Not publishable as-is. 1 of 6 publication_gate checks fail. The renderer displays the gate rather than suppressing it. Legal review and sub-brief approval are informational and are not part of this test.
CA-KAH
CA-KAHschema gdpri-v2trajectory: not yet assessedhybrid regimeoverlaps: FIM, WPM, AIC
Summary answer not yet published for this jurisdiction
Data collected · Data published
AI-assembled from cited sources
Coverage record not yet available for this jurisdiction
10 categories · 46
claims · 28 sources in the cumulative register
10Categoriesbaseline.[]
58Sub-modulesbaseline..sub_modules{}
46Claimsbaseline..claims[]
0Tier-1 sourcesrun_metadata.t1_source_count
Traffic-light mix(sums to 10 rendered categories; click to filter)
Canada federal law that applies in CA-KAH is covered once, on the Canada page. This page covers CA-KAH’s own layer: its own law, regulators and enforcement.
Jurisdiction brief
No content recorded at this JID path.
10 of 10 categories
Signal
Density
Selections OR within a group, AND across groups. Press / to search.
A federal backstop (PIPEDA) is clearly in force and well-documented at T1, but the Quebec-overlay question and the KGC's own confidentiality rules for its gaming licensees could not be verified at T1/T2 in this pass, producing real coverage gaps.
Primary frameworkPersonal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c.5
Traffic-light rationale — AmberA federal backstop (PIPEDA) is clearly in force and well-documented at T1, but the Quebec-overlay question and the KGC's own confidentiality rules for its gaming licensees could not be verified at T1/T2 in this pass, producing real coverage gaps.
Sub-modules (5)
Regulator And AuthorityAmber
OPC enforces PIPEDA federally; the Kahnawake Gaming Commission is a sectoral licensing authority for the territory's online-gambling industry, not a general-purpose DP regulator.
Claims (2):
The Office of the Privacy Commissioner of Canada administers and investigates complaints under PIPEDA but operates largely as an ombudsman, lacking a general order-making power equivalent to a GDPR-style DPA.
The Kahnawake Gaming Commission, established by the Mohawk Council of Kahnawake, licenses and regulates online-gambling operators domiciled in the territory and imposes confidentiality/data-security conditions on licensees as a matter of licensing practice; the pinpoint provision of its enabling gaming law could not be verified against a live source in this research pass.
Act And InstrumentsAmber
PIPEDA is the operative federal instrument; Quebec's amended Private Sector Act is the provincial 'substantially similar' instrument whose application on reserve land is unresolved; the federal CPPA/AIDA reform package (Bill C-27) died on the order paper.
Claims (3):
PIPEDA (S.C. 2000, c.5), the federal private-sector privacy law, sets ground rules for how private-sector organizations handle personal information in the course of commercial activity across Canada.
Quebec's Act Respecting the Protection of Personal Information in the Private Sector (CQLR c P-39.1), as amended by the 2021 'Law 25'/Bill 64, has been recognized as substantially similar to PIPEDA and displaces PIPEDA for commercial activity carried on in Quebec; whether this provincial statute binds private enterprises operating on Kahnawake reserve land (federal jurisdiction under s.91(24)) is an open question not resolved in any source reviewed.
Bill C-27 (Digital Charter Implementation Act, 2022), which would have replaced PIPEDA with the Consumer Privacy Protection Act and enacted the Artificial Intelligence and Data Act, died on the order paper when Parliament was prorogued in January 2025 and has not been re-enacted in that form.
Material ScopeGreen
PIPEDA covers personal information collected, used or disclosed in the course of commercial activity, plus employee data of federally-regulated businesses.
Claims (1):
PIPEDA applies to the collection, use and disclosure of personal information by private-sector organizations in the course of commercial activity, and also to the employee personal information of federally-regulated businesses such as banks, airlines and telecommunications companies.
Territorial ScopeGreen
PIPEDA is not intended to apply extraterritorially but does reach foreign entities that receive or transmit communications to/from Canada and collect or disclose personal information about individuals in Canada.
Claims (1):
PIPEDA was not intended to apply extraterritorially, but the Federal Court has held it can still cover foreign entities that receive or transmit communications to and from Canada and that collect and disclose personal information about individuals in Canada.
Regulator Registration And FilingAmber
Neither PIPEDA nor Quebec's Private Sector Act impose a GDPR-style general registration/notification-of-processing duty; Quebec's amended Act does require notice to the CAI on creation of a biometric database.
Claims (1):
Quebec's amended Private Sector Act requires notification to the Commission d'acces a l'information (CAI) upon the creation of a biometric database, a duty phased in alongside Law 25's other obligations from 2022.
Category narrative185 words
CA-KAH (Kahnawake Mohawk Territory) presents an unusual compound regulatory picture: there is no single comprehensive 'Kahnawake privacy statute.' The federal Personal Information Protection and Electronic Documents Act (PIPEDA) is the national private-sector backstop, overseen by the Office of the Privacy Commissioner of Canada (OPC). Geographically, Kahnawake sits within Quebec, whose amended Act Respecting the Protection of Personal Information in the Private Sector ('Law 25'/Bill 64) has been deemed substantially similar to PIPEDA for organizations carrying on enterprise in Quebec -- but Kahnawake is federal reserve land under s.91(24) of the Constitution Act, 1867, and whether a provincial privacy statute binds enterprises operating on reserve land is a genuinely unresolved constitutional question not settled in the material reviewed. Layered on top is the Kahnawake Gaming Commission (KGC), the Mohawk Council of Kahnawake's sectoral licensing body for the territory's large online-gambling licensee base, which imposes confidentiality/security conditions on licensees as a matter of licensing practice rather than through a published general-application data-protection code. No seed anchors were injected for this JID, so KGC primary-instrument text could not be verified against a live, allow-listed source in this pass.
Sources and claims (8)
ConfirmedIAPP — The Office of the Privacy Commissioner of Canada administers and investigates complaints under PIPEDA but operates largely as an ombudsman, lacking a general order-making power equivalent to a GDPR-style DPA.observed
UncertainMohawk Council of Kahnawake — The Kahnawake Gaming Commission, established by the Mohawk Council of Kahnawake, licenses and regulates online-gambling operators domiciled in the territory and imposes confidentiality/data-security conditions on licensees as a matter of licensing practice; the pinpoint provision of its enabling gaming law could not be verified against a live source in this research pass.observed
ConfirmedOPC — PIPEDA (S.C. 2000, c.5), the federal private-sector privacy law, sets ground rules for how private-sector organizations handle personal information in the course of commercial activity across Canada.observed
UncertainDataGuidance/OneTrust — Quebec's Act Respecting the Protection of Personal Information in the Private Sector (CQLR c P-39.1), as amended by the 2021 'Law 25'/Bill 64, has been recognized as substantially similar to PIPEDA and displaces PIPEDA for commercial activity carried on in Quebec; whether this provincial statute binds private enterprises operating on Kahnawake reserve land (federal jurisdiction under s.91(24)) is an open question not resolved in any source reviewed.observed
ConfirmedOPC — Bill C-27 (Digital Charter Implementation Act, 2022), which would have replaced PIPEDA with the Consumer Privacy Protection Act and enacted the Artificial Intelligence and Data Act, died on the order paper when Parliament was prorogued in January 2025 and has not been re-enacted in that form.observed
ConfirmedOPC — PIPEDA applies to the collection, use and disclosure of personal information by private-sector organizations in the course of commercial activity, and also to the employee personal information of federally-regulated businesses such as banks, airlines and telecommunications companies.observed
ConfirmedOPC — PIPEDA was not intended to apply extraterritorially, but the Federal Court has held it can still cover foreign entities that receive or transmit communications to and from Canada and that collect and disclose personal information about individuals in Canada.observed
ProbableDataGuidance/OneTrust — Quebec's amended Private Sector Act requires notification to the Commission d'acces a l'information (CAI) upon the creation of a biometric database, a duty phased in alongside Law 25's other obligations from 2022.observed
Core consent and appropriateness tests are well documented at T1/T3, but there is no binding, codified special-category regime equivalent to GDPR Art.9, which is a structural gap relative to the question set.
Primary frameworkPIPEDA Schedule 1 (CSA Model Code) and Quebec Private Sector Act as amended by Law 25
Traffic-light rationale — AmberCore consent and appropriateness tests are well documented at T1/T3, but there is no binding, codified special-category regime equivalent to GDPR Art.9, which is a structural gap relative to the question set.
Sub-modules (4)
Lawful BasesAmber
PIPEDA s.5(3) imposes an overarching 'reasonable person' appropriateness limit on all processing, not waivable by consent; Quebec's Law 25 separately permits certain consent-free disclosures.
Claims (2):
PIPEDA subsection 5(3) restricts an organization's collection, use and disclosure of personal information to purposes a reasonable person would consider appropriate in the circumstances, an overarching limit that cannot be waived by consent.
Quebec's amended Private Sector Act permits disclosure of personal information without consent in specific circumstances, including for commercial transactions and for study or research purposes, in force since 22 September 2022.
Consent ThresholdsGreen
The 2015 Digital Privacy Act amendments codified a 'valid consent' standard requiring that individuals would reasonably understand the nature, purpose and consequences of the collection, use or disclosure consented to.
Claims (1):
Following the 2015 Digital Privacy Act amendments, PIPEDA consent is valid only if it is reasonable to expect that the individuals to whom an organization's activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure to which they are consenting.
Special CategoriesAmber
No statutory enumerated special-category list exists; OPC guidance treats 'sensitive' personal information (e.g., health, financial) as requiring express rather than implied consent.
Claims (1):
Under PIPEDA, uses of sensitive data require express consent, per the OPC's interpretation, even though PIPEDA contains no codified list of special categories equivalent to GDPR Article 9.
Pseudonymisation And AnonymisationAmber
Canadian courts apply a 'serious possibility of identification' test; OPC's own analysis suggests pseudonymised data likely remains personal information where re-identification risk persists.
Claims (1):
Canadian courts have held that information will be about an identifiable individual where there is a serious possibility that the individual could be identified through use of that information alone or combined with other information, suggesting pseudonymised data remains personal information and subject to PIPEDA.
Category narrative62 words
PIPEDA uses a consent-based model (Schedule 1, Principle 3) overlaid with an overarching 'reasonable person' appropriateness test (s.5(3)) rather than GDPR-style enumerated lawful bases. Quebec's amended Private Sector Act adds consent-free processing windows for commercial transactions and research. Neither instrument has a GDPR Art.9-style enumerated list of special categories, but OPC interpretive guidance treats processing of sensitive information as requiring express consent.
Sources and claims (5)
ConfirmedIAPP — PIPEDA subsection 5(3) restricts an organization's collection, use and disclosure of personal information to purposes a reasonable person would consider appropriate in the circumstances, an overarching limit that cannot be waived by consent.observed
ProbableOPC — Quebec's amended Private Sector Act permits disclosure of personal information without consent in specific circumstances, including for commercial transactions and for study or research purposes, in force since 22 September 2022.observed
ConfirmedOPC — Following the 2015 Digital Privacy Act amendments, PIPEDA consent is valid only if it is reasonable to expect that the individuals to whom an organization's activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure to which they are consenting.observed
ProbableOPC — Under PIPEDA, uses of sensitive data require express consent, per the OPC's interpretation, even though PIPEDA contains no codified list of special categories equivalent to GDPR Article 9.observed
ProbableOPC — Canadian courts have held that information will be about an identifiable individual where there is a serious possibility that the individual could be identified through use of that information alone or combined with other information, suggesting pseudonymised data remains personal information and subject to PIPEDA.observed
Core access/correction rights are documented, but PIPEDA's federal deadline framework and an explicit restriction/objection right are not clearly codified, producing a genuine coverage gap distinct from Quebec's more concrete regime.
Primary frameworkPIPEDA Schedule 1 and Quebec Private Sector Act as amended by Law 25
Traffic-light rationale — AmberCore access/correction rights are documented, but PIPEDA's federal deadline framework and an explicit restriction/objection right are not clearly codified, producing a genuine coverage gap distinct from Quebec's more concrete regime.
Sub-modules (5)
Access RightGreen
PIPEDA Principle 9 (Individual Access) gives people the right to access personal information held about them and challenge its accuracy.
Claims (1):
Under PIPEDA's Schedule 1 fair information principles, people have the right to access their personal information held by an organization and to challenge its accuracy.
Rectification And ErasureAmber
Law 25 introduced a data-portability right and a 'right to be forgotten'-style capability effective in the September 2022 tranche.
Claims (1):
Since Quebec's Law 25 data-privacy requirements entered into force on 22 September 2023, organizations must conduct privacy impact assessments before adopting processing technology and individuals gained an added 'right to be forgotten.'
Restriction And ObjectionRed
No PIPEDA-specific restriction/objection right distinct from consent withdrawal was located in this pass.
Data PortabilityAmber
Quebec's amended Act introduced a data-portability right (Section 3.3 per commentary); the federal equivalent is still only proposed via Bill C-15's data-mobility provisions.
Claims (1):
A federal right to data mobility, allowing individuals to direct disclosure of personal information between organizations subject to a prescribed data-mobility framework, is only proposed (via Bill C-15's new PIPEDA Division 1.2) and not yet in force.
Deadlines And Response WindowsGreen
Quebec's Private Sector Act requires a response to an individual rights request within 30 days.
Claims (1):
Quebec's Private Sector Act (Section 32) requires that an individual rights request be addressed within 30 days.
Category narrative52 words
PIPEDA's Schedule 1 gives individuals rights of access and to challenge accuracy, without a fixed statutory response deadline in the federal Act itself. Quebec's Private Sector Act imposes a concrete 30-day response window and, via Law 25, added a data-portability right and a 'right to be forgotten'-style de-indexing capability from September 2022.
Sources and claims (4)
ConfirmedOPC — Under PIPEDA's Schedule 1 fair information principles, people have the right to access their personal information held by an organization and to challenge its accuracy.observed
ProbableIAPP — Since Quebec's Law 25 data-privacy requirements entered into force on 22 September 2023, organizations must conduct privacy impact assessments before adopting processing technology and individuals gained an added 'right to be forgotten.'observed
ConfirmedOPC — A federal right to data mobility, allowing individuals to direct disclosure of personal information between organizations subject to a prescribed data-mobility framework, is only proposed (via Bill C-15's new PIPEDA Division 1.2) and not yet in force.observed
ProbableIAPP — Quebec's Private Sector Act (Section 32) requires that an individual rights request be addressed within 30 days.observed
Breach notification, DPO and DPIA duties are well evidenced for the federal and Quebec-overlay tracks, but ROPA exemption tests and joint-controller/processor-contract mandatory terms were not located in this pass.
Primary frameworkPIPEDA (Digital Privacy Act amendments) and Quebec Private Sector Act as amended by Law 25
Traffic-light rationale — AmberBreach notification, DPO and DPIA duties are well evidenced for the federal and Quebec-overlay tracks, but ROPA exemption tests and joint-controller/processor-contract mandatory terms were not located in this pass.
Sub-modules (7)
Accountability And DpiaAmber
Quebec's Law 25 requires privacy impact assessments before adopting technology that processes personal information, phased in from September 2023.
Claims (1):
Quebec's Law 25 requires organizations to perform privacy impact assessments before adopting technology that processes personal information, a duty within the tranche of obligations entering force on 22 September 2023.
Dpo RequirementsAmber
Quebec's Law 25 requires appointment of a privacy officer with publicly accessible contact details, in force since September 2022; PIPEDA has no equivalent statutory DPO mandate.
Claims (1):
Law 25 amended Quebec's Private Sector Act to introduce a mandatory requirement to appoint a privacy officer, whose contact details must be made publicly accessible, effective from 22 September 2022.
Ropa RequirementsRed
No ROPA-equivalent exemption test was located for either PIPEDA or Quebec's Act in this pass.
Joint Controller ArrangementsRed
No pinpoint mandatory-processor-contract-terms provision equivalent to GDPR Art.28(3) was located for PIPEDA or Quebec's Act in this pass.
Security MeasuresGreen
PIPEDA Principle 7 requires safeguards appropriate to the sensitivity of personal information, without prescribing specific technical measures.
Claims (1):
PIPEDA requires organizations to protect personal information with safeguards appropriate to its sensitivity, and to protect it regardless of format against loss, theft, or unauthorized access, disclosure, copying, use or modification, without specifying particular technical security measures.
Breach NotificationGreen
PIPEDA's breach-reporting duty (in force Nov 2018) and Quebec's parallel confidentiality-incident regime (in force Dec 2022) both use a serious-harm/serious-injury threshold with notice to the regulator and affected individuals.
Claims (2):
PIPEDA's mandatory breach-reporting provisions, added by the 2015 Digital Privacy Act, came into force on 1 November 2018 and require organizations to report to the OPC and notify affected individuals and relevant third parties of breaches of security safeguards that pose a real risk of significant harm.
Quebec's Regulation respecting confidentiality incidents, in effect since 29 December 2022, mandates detailed breach notification to the CAI and affected individuals where there is risk of serious injury, and requires registration of incidents with records kept for at least five years after awareness of the incident.
Retention And DisposalGreen
PIPEDA Principle 5 limits retention of personal information to what is necessary to fulfill the identified purposes.
Claims (1):
Under PIPEDA, personal information can only be used and disclosed for the purposes for which it was collected and may be retained only as long as necessary to fulfill those purposes.
Category narrative73 words
PIPEDA's mandatory breach-reporting regime (in force since 1 November 2018) requires notice to the OPC and affected individuals where a breach poses a 'real risk of significant harm,' plus a breach-record-keeping duty. Quebec's Law 25 layered on a parallel 'confidentiality incident' regime (Regulation respecting confidentiality incidents, in force 29 December 2022) with a 'risk of serious injury' threshold, a mandatory privacy-officer appointment (from September 2022), and DPIA-style privacy impact assessments from September 2023.
Sources and claims (6)
ProbableIAPP — Quebec's Law 25 requires organizations to perform privacy impact assessments before adopting technology that processes personal information, a duty within the tranche of obligations entering force on 22 September 2023.observed
ConfirmedIAPP — Law 25 amended Quebec's Private Sector Act to introduce a mandatory requirement to appoint a privacy officer, whose contact details must be made publicly accessible, effective from 22 September 2022.observed
ConfirmedOPC — PIPEDA requires organizations to protect personal information with safeguards appropriate to its sensitivity, and to protect it regardless of format against loss, theft, or unauthorized access, disclosure, copying, use or modification, without specifying particular technical security measures.observed
ConfirmedOPC — PIPEDA's mandatory breach-reporting provisions, added by the 2015 Digital Privacy Act, came into force on 1 November 2018 and require organizations to report to the OPC and notify affected individuals and relevant third parties of breaches of security safeguards that pose a real risk of significant harm.observed
ConfirmedDataGuidance/OneTrust — Quebec's Regulation respecting confidentiality incidents, in effect since 29 December 2022, mandates detailed breach notification to the CAI and affected individuals where there is risk of serious injury, and requires registration of incidents with records kept for at least five years after awareness of the incident.observed
ConfirmedOPC — Under PIPEDA, personal information can only be used and disclosed for the purposes for which it was collected and may be retained only as long as necessary to fulfill those purposes.observed
The adequacy scope-gap and PIPEDA's accountability-based transfer model are well evidenced; no data-localisation mandate or Kahnawake-specific TIA practice was located.
Primary frameworkPIPEDA Schedule 1 Principle 1 (accountability) and European Commission Decision 2002/2/EC
Traffic-light rationale — AmberThe adequacy scope-gap and PIPEDA's accountability-based transfer model are well evidenced; no data-localisation mandate or Kahnawake-specific TIA practice was located.
Sub-modules (6)
Transfer MechanismsGreen
PIPEDA treats a transfer for processing as a 'use,' not a 'disclosure,' requiring no additional consent if used for the originally collected purpose, with the transferring organization remaining accountable.
Claims (1):
Under PIPEDA, a transfer of personal information to a third party for processing is treated as a 'use' rather than a 'disclosure'; additional consent is not required if the information is used for its originally collected purpose, but the transferring organization remains accountable and must use contractual or other means to provide a comparable level of protection.
Adequacy ReceivedAmber
The EU's Canada adequacy decision (2002/2/EC) is limited to data governed by PIPEDA; non-commercial and purely provincial/employee data fall outside its scope.
Claims (1):
Canada's EU adequacy determination (Commission Decision 2002/2/EC) is limited to data under the jurisdiction of PIPEDA; employee data and activities under purely provincial jurisdiction are not covered by the adequacy decision.
Adequacy GrantedRed
No instance of Canada granting outbound adequacy to another jurisdiction was located in this pass.
Sccs And BcrsAmber
Entities outside PIPEDA's adequacy scope (e.g., universities, non-commercial bodies) must rely on SCCs or Article 49 GDPR derogations for EU transfers.
Claims (1):
Because Canada's adequacy decision covers only PIPEDA-governed commercial data, non-commercial Canadian entities such as universities must use standard contractual clauses or GDPR Article 49 derogations for transfers to the EU, with derogations not intended for continuous and repeated processing.
Transfer Impact AssessmentRed
No statutory TIA requirement equivalent to EDPB guidance was located for PIPEDA or Quebec's Act in this pass.
Data LocalisationRed
No general data-localisation mandate was identified for PIPEDA, Quebec's Act, or Kahnawake specifically.
Category narrative77 words
Canada's 2002 EU adequacy decision is scoped only to organizations and data governed by PIPEDA (i.e., commercial activity); it does not extend to purely provincially-regulated activity, non-commercial entities, or employee data outside federally-regulated businesses, which must rely on SCCs or GDPR Art.49 derogations instead. PIPEDA itself takes an organization-to-organization accountability approach to outbound transfers rather than a state-to-state adequacy model, requiring contractual or other means to ensure comparable protection when data is transferred for processing, including abroad.
Sources and claims (3)
ConfirmedOPC — Under PIPEDA, a transfer of personal information to a third party for processing is treated as a 'use' rather than a 'disclosure'; additional consent is not required if the information is used for its originally collected purpose, but the transferring organization remains accountable and must use contractual or other means to provide a comparable level of protection.observed
ConfirmedIAPP — Canada's EU adequacy determination (Commission Decision 2002/2/EC) is limited to data under the jurisdiction of PIPEDA; employee data and activities under purely provincial jurisdiction are not covered by the adequacy decision.observed
ProbableIAPP — Because Canada's adequacy decision covers only PIPEDA-governed commercial data, non-commercial Canadian entities such as universities must use standard contractual clauses or GDPR Article 49 derogations for transfers to the EU, with derogations not intended for continuous and repeated processing.observed
Financial-sector and telecoms overlays are documented; health, credit-scoring, education and insurance sectoral rules specific to this JID were not located in this pass.
Primary frameworkPIPEDA plus sector-specific federal statutes (CASL, Consumer-Driven Banking Act)
Traffic-light rationale — AmberFinancial-sector and telecoms overlays are documented; health, credit-scoring, education and insurance sectoral rules specific to this JID were not located in this pass.
Sub-modules (8)
Financial Sector OverlayAmber
The Consumer-Driven Banking Act establishes Canada's open-banking data-sharing regime and is positioned as the first iteration of a broader federal data-mobility framework.
Claims (1):
Consumer-directed finance under the Consumer-Driven Banking Act is proposed to be amended under Bill C-15 to ensure individuals and businesses can securely share their data with participating entities of their choice, and is described by Finance Canada as the 'first iteration' of a broader data-mobility framework.
Health Sector OverlayRed
No Kahnawake- or Quebec-specific health-sector DP overlay was located in this pass.
Telecoms And EprivacyGreen
CASL amends PIPEDA to restrict electronic address harvesting and spyware-based collection of personal information, co-enforced by the OPC, CRTC and Competition Bureau.
Claims (1):
When Canada's Anti-Spam Legislation (CASL) came into force in 2014, it amended PIPEDA to add restrictions on electronic-address harvesting and on collecting personal information using spyware, with enforcement shared between the OPC and two other agencies, including the Canadian Radio-television and Telecommunications Commission.
Employment DataAmber
PIPEDA applies to employee personal information only in connection with federally-regulated businesses; provincially-regulated employers' staff data falls outside PIPEDA.
Claims (1):
PIPEDA applies to employee personal information only in connection with a federal work, undertaking or business (FWUB); employee information held by provincially-regulated organizations is covered instead by applicable provincial law, where one exists.
Credit And ScoringRed
No credit-scoring-specific DP rule for this JID was located in this pass.
EducationRed
No education-sector-specific DP rule for this JID was located in this pass.
InsuranceRed
No insurance-sector-specific DP rule for this JID was located in this pass.
Data Access SharingAmber
Bill C-15 proposes a federal data-mobility framework (PIPEDA Division 1.2); separately, OCAP principles assert First Nations communities' right to govern data describing them, a horizontal Indigenous-governance overlay relevant to Kahnawake.
Claims (2):
Bill C-15 would add new Division 1.2 to PIPEDA requiring an organization, on an individual's request, to disclose personal information it collected from them to a designated organization, subject to regulations and applicable only where both organizations are covered by a prescribed data-mobility framework.
Through OCAP (Ownership, Control, Access, Possession), First Nations assert the right to govern how information describing them will be used and disclosed regardless of where it is held, and what limitations must be placed on its use -- a framework the FNIGC has analyzed against PIPEDA for First Nations businesses and governments.
Category narrative99 words
The most consequential sectoral overlay for CA-KAH is the Consumer-Driven Banking Act (open-banking), described as the 'first iteration' of Canada's forthcoming federal data-mobility framework under Bill C-15; CASL (Canada's Anti-Spam Legislation) amends PIPEDA with restrictions on electronic-address harvesting and spyware-based collection; and PIPEDA's employee-data carve-out leaves provincially-regulated employers' staff data outside federal scope. A distinct Indigenous-governance overlay exists via the First Nations principles of Ownership, Control, Access and Possession (OCAP), which the First Nations Information Governance Centre has urged be reconciled with PIPEDA for First Nations businesses and governments -- directly relevant to a Mohawk Council of Kahnawake-governed territory.
Sources and claims (5)
ProbableOPC — Consumer-directed finance under the Consumer-Driven Banking Act is proposed to be amended under Bill C-15 to ensure individuals and businesses can securely share their data with participating entities of their choice, and is described by Finance Canada as the 'first iteration' of a broader data-mobility framework.observed
ConfirmedOPC — When Canada's Anti-Spam Legislation (CASL) came into force in 2014, it amended PIPEDA to add restrictions on electronic-address harvesting and on collecting personal information using spyware, with enforcement shared between the OPC and two other agencies, including the Canadian Radio-television and Telecommunications Commission.observed
ConfirmedOPC — PIPEDA applies to employee personal information only in connection with a federal work, undertaking or business (FWUB); employee information held by provincially-regulated organizations is covered instead by applicable provincial law, where one exists.observed
ConfirmedOPC — Bill C-15 would add new Division 1.2 to PIPEDA requiring an organization, on an individual's request, to disclose personal information it collected from them to a designated organization, subject to regulations and applicable only where both organizations are covered by a prescribed data-mobility framework.observed
ProbableOPC — Through OCAP (Ownership, Control, Access, Possession), First Nations assert the right to govern how information describing them will be used and disclosed regardless of where it is held, and what limitations must be placed on its use -- a framework the FNIGC has analyzed against PIPEDA for First Nations businesses and governments.observed
Direct-marketing consent rules under CASL are well evidenced; cookie-specific pinpoint provisions, dark-pattern prohibitions, and opt-out-signal recognition for this JID were not located in this pass.
Primary frameworkPIPEDA (general consent principle) and Canada's Anti-Spam Legislation (CASL)
Traffic-light rationale — AmberDirect-marketing consent rules under CASL are well evidenced; cookie-specific pinpoint provisions, dark-pattern prohibitions, and opt-out-signal recognition for this JID were not located in this pass.
Sub-modules (6)
Cookies And TrackersAmber
No dedicated statutory cookie-consent provision exists; OPC guidance requires gaming and online services to obtain meaningful consent for collection, use or disclosure of personal information via tracking/profiles.
Claims (1):
In Canada, gaming companies need to obtain meaningful consent from players if personal information is being collected, used or disclosed, per OPC guidance applying PIPEDA's general consent principle to online tracking and profiling in the absence of a dedicated cookie-consent statute.
Dark PatternsRed
No dark-pattern-specific statutory prohibition for this JID was located in this pass.
Opt Out SignalsRed
No Global Privacy Control or DAA-equivalent recognition for this JID was located in this pass.
Clean Rooms And DcrRed
No clean-room/data-collaboration-room-specific rule for this JID was located in this pass.
Cross Context AdvertisingRed
No CPRA-style 'sale'/'share' analogue exists under PIPEDA; this sub-module has no applicable finding.
Direct MarketingGreen
CASL requires consent for sending commercial electronic messages and governs address-harvesting, co-enforced by the OPC with the CRTC and Competition Bureau.
Claims (1):
CASL requires that individuals receiving electronic marketing messages have provided appropriate consent for the collection and use of their address for marketing purposes, with the OPC sharing enforcement responsibility for CASL with the CRTC and a third agency.
Category narrative48 words
Canada has no dedicated ePrivacy-style statutory cookie-consent regime; OPC guidance applies PIPEDA's general meaningful-consent principle to online tracking, profiling and in-game data collection. Direct electronic marketing is instead governed by CASL, which requires consent for commercial electronic messages and is co-enforced with the CRTC and the Competition Bureau.
Sources and claims (2)
ProbableOPC — In Canada, gaming companies need to obtain meaningful consent from players if personal information is being collected, used or disclosed, per OPC guidance applying PIPEDA's general consent principle to online tracking and profiling in the absence of a dedicated cookie-consent statute.observed
ConfirmedOPC — CASL requires that individuals receiving electronic marketing messages have provided appropriate consent for the collection and use of their address for marketing purposes, with the OPC sharing enforcement responsibility for CASL with the CRTC and a third agency.observed
The Quebec ADM-transparency obligation and the PIPEDA no-go-zone doctrine are documented; a federal AI-specific statute is not currently in force, and no biometric-specific statutory condition for this JID was located.
Primary frameworkPIPEDA s.5(3) and Quebec Private Sector Act as amended by Law 25
Traffic-light rationale — AmberThe Quebec ADM-transparency obligation and the PIPEDA no-go-zone doctrine are documented; a federal AI-specific statute is not currently in force, and no biometric-specific statutory condition for this JID was located.
Sub-modules (6)
Profiling RestrictionsAmber
PIPEDA's s.5(3) no-go-zone doctrine bars profiling that leads to unfair, unethical or discriminatory treatment contrary to human-rights law, irrespective of consent.
Claims (1):
PIPEDA's no-go-zone doctrine under s.5(3) prohibits profiling or categorizing individuals in a way that leads to unfair, unethical or discriminatory treatment contrary to human-rights law, as an over-arching limit that cannot be consented around.
Automated Decision Making TransparencyAmber
Quebec's Law 25 requires individuals be informed when personal information is used to render a decision based exclusively on automated processing.
Claims (1):
Quebec's amended Private Sector Act requires that individuals be informed of the use of technology that creates a profile and of automated processing used to render a decision about them, including the means to deactivate profiling functions where available.
Ai Risk AssessmentsRed
The federal AIDA died on the order paper with Bill C-27 in January 2025; no binding federal AI-risk-assessment statute is currently in force.
Claims (1):
The Artificial Intelligence and Data Act (AIDA), which would have established Canada's first AI-specific risk-assessment regime, died on the order paper along with the rest of Bill C-27 upon prorogation of Parliament in January 2025 and has not since been re-enacted.
Biometric RegimeAmber
Quebec's Law 25 requires notification to the CAI on creation of a biometric database; no further biometric-specific condition for this JID was located.
Claims (1):
Quebec's amended Private Sector Act requires notification to the Commission d'acces a l'information (CAI) upon the creation of a biometric database, a duty phased in alongside Law 25's other obligations from 2022.
Genetic DataRed
No genetic-data-specific statutory regime for this JID was located in this pass.
State Surveillance CarveoutsAmber
PIPEDA s.7(1)(e) permits organizations to collect personal information without knowledge or consent for law-enforcement/national-security purposes, provisions currently under court challenge.
Claims (1):
PIPEDA section 7(1)(e) gives organizations authority to collect personal information without knowledge or consent for law-enforcement and national-security purposes without limiting the amount of information, duration, or sources of collection; provisions of this kind are currently challenged in Canadian Civil Liberties Association v. Canada before the Ontario Superior Court.
Category narrative73 words
PIPEDA has no GDPR Art.22-style automated-decision-making right, but its s.5(3) 'no-go zone' doctrine prohibits profiling or categorizing individuals in ways leading to unfair, unethical or discriminatory treatment contrary to human-rights law. Quebec's Law 25 added automated-decision-making transparency obligations (informing individuals when a decision about them is based exclusively on automated processing). The federal AI-specific statute (AIDA, part of Bill C-27) died on the order paper in January 2025 and has not been re-enacted.
Sources and claims (4)
ConfirmedOPC — PIPEDA's no-go-zone doctrine under s.5(3) prohibits profiling or categorizing individuals in a way that leads to unfair, unethical or discriminatory treatment contrary to human-rights law, as an over-arching limit that cannot be consented around.observed
ProbableIAPP — Quebec's amended Private Sector Act requires that individuals be informed of the use of technology that creates a profile and of automated processing used to render a decision about them, including the means to deactivate profiling functions where available.observed
ConfirmedOPC — The Artificial Intelligence and Data Act (AIDA), which would have established Canada's first AI-specific risk-assessment regime, died on the order paper along with the rest of Bill C-27 upon prorogation of Parliament in January 2025 and has not since been re-enacted.observed
ProbableOPC — PIPEDA section 7(1)(e) gives organizations authority to collect personal information without knowledge or consent for law-enforcement and national-security purposes without limiting the amount of information, duration, or sources of collection; provisions of this kind are currently challenged in Canadian Civil Liberties Association v. Canada before the Ontario Superior Court.observed
No binding statutory age-of-consent threshold, age-verification mandate, or minor-profiling ban equivalent to GDPR Art.8/DSA Art.28(2) was located for this JID in this pass; the module rests on interpretive guidance only.
Traffic-light rationale — RedNo binding statutory age-of-consent threshold, age-verification mandate, or minor-profiling ban equivalent to GDPR Art.8/DSA Art.28(2) was located for this JID in this pass; the module rests on interpretive guidance only.
Sub-modules (5)
Age VerificationRed
No statutory age-verification mandate for this JID was located in this pass.
Parental ConsentAmber
OPC guidance (non-statutory) states children under 13 generally cannot provide valid consent and recommends parental consent in that scenario.
Claims (1):
The OPC's published guidance states that children under 13 cannot usually provide valid consent, and that if gaming services believe a user to be under 13, they need to request consent from a parent; this is interpretive OPC guidance rather than a fixed statutory age threshold within PIPEDA itself.
Minor Profiling BansRed
No minor-profiling-ban provision for this JID was located in this pass.
Education SettingsRed
No education-settings-specific DP rule for this JID was located in this pass.
Dependent AdultsRed
No dependent-adults-specific DP rule for this JID was located in this pass.
Category narrative60 words
PIPEDA contains no fixed statutory age of digital consent. OPC interpretive guidance states that children under 13 generally cannot provide valid consent and that services should seek parental consent where a user is believed to be under that age; this is regulatory guidance rather than a binding statutory threshold. No education-settings-specific or dependent-adults-specific DP rule for this JID was located.
Sources and claims (1)
ConfirmedOPC — The OPC's published guidance states that children under 13 cannot usually provide valid consent, and that if gaming services believe a user to be under 13, they need to request consent from a parent; this is interpretive OPC guidance rather than a fixed statutory age threshold within PIPEDA itself.observed
Penalty structures, recent enforcement actions, and pending reform are all well evidenced at T1; procedural deadlines, appeal time limits, and a Kahnawake-specific enforcement record are not established in this pass.
Primary frameworkPIPEDA and Quebec Private Sector Act as amended by Law 25
Traffic-light rationale — AmberPenalty structures, recent enforcement actions, and pending reform are all well evidenced at T1; procedural deadlines, appeal time limits, and a Kahnawake-specific enforcement record are not established in this pass.
Sub-modules (6)
Regulator Powers And PenaltiesAmber
PIPEDA's offence-based fines (up to CAD 100,000 on indictment) contrast sharply with Quebec Law 25's GDPR-scale administrative monetary penalties (up to CAD 25 million or 4% of global turnover).
Claims (2):
Under the PIPED Act, specific statutory offences -- including failing to retain information subject to an access request, dismissing or harassing a whistleblower employee, and obstructing the Commissioner's investigation or audit -- are subject to fines of up to CAD 10,000 on summary conviction or up to CAD 100,000 on indictment.
Quebec's Law 25 administrative penalty schedule allows the CAI to impose fines ranging from CAD 10 million or 2% of global turnover up to CAD 25 million or 4% of global turnover for violations, having technically entered into force alongside the law's major provisions in September 2023.
Enforcement Activity IndexAmber
Recent major investigations include the joint OPC/CAI/BC/Alberta TikTok inquiry, the Aylo (Pornhub) investigation, the 23andMe breach investigation, and an expanded X (platform) probe over AI deepfakes.
Claims (3):
The OPC, together with Quebec's CAI and the provincial privacy offices of British Columbia and Alberta, conducted a joint investigation of TikTok Pte. Ltd. (PIPEDA Findings #2025-003) that addressed overlapping jurisdiction between PIPEDA and provincial private-sector privacy statutes.
The OPC's recent investigations include its inquiry into Aylo, which operates Pornhub, concerning nonconsensual sharing of intimate images, and its examination of the 23andMe breach, which affected the highly sensitive personal information of 7 million customers, including more than 300,000 Canadians.
The Privacy Commissioner of Canada expanded his investigation into the social media platform X following reports of AI-generated sexualized deepfake images, citing the platform's obligations under PIPEDA.
Regulator Funding And CapacityRed
No specific OPC funding/headcount figures for the period were located in this pass.
Collective Redress And Class ActionsRed
No collective-redress/class-action-specific mechanism distinct from the private right of action was located in this pass.
Private Right Of ActionGreen
Quebec's amended Act creates a private right of action with a mandated minimum punitive-damages award for intentional or grossly-faulty infringements.
Claims (1):
Quebec's amended Private Sector Act creates a private right of action enabling individuals to sue organizations for violations including unlawful collection, use, disclosure, destruction or retention of personal information, and requires courts to award punitive damages of at least CAD 1,000 where the infringement is intentional or results from a gross fault.
Recent Developments 180DAmber
Bill C-15's PIPEDA data-mobility amendments were under active House and Senate committee review in late 2025/January 2026, and PIPEDA's law-enforcement disclosure provisions are under constitutional challenge.
Claims (2):
Bill C-15, the Budget 2025 Implementation Act No.1, which would add PIPEDA data-mobility provisions, was reviewed by the Standing Senate Committee on Banking, Commerce and the Economy in December 2025 and the House Standing Committee on Industry and Technology on 26 January 2026, with the Privacy Commissioner supporting the policy objective while urging formal OPC consultation on the implementing regulations.
In Canadian Civil Liberties Association v. Canada (Attorney General), 2026 ONSC 783, the CCLA is seeking a declaration from the Ontario court severing PIPEDA provisions that it argues allow disclosure of personal information to government institutions without meaningful oversight, accountability, or safeguards.
Category narrative135 words
PIPEDA gives the OPC ombudsman-style investigatory powers but no general order-making/administrative-penalty authority; specific statutory offences (failure to retain access-request records, whistleblower retaliation, obstruction of the Commissioner) carry fines up to CAD 100,000 on indictment. Quebec's Law 25 is far more punitive: the CAI can impose administrative monetary penalties up to CAD 10 million or 2% of global turnover (lower tier) and CAD 25 million or 4% of global turnover (upper tier), and the amended Act creates a private right of action with a minimum CAD 1,000 punitive-damages floor for intentional or grossly-faulty breaches. Recent federal developments include Bill C-15's PIPEDA data-mobility amendments under active committee review, a constitutional challenge to PIPEDA's law-enforcement disclosure provisions, and several high-profile OPC investigations (TikTok joint investigation, Aylo/Pornhub, the 23andMe breach, and an expanded probe of X over AI-generated deepfakes).
Sources and claims (8)
ConfirmedOPC — Under the PIPED Act, specific statutory offences -- including failing to retain information subject to an access request, dismissing or harassing a whistleblower employee, and obstructing the Commissioner's investigation or audit -- are subject to fines of up to CAD 10,000 on summary conviction or up to CAD 100,000 on indictment.observed
ConfirmedIAPP — Quebec's Law 25 administrative penalty schedule allows the CAI to impose fines ranging from CAD 10 million or 2% of global turnover up to CAD 25 million or 4% of global turnover for violations, having technically entered into force alongside the law's major provisions in September 2023.observed
ConfirmedOPC — The OPC, together with Quebec's CAI and the provincial privacy offices of British Columbia and Alberta, conducted a joint investigation of TikTok Pte. Ltd. (PIPEDA Findings #2025-003) that addressed overlapping jurisdiction between PIPEDA and provincial private-sector privacy statutes.observed
ConfirmedOPC — The OPC's recent investigations include its inquiry into Aylo, which operates Pornhub, concerning nonconsensual sharing of intimate images, and its examination of the 23andMe breach, which affected the highly sensitive personal information of 7 million customers, including more than 300,000 Canadians.observed
ProbableOPC — The Privacy Commissioner of Canada expanded his investigation into the social media platform X following reports of AI-generated sexualized deepfake images, citing the platform's obligations under PIPEDA.observed
ConfirmedDataGuidance/OneTrust — Quebec's amended Private Sector Act creates a private right of action enabling individuals to sue organizations for violations including unlawful collection, use, disclosure, destruction or retention of personal information, and requires courts to award punitive damages of at least CAD 1,000 where the infringement is intentional or results from a gross fault.observed
ConfirmedOPC — Bill C-15, the Budget 2025 Implementation Act No.1, which would add PIPEDA data-mobility provisions, was reviewed by the Standing Senate Committee on Banking, Commerce and the Economy in December 2025 and the House Standing Committee on Industry and Technology on 26 January 2026, with the Privacy Commissioner supporting the policy objective while urging formal OPC consultation on the implementing regulations.observed
ConfirmedOPC — In Canadian Civil Liberties Association v. Canada (Attorney General), 2026 ONSC 783, the CCLA is seeking a declaration from the Ontario court severing PIPEDA provisions that it argues allow disclosure of personal information to government institutions without meaningful oversight, accountability, or safeguards.observed
No categories match.
Filters combine as OR inside a group and AND across
groups.
Publication gate
Blocking. 1 failing check(s).
schema_valid
pass
min_quoted_text_present
waived — floor 0%
translation_provenance_recorded
n/a — no subject in this jurisdiction
egress_verified
pass
min_t1_per_instrument_met
n/a — no subject in this jurisdiction
jurisdiction_source_floor_met
pass
source_tier_integrity_ok
pass
manual_override
FAIL
tier_a_b_national_primary_pct
64.29
aggregator_only_jurisdiction_count
0
Editorial metadata
Provenance only. Nothing below gates publication or affects the render.
Editorial metadata for CA-KAH
Field
Value
trust.lawyer_review.status
never_reviewed
trust.lawyer_review.reviewer
no reviewer on record
trust.content_source
ai_generated
Provenance and declared absence
Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.
Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category (BRIEF section 2b.5). Neither WPM nor the crypto monitor carries this field.
Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.
Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.
Suppressed by doctrine: derived risk score; derived_scores = {}.
Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-20. A year-precision row is never promoted into a tighter band.
Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 46 claim(s) (46 category placement(s)), 28 source(s) in the cumulative register.
Audit trail
Machine checkChallenged on 6 Oct 2026: nothing tested (no claim on this page was eligible for an automated test). An automated, adversarial test run by a second model; no person has assessed the result.
Federal PIPEDA coverage is strong (T1, direct priv.gc.ca citations) across all 10 modules. Quebec Law 25/Private Sector Act coverage relies on T3 secondary commentary (DataGuidance, IAPP) rather than the CAI's own gazette text, which was not retrieved live in this pass -- min_t1_per_instrument_met is therefore false for the Quebec instrument specifically. The Kahnawake Gaming Commission's own enabling law and licensing regulations could not be verified at all in this pass (no seed anchor, host not on retrieval allowlist); this is the weakest point of the baseline and is flagged via absent_field_provenance on CLM-CA-KAH-002. children_and_vulnerable_groups, several sectoral_watch sub-modules (health, credit, education, insurance), cross_border_and_adequacy.data_localisation/adequacy_granted/transfer_impact_assessment, and controller_processor_duties.ropa_requirements/joint_controller_arrangements carry red traffic lights with explicit absent_field_provenance rather than fabricated findings.
Unresolved questions (4):
Does Quebec's amended Private Sector Act (Law 25) bind private enterprises carrying on business physically within Kahnawake Mohawk Territory, given that the land is federal reserve land under s.91(24) of the Constitution Act, 1867? No OPC, CAI, or case-law source addressing this was located.
What is the precise statutory or regulatory text of the Kahnawake Gaming Commission's confidentiality/data-security conditions for its interactive-gaming licensees? The KGC domain was not on this run's retrieval allowlist and no seed anchor was supplied.
Does the Mohawk Council of Kahnawake maintain any community-level data-governance code (e.g., an OCAP-aligned community data policy) distinct from PIPEDA/Quebec's Act? No such instrument was located in this pass.
What are the statutory investigation/decision deadlines and appeal time limits applicable to OPC and CAI proceedings relevant to this JID? Not located in this pass.