program, removed the tip submission feature from its website, and directed the National Anonymous Call Centre to stop accepting information intended for Toronto Crime Stoppers. That statement attributes specific figures to the vendor: Navigate360 told the chapter that 176,859 Toronto tips dating from January 2022 to November 2025 were in the stolen data, that 12,392 of those tips potentially contained personal information, and that roughly 14,973 names could be associated with the affected tip numbers. The chapter says it was not told whether those names belong to people who submitted tips, people named in tips, or both, and that it has still not been given the text of the stolen tips.

National Capital Area Crime Stoppers has also suspended tip collection, saying the Ottawa Police Service advised that it was pausing its participation in the program. That chapter says on its own site that it relies solely on donations and contributions from private citizens and local businesses, and that no funds are received from any government agency.

What the Record Does Not Show

Press coverage of this breach carries national tip counts and other totals. Those figures are not in the OPC release, which quantifies nothing at all, and we are not repeating any number that we could not trace to a primary document we opened ourselves. The figures above appear here only because they sit in a Crime Stoppers chapter's own published statement or in the vendor's own notice, and they are reported as what that chapter says the vendor told it.

The restraint matters for a specific reason. Under the Breach of Security Safeguards Regulations, a report to the Commissioner must state the number of individuals affected, or the approximate number if that is unknown. So a number may well exist inside this file. It has not been made public, and a figure that circulates without a source is not the same thing as a figure a regulator has confirmed.

What the Law Actually Says

PIPEDA is Canada's federal private-sector privacy statute, and its reach is defined by activity rather than by sector. Section 4(1)(a) applies Part 1 of the Act to every organization in respect of personal information that "the organization collects, uses or discloses in the course of commercial activities." Section 2(1) defines commercial activity as "any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists." Section 4(2)(a) carves out government institutions subject to the federal Privacy Act. Our explainer on how Canada's federal private-sector privacy law works walks through that structure in detail, and the separate regime for federal government institutions is covered in our guide to the Privacy Act and how it differs from PIPEDA.

Section 5(1) requires every organization to comply with the obligations set out in Schedule 1, while section 5(2) provides that where Schedule 1 uses the word should, it indicates a recommendation and does not impose an obligation. The release says the OPC will examine Navigate360's security safeguards. It names no provision. The provision that governs safeguards is Principle 7, clause 4.7 of Schedule 1.

"Personal information shall be protected by security safeguards appropriate to the sensitivity of the information." Source: PIPEDA, Schedule 1, clause 4.7

Clause 4.7.1 requires those safeguards to protect personal information against loss or theft and against unauthorized access, disclosure, copying, use or modification, in any format. Proportionality sits in clause 4.7 itself, which requires safeguards appropriate to the sensitivity of the information. Clause 4.7.2 adds that more sensitive information should be safeguarded by a higher level of protection, and clause 4.7.3 says the methods of protection should include physical, organizational and technological measures, naming passwords and encryption as examples of the last. Both of those clauses use the word should, so section 5(2) makes them recommendations rather than obligations. Section 2(1) of the Act then defines a breach of security safeguards by reference back to clause 4.7: the loss of, unauthorized access to, or unauthorized disclosure of personal information resulting from a breach of an organization's safeguards or from a failure to establish them.

The reporting duties sit in Division 1.1. Section 10.1(1) requires an organization to report to the Commissioner any breach of security safeguards involving personal information under its control where it is reasonable in the circumstances to believe the breach creates a real risk of significant harm to an individual. Section 10.1(3) requires notification to the affected individual on the same threshold. Section 10.1(7) defines significant harm to include humiliation, damage to reputation or relationships, loss of employment, financial loss, identity theft and bodily harm. Section 10.1(8) lists the factors relevant to real risk: the sensitivity of the information, the probability of misuse, and any other prescribed factor. Section 10.3(1) requires a record of every breach.

The Breach of Security Safeguards Regulations, SOR/2018-64, registered March 27, 2018 and in force November 1, 2018, fill in the detail. Section 2(1) requires the report to the Commissioner to be in writing and to set out the circumstances and cause, the day or period of the breach, a description of the personal information involved, the number of individuals affected or the approximate number, and the steps taken to mitigate harm and to notify people. Section 3 requires the notice to an affected individual to describe the breach, the information involved, and the steps that person could take to reduce the risk of harm. Section 6(1) requires records of every breach to be kept for 24 months after the organization determines the breach occurred.

How PIPEDA's Commercial-Activity Test Applies Here

The chain of custody for a Crime Stoppers tip runs from the member of the public, to the chapter, to a platform the chapter pays a company to run. PIPEDA's accountability principle addresses that arrangement directly.

"An organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. The organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party." Source: PIPEDA, Schedule 1, clause 4.1.3

The OPC's own guidance on mandatory breach reporting applies that principle to exactly this fact pattern, where a principal organization transfers personal information to a processor and the breach happens at the processor.

"Therefore in this context, we find it reasonable to interpret the principal organization as having control of the personal information and therefore responsibility for breach reporting in respect of a breach that occurs with the third party processor." Source: Office of the Privacy Commissioner of Canada, What you need to know about mandatory reporting of breaches of security safeguards

That matters here. In the ordinary case the reporting duty would land on the principal organization, which in this fact pattern means the chapters. The release says PIPEDA generally does not apply to not-for-profit organizations and that Crime Stoppers is one, so on the OPC's stated position the chapters' own PIPEDA reporting duties are uncertain. Generally is the OPC's word, and it is doing work. Commercial activity by a non-profit can still be caught, and the section 2(1) definition quoted above expressly includes the selling, bartering or leasing of donor, membership or other fundraising lists. The release does not say whether any chapter activity is commercial.

The same OPC guidance addresses the other side of the arrangement. It says control must be assessed case by case, informed by contractual arrangements and commercial realities, and that a processor which uses or discloses the personal information for its own purposes is no longer simply processing on another organization's behalf and is itself acting as an organization in control of the information. If Navigate360 provides and manages the platform as a commercial service, that is the conduct the section 4(1)(a) test is built around, and the release describes it as the commercial organization that provides and manages the platform. The release does not say how the OPC has resolved the application question, and we do not treat it as decided.

Where a chapter sits outside PIPEDA, the next question is whether a provincial private-sector statute covers it instead, and that depends on each province's own scope rules rather than on the federal test. Our coverage of the private-sector privacy acts in Alberta and British Columbia sets out how those regimes are structured.

What the Commissioner Can Order, and What He Cannot

PIPEDA lets the Commissioner start a matter without waiting for a member of the public. Section 11(2) provides that if the Commissioner is satisfied there are reasonable grounds to investigate a matter under Part 1, the Commissioner may initiate a complaint in respect of the matter, and section 12(1) then requires an investigation. The October 27 release says the Commissioner initiated the investigation. It does not cite a subsection, and we are not attributing one to it.

What arrives at the end is a report, not an order. Section 13(1) requires the Commissioner to prepare a report within one year after the day the complaint is filed or initiated, containing the findings and recommendations, any settlement reached by the parties, where appropriate a request that the organization give notice of action taken or proposed to implement the recommendations, and the recourse available under section 14. Section 13(3) requires the report to go to the complainant and the organization without delay.

Binding remedies come from the Federal Court. Section 14(1) lets a complainant apply to the court for a hearing after receiving the report, in respect of matters including clause 4.7 of Schedule 1 and Division 1.1, and section 14(2) sets a one year window. Section 14(3) states for greater certainty that those subsections apply in the same manner to complaints initiated by the Commissioner under section 11(2) as to complaints filed by an individual. Who the applicant would be in a Commissioner-initiated matter is a good deal less clear. Section 14(1) gives the right to a complainant, the Act does not define that term in section 2(1), and a complaint initiated by the Commissioner under section 11(2) has no individual complainant behind it. Section 15 gives the Commissioner standing to apply to the court or appear, but only "in respect of a complaint that the Commissioner did not initiate." Section 16 is where real consequences live: the court may order an organization to correct its practices, order it to publish a notice of corrective action, and award damages to the complainant, including damages for humiliation.

The Act does not give the Commissioner a power to fine for a safeguards failure, based on the consolidated Act as read on October 31, 2026. The leverage in an OPC investigation is the finding, the recommendations, the public report and any court route that may follow.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The substance of this announcement is not the breach. It is the shape of the regulator's reach. Canada's federal private-sector law is drawn around commercial activity, and that drafting choice decides who answers for a given set of records before anyone looks at a single safeguard. A tip travels from a volunteer-run charity into a vendor's database, and the statute attaches to the vendor's side of that handoff.

There is a possible mismatch worth naming. The OPC's published interpretation normally puts the breach reporting duty on the principal organization that handed information to a processor. In this matter the principal organizations are not-for-profits that the release says PIPEDA generally does not cover, while the investigation is directed at a commercial vendor. Generally is the OPC's word: commercial activity by a non-profit can still be caught, and section 2(1) names the sale of donor, membership or fundraising lists as an example of it. The release does not say whether any chapter activity is commercial, so this is a gap in the public record rather than a settled division of responsibility.

It is also worth being precise about what an investigation is. Section 12(1) opens a fact finding process. Nothing has been decided, Navigate360 has not been found to have contravened PIPEDA or any other law, and the Commissioner's own release says the OPC cannot say more while the matter is active. A safeguards analysis under clause 4.7 is a reasonableness assessment calibrated to the sensitivity of the information. What was in the stolen data has not been made public, so the sensitivity question is open. We predict no answer and offer none.

The visible gap in the public record is informational rather than legal. A regulator has a reporting regime that requires the number of affected individuals be stated in writing. Chapters say they have asked for the underlying records for months. Members of the public have read totals in press coverage that no official document has confirmed. An investigation under section 12 is one of the few mechanisms in the Act that can compel that record into the open, and section 13 is what eventually makes part of it public.

How This Affects You

If you submitted a tip to a Canadian Crime Stoppers program, the public record as it stands does not tell you whether your specific tip was in the stolen data. Toronto Crime Stoppers says it has not been given the text of the stolen tips and so cannot say what each one contains. Several chapters have suspended tip intake and have directed people to contact their local police service directly, or to call 911 in an emergency.

Toronto Crime Stoppers also warns in its statement that it will never contact someone first to ask for a tip number, password or anything else, which is a useful marker for anyone who receives an unexpected message referring to a tip. Information from a breach of this kind is the raw material for exactly that sort of approach.

For organizations, the operative lesson sits in clause 4.1.3 and the OPC's control guidance rather than in the news. Handing personal information to a processor does not hand over responsibility for it, and the obligation to use contractual or other means to secure a comparable level of protection is part of the statute itself. Whether any given entity falls inside PIPEDA at all turns on the commercial activity test in section 4(1), which is the first question to answer and not the last. Our Canadian privacy coverage and our overview of how Canada's data privacy framework fits together set out the federal and provincial regimes and where each one applies.

This is general legal information, not legal advice. It covers Canadian federal private-sector privacy law under PIPEDA and reflects sources verified on October 31, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• PIPEDA explained
• how the federal Privacy Act governs government institutions
• the way private-sector privacy law works in Alberta and British Columbia
• our full Canadian privacy section
• a country level overview of Canadian data privacy law

---

Last updated: 2026-10-31. This is a developing story; details verified as of 2026-10-31.

Frequently Asked Questions

Has Navigate360 been found to have broken Canadian privacy law?

No. The Office of the Privacy Commissioner of Canada announced on October 27, 2026 that it had initiated an investigation into Navigate360 under PIPEDA. An investigation is a fact finding process under section 12 of the Act and no finding has been made. Nothing has been decided.

Why is the Privacy Commissioner investigating the software vendor instead of Crime Stoppers?

The release does not spell out its reasoning. It says PIPEDA applies to organizations that collect, use and disclose personal information in the course of commercial activities, under section 4(1)(a), that PIPEDA generally does not apply to not-for-profit organizations, and that Crime Stoppers is a not-for-profit organization. It describes Navigate360 as the commercial organization that provides and manages the tip platform. The release does not say whether any chapter activity is commercial, and generally is its own word.

How many tips or people were affected by the Crime Stoppers breach?

The OPC release does not say. It gives no number of tips, no number of affected individuals and no breach date. Toronto Crime Stoppers says in its own October 21, 2026 statement that Navigate360 told it 176,859 Toronto tips from January 2022 to November 2025 were in the stolen data, that 12,392 potentially contained personal information, and that about 14,973 names could be linked to those tip numbers. Navigate360 notice of data breach states no total.

Which PIPEDA provision governs the safeguards the OPC says it will examine?

The release says only that the OPC will examine the security safeguards Navigate360 had in place at the time of the breach. It names no provision. The provision that governs safeguards is clause 4.7 of Schedule 1, made binding by section 5(1), which requires that personal information be protected by security safeguards appropriate to the sensitivity of the information. Clauses 4.7.2 and 4.7.3 add detail using the word should, which section 5(2) makes a recommendation rather than an obligation.

When does a company have to report a data breach to the Privacy Commissioner of Canada?

Section 10.1(1) of PIPEDA requires an organization to report a breach of security safeguards involving personal information under its control where it is reasonable in the circumstances to believe the breach creates a real risk of significant harm to an individual. The Breach of Security Safeguards Regulations, SOR/2018-64, set the written contents in section 2(1), including the number of individuals affected or the approximate number.

Can the Privacy Commissioner fine a company under PIPEDA?

Not for a safeguards failure. Section 13(1) produces a report containing findings and recommendations. Binding remedies come from the Federal Court under sections 14 to 16, where the court may order an organization to correct its practices, order it to publish a notice of corrective action, and award damages to the complainant including damages for humiliation.

Who is responsible for personal information once it is given to an outside platform?

Clause 4.1.3 of Schedule 1 to PIPEDA says an organization remains responsible for personal information transferred to a third party for processing and must use contractual or other means to provide a comparable level of protection. OPC guidance adds that control is assessed case by case and that a processor using the information for its own purposes may itself be in control of it.