Not publishable as-is. 1 of 6 publication_gate checks fail. The renderer displays the gate rather than suppressing it. Legal review and sub-brief approval are informational and are not part of this test.
CA-TFN
CA-TFNschema gdpri-v2trajectory: not yet assessedhybrid regimeoverlaps: AIC
Summary answer not yet published for this jurisdiction
Data collected · Data published
AI-assembled from cited sources
Not covered: Regulator & Framework, Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups, Enforcement & Redress.
10 categories · 0
claims · 40 sources in the cumulative register
10Categoriesbaseline.[]
58Sub-modulesbaseline..sub_modules{}
0Claimsbaseline..claims[]
0Tier-1 sourcesrun_metadata.t1_source_count
Traffic-light mix(sums to 10 rendered categories; click to filter)
No red categories; 25 sub-modules are flagged red.
Canada federal law that applies in CA-TFN is covered once, on the Canada page. This page covers CA-TFN’s own layer: its own law, regulators and enforcement.
Jurisdiction brief
No content recorded at this JID path.
10 of 10 categories
Signal
Density
Selections OR within a group, AND across groups. Press / to search.
A functioning federal regulator and statute exist and have been applied directly to a First Nation band council, but PIPEDA's material scope is activity-limited (commercial/FWUB) rather than universal, and no registration/filing regime or Indigenous-specific instrument exists.
Primary frameworkPersonal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c.5
Traffic-light rationale — AmberA functioning federal regulator and statute exist and have been applied directly to a First Nation band council, but PIPEDA's material scope is activity-limited (commercial/FWUB) rather than universal, and no registration/filing regime or Indigenous-specific instrument exists.
Sub-modules (5)
Regulator And AuthorityGreen
OPC is an independent Agent of Parliament mandated to oversee both PIPEDA (private sector) and the Privacy Act (federal public sector).
Claims (1):
CLM-CA-TFN-001 (claim on file)
Act And InstrumentsAmber
PIPEDA received Royal Assent in 2000; Part 1 is the operative private-sector instrument; no successor statute has yet replaced it.
Claims (1):
CLM-CA-TFN-002 (claim on file)
Material ScopeAmber
PIPEDA covers commercial-activity personal information nationally and FWUB employee data, including, per OPC case practice, band-council employees acting in core governmental functions.
Claims (2):
CLM-CA-TFN-003 (claim on file)
CLM-CA-TFN-004 (claim on file)
Territorial ScopeGreen
PIPEDA applies wherever there is a real and substantial connection to Canada and applies fully within New Brunswick because NB has no 'substantially similar' provincial law (unlike AB/BC/QC).
Claims (1):
CLM-CA-TFN-005 (claim on file)
Regulator Registration And FilingRed
No general registration, notification or fee duty on controllers was identified under PIPEDA.
Tobique First Nation (a reserve community in New Brunswick) is not subject to a dedicated Indigenous or provincial private-sector data-protection statute. The operative regime is the federal Personal Information Protection and Electronic Documents Act (PIPEDA), enforced by the Office of the Privacy Commissioner of Canada (OPC), which applies to commercial activity across Canada and to employee data of 'federal works, undertakings or businesses' (FWUBs). New Brunswick has not enacted a provincial private-sector law deemed 'substantially similar' to PIPEDA (unlike Alberta, BC and Quebec), so PIPEDA applies in full within NB. OPC practice treats a First Nation band council acting in its core governmental functions as a FWUB, bringing band-council employee personal information within PIPEDA's and the OPC's jurisdiction — a finding of direct relevance to Tobique First Nation's own governance body.
Core consent and sensitivity doctrines are well-developed and actively enforced, but there is no statutory anonymisation/pseudonymisation safe harbour and no enumerated special-category list.
Traffic-light rationale — AmberCore consent and sensitivity doctrines are well-developed and actively enforced, but there is no statutory anonymisation/pseudonymisation safe harbour and no enumerated special-category list.
Sub-modules (4)
Lawful BasesAmber
Consent is the default basis; s.5(3) requires purposes a reasonable person would consider appropriate; s.7 lists limited consent exceptions (e.g., publicly available information).
Claims (1):
CLM-CA-TFN-006 (claim on file)
Consent ThresholdsGreen
Consent must let the individual reasonably understand nature, purpose and consequences (s.6.1); OPC guidance mandates express consent for sensitive information, out-of-expectation uses, or meaningful residual risk of harm.
Claims (2):
CLM-CA-TFN-007 (claim on file)
CLM-CA-TFN-008 (claim on file)
Special CategoriesAmber
No defined special-category list; 'sensitive personal information' is contextual; biometric/facial data has been found sensitive in almost all circumstances requiring express consent.
Claims (2):
CLM-CA-TFN-009 (claim on file)
CLM-CA-TFN-010 (claim on file)
Pseudonymisation And AnonymisationRed
PIPEDA contains no statutory de-identification/anonymisation safe harbour; the proposed CPPA (Bill C-27) would have added one but died on the order paper in January 2025.
Claims (1):
CLM-CA-TFN-011 (claim on file)
Category narrative88 words
PIPEDA is built around a consent-centric model (Schedule 1, Principle 4.3) rather than an enumerated multi-basis framework like GDPR Art 6, supplemented by a 'reasonable purposes' test (s.5(3)) and a 'meaningful consent' validity standard (s.6.1). It has no codified list of 'special category' data; instead it imposes an undefined but heightened 'sensitive information' standard, which the OPC/CAI have applied to require express opt-in consent for biometric/facial-recognition data (Clearview AI). Reform proposals (Bill C-27) that would have added de-identification/anonymisation safe harbours died on the order paper in January 2025.
Traffic-light rationale — AmberAccess and timeliness rights are robust and enforced, but erasure and portability rights that are now baseline in comparator regimes remain absent.
Sub-modules (5)
Access RightGreen
Individuals have the right to be informed of, and to access, their personal information held by an organization.
Claims (1):
CLM-CA-TFN-012 (claim on file)
Deadlines And Response WindowsGreen
30-day response deadline, one 30-day extension (with written notice and complaint-rights advisory), deemed refusal on silence; actively enforced (e.g., Bell 2026 contravention).
Claims (1):
CLM-CA-TFN-013 (claim on file)
Rectification And ErasureRed
Right to challenge accuracy exists; no standalone erasure right exists under PIPEDA, and the CPPA's proposed right to be forgotten died with Bill C-27.
Claims (1):
CLM-CA-TFN-014 (claim on file)
Data PortabilityRed
PIPEDA has no direct equivalent of GDPR Art 20 data portability.
Claims (1):
CLM-CA-TFN-015 (claim on file)
Restriction And ObjectionRed
No explicit standalone restriction/objection right distinct from consent withdrawal was confirmed in sources reviewed this cycle.
Absence provenance: unavailable. Searched: PIPEDA right to object profiling, PIPEDA restriction of processing.
Category narrative63 words
Individuals have a right of access and to challenge accuracy (Principle 4.9), with a strict 30-day statutory response deadline (s.8(3)), a single 30-day extension option with mandatory notice (s.8(4)), and a deemed-refusal consequence for silence (s.8(5)) — actively enforced (e.g., 2026 Bell Canada finding). PIPEDA has no standalone erasure/'right to be forgotten' or data-portability right; the defunct Bill C-27/CPPA would have added both.
Traffic-light rationale — GreenBreach-notification and accountability duties are clearly specified, in force, and actively enforced through multiple OPC findings (Brinks, MGM).
Sub-modules (7)
Accountability And DpiaAmber
Principle 4.1 accountability applies; PIPEDA does not mandate formal private-sector DPIAs (PIAs are a Treasury Board policy requirement for federal institutions under the Privacy Act, not PIPEDA).
Claims (1):
CLM-CA-TFN-016 (claim on file)
Dpo RequirementsAmber
No formal 'DPO' title is mandated, but Principle 4.1 requires designating an accountable individual, as seen in OPC compliance-promotion case practice.
Claims (1):
CLM-CA-TFN-017 (claim on file)
Ropa RequirementsRed
No records-of-processing-activities (ROPA) regime equivalent to GDPR Art 30 was found under PIPEDA.
Absence provenance: unavailable. Searched: PIPEDA records of processing activities requirement.
Joint Controller ArrangementsAmber
The transferring ('principal') organization remains accountable for personal information handled by a third-party processor, including for breach-reporting purposes, and must have sufficient contractual arrangements in place.
Claims (1):
CLM-CA-TFN-018 (claim on file)
Security MeasuresGreen
Organizations must protect personal information with safeguards appropriate to sensitivity against loss, theft and unauthorized access, disclosure, copying, use or modification.
Claims (1):
CLM-CA-TFN-019 (claim on file)
Breach NotificationGreen
RROSH-triggered reporting to OPC and notification to individuals, in force since 1 Nov 2018, with mandatory recordkeeping and an offence-based penalty for knowing non-compliance.
Claims (3):
CLM-CA-TFN-020 (claim on file)
CLM-CA-TFN-021 (claim on file)
CLM-CA-TFN-022 (claim on file)
Retention And DisposalAmber
Personal information is retained only as long as necessary for identified purposes; breach records must be kept a minimum of two years.
Claims (1):
CLM-CA-TFN-023 (claim on file)
Category narrative95 words
Accountability (Principle 4.1) requires organizations to designate an individual accountable for compliance and remain responsible for information transferred to third-party processors. Security safeguards must be proportionate to sensitivity (Principle 4.7). Mandatory breach reporting/notification (s.10.1, in force since 1 Nov 2018) requires reporting to the OPC and notifying affected individuals wherever a 'real risk of significant harm' (RROSH) exists, assessed via sensitivity and probability of misuse (s.10.1(8)), 'as soon as feasible.' All breaches, regardless of RROSH, must be recorded and retained for two years; knowing non-compliance is an offence (up to $100,000 per individual not notified).
Adequacy from both the EU and UK is current and was substantively reconfirmed in 2024, though materially scoped to PIPEDA-covered commercial data only.
Primary frameworkPIPEDA (transborder transfer accountability); EU Commission Canada adequacy decision (2001, reconfirmed 2024); UK Canada adequacy regulations
Traffic-light rationale — GreenAdequacy from both the EU and UK is current and was substantively reconfirmed in 2024, though materially scoped to PIPEDA-covered commercial data only.
Sub-modules (6)
Transfer MechanismsGreen
PIPEDA does not prohibit transfers abroad for processing; it relies on contractual accountability of the transferring organization rather than a state adequacy test.
Claims (1):
CLM-CA-TFN-024 (claim on file)
Adequacy ReceivedGreen
Canada's EU adequacy (originally 2001 under Directive 95/46/EC Art 25(6)) remains in force under GDPR and was reconfirmed 15 Jan 2024; reviews occur on a four-year cycle (next ~2028); but the decision only covers information subject to PIPEDA, excluding non-commercial entities such as universities.
Claims (2):
CLM-CA-TFN-025 (claim on file)
CLM-CA-TFN-026 (claim on file)
Adequacy GrantedAmber
The UK grants only 'partial adequacy' to Canada, limited to restricted transfers where the recipient information is subject to PIPEDA.
Claims (1):
CLM-CA-TFN-027 (claim on file)
Sccs And BcrsAmber
For transfers outside PIPEDA's/adequacy's scope (e.g., non-commercial entities, intra-provincial employment data), organizations typically rely on the EU 2021 SCCs or Art 49 derogations.
Claims (1):
CLM-CA-TFN-028 (claim on file)
Transfer Impact AssessmentRed
No PIPEDA-specific statutory TIA requirement was located.
Absence provenance: unavailable. Searched: PIPEDA transfer impact assessment.
Data LocalisationRed
No general data-localisation mandate under PIPEDA was found.
Absence provenance: unavailable. Searched: PIPEDA data localisation requirement, Canada data residency law.
Category narrative80 words
PIPEDA takes an organization-to-organization accountability approach to outbound transfers rather than an adequacy-gated model domestically. Canada (via PIPEDA) has held EU adequacy since 2001 (renewed under GDPR Art 45(9)/grandfathering, most recently reconfirmed 15 January 2024, next review expected 2028), but the decision is partial — limited to information actually subject to PIPEDA (commercial activity/FWUBs); non-commercial entities and purely intra-provincial activity fall outside it and require SCCs or Art 49 derogations. The UK's own adequacy regulations mirror this 'partial adequacy' limitation.
The core JID-defining jurisdictional finding (band council as FWUB) is well evidenced, but health-sector and financial-sector sectoral overlays for this specific community remain unconfirmed gaps.
Primary frameworkPIPEDA (FWUB doctrine); OCAP® Principles (non-statutory); First Nations Data Governance Strategy (2020, non-statutory)
Traffic-light rationale — AmberThe core JID-defining jurisdictional finding (band council as FWUB) is well evidenced, but health-sector and financial-sector sectoral overlays for this specific community remain unconfirmed gaps.
Sub-modules (8)
Financial Sector OverlayRed
No Tobique-specific or band-level financial-sector data overlay beyond general FWUB/PIPEDA coverage of federally-regulated financial institutions was found.
Absence provenance: unavailable. Searched: Tobique First Nation financial institution data rules, First Nation band council banking privacy overlay.
Health Sector OverlayRed
No confirmed New Brunswick or federal Indigenous-health-specific privacy statute applicable to on-reserve health services was located this cycle; flagged as an open question.
Absence provenance: unavailable. Searched: New Brunswick personal health information privacy act First Nation reserve, Indigenous Services Canada health privacy PIPEDA Privacy Act interplay.
Telecoms And EprivacyAmber
No dedicated ePrivacy-style telecom communications-data statute distinct from PIPEDA was located; general PIPEDA FWUB coverage applies to telecom carriers.
Absence provenance: unavailable. Searched: Canada ePrivacy telecom traffic data law.
Employment DataAmber
PIPEDA's employee-data coverage is narrow (FWUBs only); band councils in their core governmental function are treated as FWUBs, bringing band employee data under PIPEDA — directly on point for Tobique First Nation.
Claims (2):
CLM-CA-TFN-029 (claim on file)
CLM-CA-TFN-030 (claim on file)
Credit And ScoringAmber
General PIPEDA access/accuracy rights have been applied to credit bureaus in OPC case practice; no distinct statutory credit-scoring regime beyond PIPEDA was found.
Absence provenance: unavailable. Searched: Canada credit scoring specific statute.
EducationRed
No education-sector-specific overlay was located for this JID.
OCAP® principles and the First Nations Data Governance Strategy constitute a parallel, non-statutory Indigenous data-sovereignty framework that OPC has engaged with but which PIPEDA does not itself codify.
Claims (1):
CLM-CA-TFN-031 (claim on file)
Category narrative112 words
The single most JID-critical finding is that a First Nation band council, acting in its core governmental functions, is generally treated by the OPC as a 'federal work, undertaking or business' (FWUB), bringing Tobique First Nation's band-council employee data within PIPEDA — confirmed in a 2016 OPC early-resolution case where a band council adopted a privacy policy at OPC's urging. Alongside the statutory regime, First Nations communities (including Tobique) operate under the non-statutory OCAP® principles (Ownership, Control, Access, Possession) and the 2020 First Nations Data Governance Strategy, asserting community-level data sovereignty that PIPEDA itself does not codify. Health-sector and financial-sector overlays specific to this reserve community were not confirmed in sources reviewed.
This is the weakest-covered module: no dedicated cookie, dark-pattern, opt-out-signal, or clean-room regime exists under the operative PIPEDA framework.
Traffic-light rationale — Not assessedThis is the weakest-covered module: no dedicated cookie, dark-pattern, opt-out-signal, or clean-room regime exists under the operative PIPEDA framework.
Sub-modules (6)
Cookies And TrackersRed
No dedicated statutory cookie-consent provision; OPC applies general meaningful-consent doctrine and recommends avoiding tracking of children.
Claims (1):
CLM-CA-TFN-032 (claim on file)
Dark PatternsRed
No binding dark-pattern prohibition under PIPEDA was found; OPC has funded academic research into dark patterns but this is not a regulatory instrument.
Claims (1):
CLM-CA-TFN-033 (claim on file)
Opt Out SignalsRed
No PIPEDA-specific recognition of browser-level opt-out signals (e.g., Global Privacy Control) was located.
Absence provenance: unavailable. Searched: PIPEDA Global Privacy Control recognition.
Clean Rooms And DcrRed
No data clean-room-specific regime was located under PIPEDA.
Absence provenance: unavailable. Searched: PIPEDA data clean room regulation.
Cross Context AdvertisingRed
No CPRA-style 'sale'/'share' cross-context advertising regime was located under PIPEDA.
Absence provenance: unavailable. Searched: PIPEDA cross-context advertising sale share definition.
Direct MarketingAmber
Electronic direct marketing consent (opt-in, soft opt-in for existing business relationships) is governed by CASL, administered by the CRTC/Competition Bureau separately from OPC/PIPEDA enforcement.
Claims (1):
CLM-CA-TFN-034 (claim on file)
Category narrative81 words
PIPEDA has no dedicated cookie-consent or ePrivacy-style tracker regime; the OPC instead applies its general meaningful-consent framework to online behavioural advertising, acknowledging that valid consent from children is difficult to obtain and recommending organizations avoid tracking on child-directed sites. Electronic direct marketing is governed by a separate statute, Canada's Anti-Spam Legislation (CASL), enforced by the CRTC/Competition Bureau rather than the OPC. No dedicated dark-pattern prohibition, opt-out-signal (e.g., GPC) regime, clean-room framework, or cross-context-advertising rule analogous to CPRA was identified under PIPEDA.
Vigorous ad hoc enforcement exists against biometric surveillance misuse via general consent/purpose principles, but no codified ADM-transparency right or AI-specific statute is currently in force.
Primary frameworkPIPEDA (general consent/purpose principles only — no AI-specific statute in force); defunct Artificial Intelligence and Data Act (AIDA, Bill C-27)
Traffic-light rationale — AmberVigorous ad hoc enforcement exists against biometric surveillance misuse via general consent/purpose principles, but no codified ADM-transparency right or AI-specific statute is currently in force.
Sub-modules (6)
Profiling RestrictionsRed
No general profiling-restriction provision beyond ordinary consent/appropriate-purpose principles was found.
PIPEDA has no automated-decision-making transparency/explanation right; the defunct CPPA would have added a limited explanation requirement.
Claims (1):
CLM-CA-TFN-035 (claim on file)
Ai Risk AssessmentsRed
AIDA, Canada's proposed cross-sectoral AI risk-assessment statute, died with Bill C-27 in January 2025; no enacted successor exists yet.
Claims (1):
CLM-CA-TFN-036 (claim on file)
Biometric RegimeAmber
Biometric/facial-recognition data is treated as sensitive in almost all circumstances, generally requiring express opt-in consent, per the OPC/CAI/OIPC joint Clearview AI finding.
Claims (1):
CLM-CA-TFN-037 (claim on file)
Genetic DataRed
No genetic-data-specific regime beyond general 'sensitive information' treatment was located.
Absence provenance: unavailable. Searched: PIPEDA genetic data specific provision.
State Surveillance CarveoutsAmber
OPC found that RCMP's use of Clearview AI's facial-recognition database (itself built on PIPEDA-non-compliant collection) constituted mass surveillance in violation of privacy law.
Claims (1):
CLM-CA-TFN-038 (claim on file)
Category narrative111 words
PIPEDA contains no GDPR Art 22-equivalent automated-decision-making provision; the OPC's own reform submissions describe the current law as 'ill-suited to the AI environment.' The proposed Artificial Intelligence and Data Act (AIDA), which would have introduced Canada's first cross-sectoral AI risk-assessment regime, died on the order paper with the rest of Bill C-27 upon prorogation in January 2025, leaving Canada without an enacted general AI statute. Biometric/facial-recognition data is nonetheless actively regulated through general PIPEDA consent principles: the OPC's joint investigation found Clearview AI's covert scraping-based facial-recognition database unlawful for lack of consent and inappropriate purpose, and a related special report found the RCMP's use of that database constituted unlawful mass surveillance.
Strong, actively-enforced interpretive protections for minors exist, but they rest on non-binding OPC guidance rather than statute, and a prospective enforceable children's code remains at the consultation stage.
Traffic-light rationale — AmberStrong, actively-enforced interpretive protections for minors exist, but they rest on non-binding OPC guidance rather than statute, and a prospective enforceable children's code remains at the consultation stage.
Sub-modules (5)
Age VerificationAmber
No statutory age-verification mechanism exists; OPC's interpretive under-13 threshold is applied in practice without a formal verification mandate.
Claims (1):
CLM-CA-TFN-039 (claim on file)
Parental ConsentGreen
OPC guidance requires parental/guardian consent for children generally under 13, and maturity-adapted consent processes for older minors.
Claims (1):
CLM-CA-TFN-039 (claim on file)
Minor Profiling BansRed
No codified minor-profiling-for-advertising ban was found distinct from the general sensitivity/consent treatment of children's data.
Absence provenance: unavailable. Searched: PIPEDA minor profiling advertising ban.
Education SettingsRed
No education-settings-specific children's privacy provision was located for this JID.
Absence provenance: unavailable. Searched: PIPEDA education settings children privacy.
Dependent AdultsRed
No dependent-adult-specific privacy provision was located.
PIPEDA has no statutory age-of-consent provision; the OPC's own 'Guidelines for obtaining meaningful consent' set an interpretive threshold that, in all but exceptional circumstances, children under 13 cannot provide meaningful consent themselves (parent/guardian consent required), with a maturity-based sliding scale for older minors. Recent enforcement (a 2025 swimming-pool finding) confirms images of children are treated as sensitive personal information requiring express consent, and that bundling consent for promotional use of children's images with service enrollment is an inappropriate condition of service. The OPC's 2025-2026 exploratory consultation on a 'Children's Privacy Code' found that, as currently drafted, PIPEDA would not allow such a code to be made enforceable — a key legislative gap.
Active, well-documented enforcement continues via the ombudsman/Federal-Court model, but the absence of order-making power and AMPs under current law is a structural weakness flagged repeatedly by the regulator itself, pending stalled legislative reform.
Traffic-light rationale — AmberActive, well-documented enforcement continues via the ombudsman/Federal-Court model, but the absence of order-making power and AMPs under current law is a structural weakness flagged repeatedly by the regulator itself, pending stalled legislative reform.
Sub-modules (6)
Regulator Powers And PenaltiesAmber
Ombudsman-model powers only (investigation, recommendation, compliance agreement, Federal Court application); no order-making or AMP power currently in force; the only monetary penalty is a breach-related offence provision; proposed CPPA AMPs died with Bill C-27.
Claims (3):
CLM-CA-TFN-040 (claim on file)
CLM-CA-TFN-041 (claim on file)
CLM-CA-TFN-042 (claim on file)
Enforcement Activity IndexGreen
2026 findings against Bell Canada (access-deadline contravention) and X Corp./xAI (consent failures re: sexualized deepfakes) evidence ongoing active enforcement within the last 180 days.
Claims (1):
CLM-CA-TFN-043 (claim on file)
Regulator Funding And CapacityAmber
OPC has publicly described itself as a 'global outlier' lacking order/penalty powers (cf. 74% of DPAs globally with fining power) and has estimated a roughly $25 million additional annual funding need to implement reform.
Claims (1):
CLM-CA-TFN-044 (claim on file)
Collective Redress And Class ActionsRed
No PIPEDA-specific collective-redress/class-action mechanism distinct from ordinary Federal Court civil procedure and general Canadian class-action law was located this cycle.
Absence provenance: unavailable. Searched: PIPEDA class action collective redress mechanism.
Private Right Of ActionGreen
PIPEDA s.15 allows a complainant or the Commissioner to apply to the Federal Court for a correction order and/or damages; actively exercised (e.g., ongoing Facebook/Meta litigation, under appeal).
Claims (1):
CLM-CA-TFN-045 (claim on file)
Recent Developments 180DAmber
The EU Commission's January 2024 adequacy renewal explicitly committed to 'closely monitor' future PIPEDA reform; as of the most recent reporting, a successor bill to the defunct C-27 had not yet been introduced, with stakeholders anticipating possible introduction early in the current parliamentary session.
Claims (1):
CLM-CA-TFN-046 (claim on file)
Category narrative155 words
The OPC currently operates largely as an ombudsman: it can investigate complaints, issue non-binding recommendations, enter compliance agreements, and apply to the Federal Court (PIPEDA s.15) for a correction order — but it cannot issue binding orders or impose administrative monetary penalties (AMPs), making it, per its own submissions, 'a global outlier' among comparator DPAs. The only monetary penalty under current PIPEDA is a criminal offence for knowingly contravening breach-reporting/notification/recordkeeping duties (fines reportedly up to $100,000 per individual not notified). Bill C-27's proposed Consumer Privacy Protection Act would have added order-making power and AMPs of up to the greater of C$10 million/3% of global revenue (C$25 million/5% for serious contraventions), but the bill died on the order paper in January 2025 and no successor had been enacted as of this cycle. Recent (within-180-day) enforcement activity includes 2026 findings against Bell Canada (missed 30-day access deadline) and against X Corp./xAI (consent failures enabling non-consensual sexualized deepfakes).
No categories match.
Filters combine as OR inside a group and AND across
groups.
Publication gate
Blocking. 1 failing check(s).
schema_valid
pass
min_quoted_text_present
waived — floor 0%
translation_provenance_recorded
n/a — no subject in this jurisdiction
egress_verified
pass
min_t1_per_instrument_met
n/a — no subject in this jurisdiction
jurisdiction_source_floor_met
pass
source_tier_integrity_ok
pass
manual_override
FAIL
tier_a_b_national_primary_pct
75.0
aggregator_only_jurisdiction_count
0
Editorial metadata
Provenance only. Nothing below gates publication or affects the render.
Editorial metadata for CA-TFN
Field
Value
trust.lawyer_review.status
never_reviewed
trust.lawyer_review.reviewer
no reviewer on record
trust.content_source
ai_generated
Provenance and declared absence
Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.
Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category (BRIEF section 2b.5). Neither WPM nor the crypto monitor carries this field.
Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.
Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.
Suppressed by doctrine: derived risk score; derived_scores = {}.
Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-20. A year-precision row is never promoted into a tighter band.
Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 0 claim(s) (0 category placement(s)), 40 source(s) in the cumulative register.
Audit trail
Machine checkChallenged on 6 Oct 2026: nothing tested (no claim on this page was eligible for an automated test). An automated, adversarial test run by a second model; no person has assessed the result.
Strong T1 coverage (direct OPC enforcement findings/official statements) exists for regulator_and_framework, controller_processor_duties (breach notification), cross_border_and_adequacy, algorithmic_biometric_and_surveillance_governance (Clearview/RCMP), children_and_vulnerable_groups (2025 swimming-pool finding), and enforcement_and_redress (2026 Bell and X Corp/xAI findings). The single most JID-critical finding — that a First Nation band council acting in core governmental functions is treated as a FWUB under PIPEDA — is grounded in a direct OPC case (T1). lawful_processing_and_special_data and data_subject_rights rely on a mix of T1 regulator statements and T2 guidance/interpretation bulletins. sectoral_watch is uneven: the employment_data and data_access_sharing (OCAP) sub-modules are well sourced, but financial_sector_overlay, health_sector_overlay, education, insurance and credit_and_scoring sub-modules for this specific reserve community rely on T3/absent sourcing and are flagged with absent_field_provenance. adtech_and_commercial_privacy is the weakest module overall (no dedicated cookie/dark-pattern/opt-out-signal regime under PIPEDA), relying mainly on T2 guidance confirming the gap rather than T1 enactments. Reliance on T3 commentary (IAPP) is concentrated in characterizing the status and history of the defunct Bill C-27/CPPA/AIDA and the EU adequacy renewal narrative, corroborated where possible against T1/T2 OPC and regulator sources.
Unresolved questions (5):
Which specific privacy/health-information instrument (NB provincial law, Privacy Act, or an Indigenous Services Canada policy) governs on-reserve health records for Tobique First Nation members was not conclusively sourced this cycle.
Whether and when a successor bill to the defunct Bill C-27 (reviving CPPA/AIDA-style order-making powers, AMPs, erasure and portability rights) will be introduced in the current Parliament remains unresolved.
Whether OCAP® principles and the First Nations Data Governance Strategy will be given statutory force (e.g., via Privacy Act modernization or a bespoke Indigenous data-sovereignty instrument) is an open policy question being tracked by the Department of Justice and OPC.
The precise scope of PIPEDA's 'publicly available information' exception as it might apply to band membership/community records was not separately verified for this JID.
Whether the OPC's proposed enforceable 'Children's Privacy Code' will proceed, and on what timeline, following the 2025-2026 'What We Heard' consultation, remains unresolved.