The investigation found that the firm violated both the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and the provincial Personal Information Protection Act (PIPA).