Not publishable as-is. 1 of 6 publication_gate checks fail. The renderer displays the gate rather than suppressing it. Legal review and sub-brief approval are informational and are not part of this test.
CA-TFN Data Protection & Privacy Regulation
CA-TFNschema gdpri-v2trajectory: not yet assessedhybrid regimeoverlaps: artificial-intelligence
Last updated · 10 categories · 5
claims · 42 sources in the cumulative register
Summary answer not yet published for this jurisdiction
Data collected · Data published
AI-assembled from cited sources
Not covered: Regulator & Framework, Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups, Enforcement & Redress.
Evidence re-verified:·Position last changed:·Record history & provenance ▾
Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.
Traffic-light mix(sums to 10 rendered categories; click to filter)
No red categories; 25 sub-modules are flagged red.
Canada federal law that applies in CA-TFN is covered once, on the Canada page. This page covers CA-TFN’s own layer: its own law, regulators and enforcement.
Jurisdiction brief
CA-TFN operates under a hybrid regime supervised by Office of the Privacy Commissioner of Canada (OPC), with 9 regulatory modules assessed in the current cycle.
D1 · Regulator & Framework: A functioning federal regulator and statute exist and have been applied directly to a First Nation band council, but PIPEDA's material scope is activity-limited (commercial/FWUB) rather than universal, and no registration/filing regime or Indigenous-specific instrument exists.
D2 · Lawful Processing: Core consent and sensitivity doctrines are well-developed and actively enforced, but there is no statutory anonymisation/pseudonymisation safe harbour and no enumerated special-category list.
D3 · Data Subject Rights: Access and timeliness rights are robust and enforced, but erasure and portability rights that are now baseline in comparator regimes remain absent.
D4 · Controller & Processor: Breach-notification and accountability duties are clearly specified, in force, and actively enforced through multiple OPC findings (Brinks, MGM).
All 9 module posture summaries
D1 · Regulator & Framework: A functioning federal regulator and statute exist and have been applied directly to a First Nation band council, but PIPEDA's material scope is activity-limited (commercial/FWUB) rather than universal, and no registration/filing regime or Indigenous-specific instrument exists.
D2 · Lawful Processing: Core consent and sensitivity doctrines are well-developed and actively enforced, but there is no statutory anonymisation/pseudonymisation safe harbour and no enumerated special-category list.
D3 · Data Subject Rights: Access and timeliness rights are robust and enforced, but erasure and portability rights that are now baseline in comparator regimes remain absent.
D4 · Controller & Processor: Breach-notification and accountability duties are clearly specified, in force, and actively enforced through multiple OPC findings (Brinks, MGM).
D5 · Cross-Border & Adequacy: Adequacy from both the EU and UK is current and was substantively reconfirmed in 2024, though materially scoped to PIPEDA-covered commercial data only.
D6 · Sectoral Watch: The core JID-defining jurisdictional finding (band council as FWUB) is well evidenced, but health-sector and financial-sector sectoral overlays for this specific community remain unconfirmed gaps.
D8 · AI, Biometrics & Automated: Vigorous ad hoc enforcement exists against biometric surveillance misuse via general consent/purpose principles, but no codified ADM-transparency right or AI-specific statute is currently in force.
D9 · Children's Privacy: Strong, actively-enforced interpretive protections for minors exist, but they rest on non-binding OPC guidance rather than statute, and a prospective enforceable children's code remains at the consultation stage.
D10 · Enforcement & Redress: Active, well-documented enforcement continues via the ombudsman/Federal-Court model, but the absence of order-making power and AMPs under current law is a structural weakness flagged repeatedly by the regulator itself, pending stalled legislative reform.
Key regulatory facts for CA-TFN
Regulatory Dimension
CA-TFN Standing Position
Jurisdiction
CA-TFN (CA-TFN)
Regulatory Scope
Data Protection & Privacy Regulation (10 modules, 5 sourced findings)
Regulator & Framework
A functioning federal regulator and statute exist and have been applied directly to a First Nation band council, but PIPEDA's material scope is activity-limited (commercial/FWUB) rather than universal, and no...
Lawful Processing & Special Data
Core consent and sensitivity doctrines are well-developed and actively enforced, but there is no statutory anonymisation/pseudonymisation safe harbour and no enumerated special-category list.
Data Subject Rights
Access and timeliness rights are robust and enforced, but erasure and portability rights that are now baseline in comparator regimes remain absent.
Controller/Processor Duties
Breach-notification and accountability duties are clearly specified, in force, and actively enforced through multiple OPC findings (Brinks, MGM).
A functioning federal regulator and statute exist and have been applied directly to a First Nation band council, but PIPEDA's material scope is activity-limited (commercial/FWUB) rather than universal, and no registration/filing regime or Indigenous-specific instrument exists.
Primary frameworkPersonal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c.5
Traffic-light rationale — AmberA functioning federal regulator and statute exist and have been applied directly to a First Nation band council, but PIPEDA's material scope is activity-limited (commercial/FWUB) rather than universal, and no registration/filing regime or Indigenous-specific instrument exists.
Sub-modules (5)
Regulator And AuthorityGreen
OPC is an independent Agent of Parliament mandated to oversee both PIPEDA (private sector) and the Privacy Act (federal public sector).
Claims (2):
Tobique Gaming Commission — TGC has appointed a data protection officer responsible for its own website privacy policy and acts as controller for data collected through thetgc.ca.
Act And InstrumentsAmber
PIPEDA received Royal Assent in 2000; Part 1 is the operative private-sector instrument; no successor statute has yet replaced it.
Claims indexed in baseline register · source extraction in progress
Material ScopeAmber
PIPEDA covers commercial-activity personal information nationally and FWUB employee data, including, per OPC case practice, band-council employees acting in core governmental functions.
Claims (3):
Office of the Privacy Commissioner of Canada / Tobique First Nation — PIPEDA plausibly applies to private-sector commercial activity but its application to Tobique First Nation government bodies and the Tobique Gaming Commission as a First Nation regulatory body is unresolved; First Nations data-sovereignty principles (OCAP) assert First Nations data is governed by First Nations laws
Territorial ScopeGreen
PIPEDA applies wherever there is a real and substantial connection to Canada and applies fully within New Brunswick because NB has no 'substantially similar' provincial law (unlike AB/BC/QC).
Claims indexed in baseline register · source extraction in progress
Regulator Registration And FilingRed
No general registration, notification or fee duty on controllers was identified under PIPEDA.
Category narrative131 words
Tobique First Nation (a reserve community in New Brunswick) is not subject to a dedicated Indigenous or provincial private-sector data-protection statute. The operative regime is the federal Personal Information Protection and Electronic Documents Act (PIPEDA), enforced by the Office of the Privacy Commissioner of Canada (OPC), which applies to commercial activity across Canada and to employee data of 'federal works, undertakings or businesses' (FWUBs). New Brunswick has not enacted a provincial private-sector law deemed 'substantially similar' to PIPEDA (unlike Alberta, BC and Quebec), so PIPEDA applies in full within NB. OPC practice treats a First Nation band council acting in its core governmental functions as a FWUB, bringing band-council employee personal information within PIPEDA's and the OPC's jurisdiction — a finding of direct relevance to Tobique First Nation's own governance body.
Sources and claims (2)
ConfirmedTobique Gaming Commission — Tobique Gaming Commission — TGC has appointed a data protection officer responsible for its own website privacy policy and acts as controller for data collected through thetgc.ca.observed
Uncertainhttps://fnigc.ca/wp-content/uploads/2024/08/FNIGC_FN_Guide_Privacy_Act_EN-1.pdf — Office of the Privacy Commissioner of Canada / Tobique First Nation — PIPEDA plausibly applies to private-sector commercial activity but its application to Tobique First Nation government bodies and the Tobique Gaming Commission as a First Nation regulatory body is unresolved; First Nations data-sovereignty principles (OCAP) assert First Nations data is governed by First Nations laws
Core consent and sensitivity doctrines are well-developed and actively enforced, but there is no statutory anonymisation/pseudonymisation safe harbour and no enumerated special-category list.
Traffic-light rationale — AmberCore consent and sensitivity doctrines are well-developed and actively enforced, but there is no statutory anonymisation/pseudonymisation safe harbour and no enumerated special-category list.
D2 · Lawful Processing — Full Module Record4 sub-modules · 88 words · 1 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Traffic-light rationale — AmberAccess and timeliness rights are robust and enforced, but erasure and portability rights that are now baseline in comparator regimes remain absent.
Sub-modules (5)
Access RightGreen
Individuals have the right to be informed of, and to access, their personal information held by an organization.
Claims indexed in baseline register · source extraction in progress
Deadlines And Response WindowsGreen
30-day response deadline, one 30-day extension (with written notice and complaint-rights advisory), deemed refusal on silence; actively enforced (e.g., Bell 2026 contravention).
Claims indexed in baseline register · source extraction in progress
Rectification And ErasureRed
Right to challenge accuracy exists; no standalone erasure right exists under PIPEDA, and the CPPA's proposed right to be forgotten died with Bill C-27.
Claims indexed in baseline register · source extraction in progress
Data PortabilityRed
PIPEDA has no direct equivalent of GDPR Art 20 data portability.
Claims indexed in baseline register · source extraction in progress
Restriction And ObjectionRed
No explicit standalone restriction/objection right distinct from consent withdrawal was confirmed in sources reviewed this cycle.
Category narrative63 words
Individuals have a right of access and to challenge accuracy (Principle 4.9), with a strict 30-day statutory response deadline (s.8(3)), a single 30-day extension option with mandatory notice (s.8(4)), and a deemed-refusal consequence for silence (s.8(5)) — actively enforced (e.g., 2026 Bell Canada finding). PIPEDA has no standalone erasure/'right to be forgotten' or data-portability right; the defunct Bill C-27/CPPA would have added both.
Traffic-light rationale — GreenBreach-notification and accountability duties are clearly specified, in force, and actively enforced through multiple OPC findings (Brinks, MGM).
D4 · Controller & Processor — Full Module Record7 sub-modules · 95 words · 7 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Adequacy from both the EU and UK is current and was substantively reconfirmed in 2024, though materially scoped to PIPEDA-covered commercial data only.
Primary frameworkPIPEDA (transborder transfer accountability); EU Commission Canada adequacy decision (2001, reconfirmed 2024); UK Canada adequacy regulations
Traffic-light rationale — GreenAdequacy from both the EU and UK is current and was substantively reconfirmed in 2024, though materially scoped to PIPEDA-covered commercial data only.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 80 words · 6 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
The core JID-defining jurisdictional finding (band council as FWUB) is well evidenced, but health-sector and financial-sector sectoral overlays for this specific community remain unconfirmed gaps.
Primary frameworkPIPEDA (FWUB doctrine); OCAP® Principles (non-statutory); First Nations Data Governance Strategy (2020, non-statutory)
Traffic-light rationale — AmberThe core JID-defining jurisdictional finding (band council as FWUB) is well evidenced, but health-sector and financial-sector sectoral overlays for this specific community remain unconfirmed gaps.
D6 · Sectoral Watch — Full Module Record8 sub-modules · 112 words · 8 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
This is the weakest-covered module: no dedicated cookie, dark-pattern, opt-out-signal, or clean-room regime exists under the operative PIPEDA framework.
Traffic-light rationale — Not assessedThis is the weakest-covered module: no dedicated cookie, dark-pattern, opt-out-signal, or clean-room regime exists under the operative PIPEDA framework.
Sub-modules (6)
Cookies And TrackersRed
No dedicated statutory cookie-consent provision; OPC applies general meaningful-consent doctrine and recommends avoiding tracking of children.
Claims indexed in baseline register · source extraction in progress
Dark PatternsRed
No binding dark-pattern prohibition under PIPEDA was found; OPC has funded academic research into dark patterns but this is not a regulatory instrument.
Claims indexed in baseline register · source extraction in progress
Opt Out SignalsRed
No PIPEDA-specific recognition of browser-level opt-out signals (e.g., Global Privacy Control) was located.
Clean Rooms And DcrRed
No data clean-room-specific regime was located under PIPEDA.
Cross Context AdvertisingRed
No CPRA-style 'sale'/'share' cross-context advertising regime was located under PIPEDA.
Direct MarketingAmber
Electronic direct marketing consent (opt-in, soft opt-in for existing business relationships) is governed by CASL, administered by the CRTC/Competition Bureau separately from OPC/PIPEDA enforcement.
Claims indexed in baseline register · source extraction in progress
Category narrative81 words
PIPEDA has no dedicated cookie-consent or ePrivacy-style tracker regime; the OPC instead applies its general meaningful-consent framework to online behavioural advertising, acknowledging that valid consent from children is difficult to obtain and recommending organizations avoid tracking on child-directed sites. Electronic direct marketing is governed by a separate statute, Canada's Anti-Spam Legislation (CASL), enforced by the CRTC/Competition Bureau rather than the OPC. No dedicated dark-pattern prohibition, opt-out-signal (e.g., GPC) regime, clean-room framework, or cross-context-advertising rule analogous to CPRA was identified under PIPEDA.
Vigorous ad hoc enforcement exists against biometric surveillance misuse via general consent/purpose principles, but no codified ADM-transparency right or AI-specific statute is currently in force.
Primary frameworkPIPEDA (general consent/purpose principles only — no AI-specific statute in force); defunct Artificial Intelligence and Data Act (AIDA, Bill C-27)
Traffic-light rationale — AmberVigorous ad hoc enforcement exists against biometric surveillance misuse via general consent/purpose principles, but no codified ADM-transparency right or AI-specific statute is currently in force.
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Strong, actively-enforced interpretive protections for minors exist, but they rest on non-binding OPC guidance rather than statute, and a prospective enforceable children's code remains at the consultation stage.
Traffic-light rationale — AmberStrong, actively-enforced interpretive protections for minors exist, but they rest on non-binding OPC guidance rather than statute, and a prospective enforceable children's code remains at the consultation stage.
D9 · Children's Privacy — Full Module Record5 sub-modules · 112 words · 1 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Active, well-documented enforcement continues via the ombudsman/Federal-Court model, but the absence of order-making power and AMPs under current law is a structural weakness flagged repeatedly by the regulator itself, pending stalled legislative reform.
Traffic-light rationale — AmberActive, well-documented enforcement continues via the ombudsman/Federal-Court model, but the absence of order-making power and AMPs under current law is a structural weakness flagged repeatedly by the regulator itself, pending stalled legislative reform.
D10 · Enforcement & Redress — Full Module Record6 sub-modules · 155 words · 6 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Filters combine as OR inside a group and AND across
groups.
Provenance and declared absence
Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.
Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.
Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.
Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.
Suppressed by doctrine: derived risk score. Not shown on this page.
Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.
Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 5 claim(s) (5 category placement(s)), 42 source(s) in the cumulative register.
Audit trail
Machine checkChallenged on 3 Nov 2026: upheld (4 confirmed against the cited source). An automated, adversarial test run by a second model; no person has assessed the result.
CA-TFN