{ "jurisdiction_id": "CA-BC", "jurisdiction": "Canada – British Columbia", "url": "https://dataprotection.gi/jurisdictions/canada-british-columbia/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-05", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 34, "sub_modules": 57, "source_register": 20 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "green", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/canada-british-columbia/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "Comprehensive, actively-enforced private-sector statute with a functioning independent regulator and confirmed federal 'substantially similar' status; recent joint enforcement (OpenAI, TikTok) demonstrates active jurisdiction.", "claims": [ { "statement": "The Information and Privacy Commissioner for British Columbia is responsible for overseeing and enforcing PIPA, FIPPA, and the E-Health Act.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/about-the-opc/what-we-do/provincial-and-territorial-collaboration/provincial-and-territorial-privacy-laws-and-oversight/", "source_tier": null, "observed_at": null }, { "statement": "Michael Harvey serves as the Information and Privacy Commissioner for British Columbia as of the May 2026 joint ChatGPT investigation announcement.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/opc-news/news-and-announcements/2026/ma_260504/", "source_tier": null, "observed_at": null }, { "statement": "PIPA is BC's private-sector privacy law, and has been deemed 'substantially similar' to the federal PIPEDA, while FIPPA is BC's public-sector privacy law and the E-Health Act governs health records.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/about-the-opc/what-we-do/provincial-and-territorial-collaboration/provincial-and-territorial-privacy-laws-and-oversight/", "source_tier": null, "observed_at": null }, { "statement": "Employee personal information held by provincially-regulated organizations in British Columbia is covered by PIPA, unlike PIPEDA which excludes employee information for non-FWUB organizations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/02_05_d_26/", "source_tier": null, "observed_at": null }, { "statement": "Exemption Order SOR/2004-220, issued under PIPEDA, exempts organizations from Part 1 of PIPEDA for collection, use, or disclosure of personal information occurring within British Columbia, making PIPA the operative statute for BC-internal activity even for organizations without physical presence in Canada.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OPC Canada / OIPC BC / OIPC AB / CAI", "source_url": "https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-002/", "source_tier": null, "observed_at": null }, { "statement": "The OIPC-BC and the BC Court of Appeal have confirmed that PIPA's jurisdiction extends to foreign organizations with a real and substantial connection to British Columbia, notwithstanding lack of establishment or employees in Canada prior to product launch.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OPC Canada / OIPC BC / OIPC AB / CAI", "source_url": "https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-002/", "source_tier": null, "observed_at": null } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "amber", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/canada-british-columbia/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "Core consent architecture is robust and enforced, but the absence of a codified sensitive-data category and of anonymisation safe-harbours leaves gaps relative to GDPR-style regimes.", "claims": [ { "statement": "Sections 6-8 of PIPA-BC require the consent of individuals for the collection, use or disclosure of their personal information, unless an exception applies.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OPC Canada / OIPC BC / OIPC AB / CAI", "source_url": "https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-002/", "source_tier": null, "observed_at": null }, { "statement": "An organization may collect, use or disclose personal information under PIPA only for a purpose that a reasonable person would consider appropriate in the circumstances, per sections 11 and 14.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OPC Canada / OIPC BC / OIPC AB / CAI", "source_url": "https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2025/pipeda-2025-003/", "source_tier": null, "observed_at": null }, { "statement": "Joint guidelines issued by OPC, OIPC-AB and OIPC-BC provide that organizations must generally obtain express consent when information is sensitive, collection/use/disclosure is outside reasonable expectations, or creates a meaningful residual risk of significant harm.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "OPC Canada / OIPC BC / OIPC AB / CAI", "source_url": "https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-002/", "source_tier": null, "observed_at": null }, { "statement": "Joint regulatory investigations (Clearview AI, Cadillac Fairview) found biometric information to be sensitive in almost all circumstances, being intrinsically and often permanently linked to an individual, distinctive and difficult to change.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "OPC Canada / OIPC AB / OIPC BC", "source_url": "https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2020/pipeda-2020-004/", "source_tier": null, "observed_at": null } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "amber", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/canada-british-columbia/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Core access/correction rights are in force and enforced, but PIPA lacks GDPR-equivalent erasure, restriction/objection, and portability rights, which remain at the recommendation stage only.", "claims": [ { "statement": "Individuals have a right to know the details of unauthorized access of their personal information and, more broadly, a right to access personal information held about them by an organization subject to statutory exceptions.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/02_05_d_26/", "source_tier": null, "observed_at": null }, { "statement": "The OIPC BC's PIPA-reform recommendations included a 'Right to be Forgotten' proposal on which the federal OPC stated it would go further than the BC recommendation.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/bc_20210622/comp_bc_20210622/", "source_tier": null, "observed_at": null }, { "statement": "Automated decision-making transparency was among the 12 recommendations made by the OIPC BC for PIPA reform, indicating it is not currently a codified right under PIPA.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/bc_20210622/comp_bc_20210622/", "source_tier": null, "observed_at": null }, { "statement": "Data portability was among the 12 recommendations made by the OIPC BC for PIPA reform, confirming it is not a currently codified statutory right.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/bc_20210622/comp_bc_20210622/", "source_tier": null, "observed_at": null } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "amber", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/canada-british-columbia/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "Accountability and security-safeguard obligations are in force, but the absence of mandatory breach notification and of explicit processor/service-provider accountability are material, long-flagged gaps relative to peer Canadian regimes and GDPR.", "claims": [ { "statement": "An organization is responsible for personal information under its control and shall designate an individual or individuals accountable for the organization's compliance with core privacy principles.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/02_05_d_26/", "source_tier": null, "observed_at": null }, { "statement": "PIPA currently does not expressly hold organizations responsible for the personal information they transfer to a service provider, and the OIPC has recommended amending PIPA to require contractual or other means ensuring compliance or comparable protection.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "OIPC BC", "source_url": "https://www.oipc.bc.ca/", "source_tier": null, "observed_at": null }, { "statement": "PIPA requires organizations to protect personal information in their custody or under their control through reasonable security arrangements against risks such as unauthorized access, collection, use, or disclosure.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/02_05_d_26/", "source_tier": null, "observed_at": null }, { "statement": "The BC OIPC has recommended that PIPA be amended to require organizations to notify affected individuals and the Commissioner of any loss of, unauthorized access to, or disclosure of personal information where it is reasonable to believe there is a real risk of significant harm — confirming this is not yet a binding statutory requirement.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/bc_20210622/is_bc_20210622/", "source_tier": null, "observed_at": null }, { "statement": "Quebec's mandatory breach reporting to its data protection authority and to individuals is described as bringing that province's regime into alignment with 'the existing regime everywhere else in Canada, except British Columbia', confirming BC PIPA lacks a mandatory breach-notification obligation.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/2023-canada-private-sector-privacy-law-reform-keeping-track-of-moving-parts", "source_tier": null, "observed_at": null }, { "statement": "In April 2026, the OIPC BC published a quick-reference guide for small and medium-sized businesses on responding to privacy breaches, explaining that a privacy breach occurs when personal information is mishandled in violation of PIPA and describing OIPC's monitoring and recommendation role, without imposing a new mandatory notification duty.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/british-columbia-oipc-publishes-privacy-breach-guide", "source_tier": null, "observed_at": null }, { "statement": "Organizations are expected to limit collection to what is necessary and retain personal information only as long as necessary to fulfil identified purposes under BC and Alberta's private-sector privacy laws.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/02_05_d_26/", "source_tier": null, "observed_at": null } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "amber", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/canada-british-columbia/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "Private-sector transfer mechanics are well-settled via the PIPEDA/PIPA interlock, but the 2021 removal of BC's public-sector data-residency mandate in favour of yet-unspecified regulations creates ongoing uncertainty flagged by the regulator itself.", "claims": [ { "statement": "Trans-border personal information flows in a commercial context are covered by PIPEDA due to the federal government's constitutional power over inter-provincial and international trade and commerce, even for organizations otherwise subject to PIPA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/02_05_d_26/", "source_tier": null, "observed_at": null }, { "statement": "PIPA has been declared substantially similar to PIPEDA, the mechanism by which BC's private-sector regime is recognized as equivalent within Canada's federal-provincial privacy architecture.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/02_05_d_26/", "source_tier": null, "observed_at": null }, { "statement": "Section 30.1 of the BC Freedom of Information and Protection of Privacy Act formerly required public bodies to ensure personal information in their custody or control was stored only in Canada and accessed only in Canada.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/canadian-data-residency-requirements-a-few-more-thoughts-on-a-tricky-subject", "source_tier": null, "observed_at": null }, { "statement": "The Freedom of Information and Protection of Privacy Amendment Act, 2021 (Bill 22) replaced the prohibition on disclosure of personal information outside Canada with a provision allowing such disclosure in accordance with regulations, in practical terms removing the data-residency requirement.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/2023-canada-private-sector-privacy-law-reform-keeping-track-of-moving-parts", "source_tier": null, "observed_at": null }, { "statement": "The OIPC BC wrote to the responsible Minister expressing concern that Bill 22's data-residency changes would be filled in only through regulations whose substance was unknown at the time of the bill's introduction.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/british-columbia-oipc-issues-statement-bill-proposed", "source_tier": null, "observed_at": null } ] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "amber", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/canada-british-columbia/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Health and employment overlays are well-documented and in force; several other sectoral sub-modules show no BC-specific overlay, which is itself a legitimate finding rather than a research gap.", "claims": [ { "statement": "The Information and Privacy Commissioner for British Columbia oversees the E-Health (Personal Health Information Access and Protection of Privacy) Act, BC's privacy law relating to health records.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/about-the-opc/what-we-do/provincial-and-territorial-collaboration/provincial-and-territorial-privacy-laws-and-oversight/", "source_tier": null, "observed_at": null } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "red", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/canada-british-columbia/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "No BC-specific adtech statute exists; coverage relies entirely on PIPA's general consent/purpose principles, which is a materially thinner regime than jurisdictions with dedicated adtech rules (e.g., US-CA CPRA).", "claims": [] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "amber", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/canada-british-columbia/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "Strong, recent case-law-driven biometric protection exists via joint enforcement, but statutory ADM-transparency, genetic-data, and AI-risk-assessment provisions remain absent or only proposed.", "claims": [ { "statement": "In 2026, the OPC, CAI, OIPC-BC, and OIPC-AB jointly released findings on OpenAI's ChatGPT, examining compliance with PIPEDA, Quebec's Private Sector Act, PIPA-BC and PIPA-AB rather than any dedicated AI-specific statute.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OPC Canada / OIPC BC / OIPC AB / CAI", "source_url": "https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-002/", "source_tier": null, "observed_at": null }, { "statement": "A joint investigation found that Clearview AI's collection of images and creation of biometric facial-recognition arrays required assessment against PIPA-BC's and PIPA-AB's reasonable-purpose and consent requirements.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OPC Canada / OIPC BC / OIPC AB / CAI", "source_url": "https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2021/pipeda-2021-001/", "source_tier": null, "observed_at": null }, { "statement": "The OIPC, FIPA and OpenMedia.ca called for the PIPA Special Committee to review PIPA's provisions permitting organizations to voluntarily provide information to law enforcement, with FIPA recommending that law enforcement be required to provide evidence of lawful authority to compel production.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/the-undercurrents-of-bcs-potential-pipa-reform", "source_tier": null, "observed_at": null } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "amber", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/canada-british-columbia/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "No codified statutory age-of-consent or parental-consent regime exists, but active, recent joint enforcement (TikTok 2025) demonstrates the regulator applying general consent principles rigorously to protect minors.", "claims": [ { "statement": "In the 2025 joint TikTok investigation, the Offices found that TikTok's collection and use of personal information from underage users (many aged 13-17) was inappropriate, unreasonable and illegitimate, contravening sections 11 and 14 of PIPA BC among other provisions, given the platform's sophisticated age-estimation analytics used for other business purposes.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OPC Canada / OIPC BC / OIPC AB / CAI", "source_url": "https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2025/pipeda-2025-003/", "source_tier": null, "observed_at": null }, { "statement": "Commissioner Dufresne and privacy authorities from across Canada, including BC's counterpart, issued a joint resolution on protecting the privacy of children and youth in the classroom through responsible educational technologies.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/opc-actions-and-decisions/ar_index/202526/ar_202526/", "source_tier": null, "observed_at": null } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "amber", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/canada-british-columbia/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Order-making powers are real and recently exercised via major joint AI/platform investigations, but the absence of AMPs constrains the deterrent strength of BC's enforcement regime relative to Quebec, the federal CPPA proposal, and GDPR-style regimes.", "claims": [ { "statement": "The OIPC currently has order-making powers under section 52 of PIPA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/bc_20210622/is_bc_20210622/", "source_tier": null, "observed_at": null }, { "statement": "The OIPC has argued its order-making power is 'inadequate' because it lacks the ability to issue financial penalties, and has recommended PIPA be amended to enable the Commissioner to impose administrative monetary penalties, noting its existing experience administering AMPs under BC's Lobbyists Transparency Act.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "OPC Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/bc_20210622/is_bc_20210622/", "source_tier": null, "observed_at": null } ] } ] }