Under the Personal Information Protection and Electronic Documents Act of Canada, the contractor only has the right to take photographs of your private dwelling if you give consent.
Furthermore, the photographs may only be used for the purpose to which you gave consent.
Most importantly, the photographs are private information (interior for sure, exterior is harder to argue but not impossible). That means that under PIPEDA, you have the right to:
Demand copies of all private data belonging to an "identifiable individual" (that's you) and
Demand that the private data be destroyed. This could become difficult if you've effectively contracted (verbally or otherwise) to permit the continued retention and use of your data.
Here is the process:
Politely request copies of the photos.
If refused, write an email to them stating that you are now requiring the data under PIPEDA, which is a federal law that applies to all corporations. Make sure that you state that the email should be forwarded to the company's Privacy Officer, or that their contact information should be provided if they will not forward it automatically.
If they still do not comply, escalate to a complaint with the Privacy Commissioner of Canada.
Most corporations (let alone small-medium businesses) in Canada are blissfully ignorant of the duties they are bound to under PIPEDA. I would, for example, strongly suspect that if you requested the contact information for their Privacy Officer, they'll not be able to provide one, nor understand that they're legally required to have one appointed.
I would try by all means to resolve this peacefully first. The route of the Privacy Complaint is long. The Privacy Commissioner is allowed to take one year to process your case. If they ultimately issue a Report of Findings, this accomplishes nothing except gives you the statutory right to now proceed to Federal Court in legal action for the violations found.
It should be noted that Federal Court is the most difficult to navigate. There are rules upon rules, right down to line spacing in your filings. While there is some leniency for self represented applicants in this scope, it's not broad. You won't get a free pass to fumble all of the rules. And finally, the awards for privacy violations are tiny. Expect to lose money, whether you hire a lawyer or not.
For your specific case:
Since your interest is due to another, more expensive dispute, it may be worth it to pursue this avenue. In my experience, the Privacy Commissioner is much more interested in using the investigation phase to pressure the offending party into compliance than trying to find guilt. This phase costs you nothing, costs the respondent (they have to answer / facilitate the Privacy Commissioner) and they may yield.
The important thing to keep in mind is that private data belongs to you. You control what is done with it. Since the relationship appears to already be hostile, I would jump directly to a formal privacy disclosure request, and specifically call out the original copies of all photos. I would explicitly state that "deletion of the data after this request will cause me significant financial losses and other harms that will have to be cured." It's your data and you're making it clear that you want copies specifically for harm reduction, such that non-compliance will induce the harms you're trying to mitigate.
From a legal risk perspective, they'll be putting themselves squarely under judgment if the Commissioner later finds that they deleted after your request, or finds that they failed to fulfill it. Either scenario could put you on a path to being one of the rarer cases where awarded damages for a privacy violation are significantly above the normal awards because you could articulate clear losses ("I had to demolish XYZ unnecessarily because I couldn't narrow down issue N to area B").
However, given that all of this was done related to an insurance claim, it's highly likely that someone is retaining your photographs under other statutory obligations. This is a guess, but I assume someone would want to retain proof of work related to significant financial expenditures, and probably also for legal shielding should disputes arise.
Disclaimer:
I am not a lawyer, not your lawyer. I am simply a Canadian who has fought and won some significant privacy-centric legal disputes as a self represented litigant.
