Ontario, Canada Data Protection & Privacy Regulation

Because Ontario has no general private-sector data-protection statute of its own, each of these matters falls to the federal regime: the Information and Privacy Commissioner of Ontario's mandate is confined to the public sector under the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act, and to the health sector under the Personal Health Information Protection Act, while general commercial activity in the province is governed directly by PIPEDA under OPC supervision. The enforcement cadence described above is therefore the operative accountability mechanism for Ontario-based commercial entities, notwithstanding that none of the three matters originates with the provincial regulator.

Other Developments

Third-party service-provider guidance. The OPC published guidance, dated September 10, 2026 and reported October 29, 2026, on assessing third-party service providers. The guidance is understood to state that engaging a service provider does not relieve a PIPEDA-covered organization of responsibility for personal information handled on its behalf, and it sets out due-diligence, contractual, and ongoing-monitoring expectations for organizations operating in Ontario and elsewhere.

Call-recording guidance. On October 8, 2026, the OPC published updated guidance on the recording of customer telephone calls, addressing consent, caller choice, and the handling of recordings under PIPEDA. The guidance is reported to state that for organizations not subject to PIPEDA, the guidelines operate as best practices only rather than as binding rules.

AI-transparency consultation. The OPC published its comments to a government consultation on AI transparency on October 23, 2026, applicable to PIPEDA-covered organizations including those operating in Ontario. This remains consultation-stage activity; no new binding rule has resulted from it this period.

Children's Privacy Code. The federal Privacy Commissioner launched a Children's Privacy Code on October 20, 2026, described as intended to support strong online protections for youth, applicable to PIPEDA-covered organizations operating in the province. Whether the Code constitutes binding guidance or a voluntary instrument has not yet been confirmed.

Cross-Monitor Connections

The Navigate360/Crime Stoppers investigation, with its parallel consumer litigation alleging delayed breach notification, is a matter a financial-integrity-focused monitor would track only insofar as any financial-sector data is implicated; no such nexus is indicated in the current reporting. The AI-transparency consultation comments touch territory that an artificial-intelligence-focused monitor would track directly with respect to automated-decision-making transparency obligations; this brief does not re-analyse that ground here.

Outlook

The open question for the Navigate360 matter is whether the OPC's investigation, opened October 27, 2026, will proceed in parallel with or independently of the consumer class proceeding alleging delayed notification; as scheduled, no resolution has yet been reported. Whether the Children's Privacy Code acquires binding force, and whether the AI-transparency consultation produces a rule rather than guidance, remain open as at this writing, with Ontario's commercial sector continuing to be governed entirely through the federal PIPEDA/OPC channel regardless of outcome.

Standing brief · as of 11 October 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

Ontario's private-sector data protection landscape is currently defined less by settled law than by overlapping and potentially conflicting federal reform tracks. Federal PIPEDA continues to govern general private-sector commercial activity directly in Ontario, since there is no substantially-similar provincial private-sector law; the Information and Privacy Commissioner of Ontario's mandate under FIPPA/MFIPPA and PHIPA covers only the public sector and the health sector respectively, leaving PIPEDA as the operative general commercial-privacy statute. Against that backdrop, Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled on 15 June 2026 and would repeal Part 1 of PIPEDA entirely, replacing the Office of the Privacy Commissioner with a new Digital Safety and Data Protection Commission of Canada; as at its Charter Statement of 28 August 2026, the bill remained before Parliament without Royal Assent. Running alongside this is Bill C-15's PIPEDA Division 1.2, the federal data-mobility provision, which received Royal Assent on 26 March 2026 but is not yet in force and has no implementing regulations published. Bill C-36 contains coordinating amendments that would repeal this data-mobility Division if C-36 commences first, meaning organisations planning around a federal data-portability right currently face two mutually exclusive commencement paths with no clarity on which will prevail.

Other Developments

Sectoral financial-data regulation is also advancing on a parallel track. Draft Consumer-Driven Banking Regulations, published 27 June 2026 under the Consumer-Driven Banking Act component of Bill C-15, would set accreditation, security, consent and liability rules for bank-held financial-data sharing, with the Bank of Canada as supervisor; the sixty-day comment period on the draft closed on 26 August 2026, and the regulations are not yet final. Enforcement activity under the health-sector regime continued independently of the federal reform uncertainty: the Information and Privacy Commissioner of Ontario issued its third administrative monetary penalty under the Personal Health Information Protection Act, PHIPA Decision 341, on 26 August 2026, involving a clinical information clerk at Lake of the Woods District Hospital. This sits under the IPC's authority, amended into PHIPA section 61.1 and Ontario Regulation 329/04, to impose administrative monetary penalties on health information custodians up to a maximum of CAD 50,000. The cadence of this being the IPC's third such penalty signals an active, continuing enforcement program under the health-sector statute distinct from the stalled general private-sector reform.

Cross-Monitor Connections

The Consumer-Driven Banking Regulations development connects directly to world-payments' tracking of the same open-banking regime, since the draft regulations' accreditation, security and consent rules for financial-data sharing are the data-protection-facing counterpart to the payment-access and market-structure questions world-payments monitors under its own licensing and market-access module. The uncertainty over Bill C-36 and Bill C-15's data-mobility Division also has a bearing on financial-integrity's interest in Canada's broader regulatory-architecture trajectory, insofar as the identity of Canada's eventual privacy regulator, whether the continuing Office of the Privacy Commissioner or the proposed Digital Safety and Data Protection Commission, affects the institutional landscape relevant to cross-border data-sharing cooperation.

Outlook

The most consequential open question for Ontario data protection is which of the two federal reform paths commences first: full PIPEDA replacement under Bill C-36 or the narrower data-mobility right under Bill C-15's already-enacted Division 1.2. Until Parliament resolves this sequencing, which remained unresolved as at Bill C-36's 28 August 2026 Charter Statement, organisations cannot reliably plan around a stable federal data-portability obligation. On the sectoral side, the Consumer-Driven Banking Regulations consultation having closed on 26 August 2026 means a finalised rule could follow in the coming months, and the IPC's continuing PHIPA enforcement cadence suggests health information custodians should expect further administrative monetary penalty activity under the existing CAD 50,000 ceiling.