#
No standing position recorded for this category.
The multi-regulator structure of this investigation, spanning the federal regulator and three provincial regulators with their own substantially similar legislative regimes, is notable as an enforcement-coordination mechanism distinct from a single regulator acting alone. It suggests that for matters involving nationwide AI-system data practices, Canadian privacy regulators are willing to coordinate formal joint investigations rather than pursue separate, potentially inconsistent, provincial and federal actions.
Whether this finding will be followed by a compliance order, further OPC proceedings, or referral to the Federal Court, which PIPEDA permits following OPC findings, had not been established this cycle. The specific remedial steps OpenAI is expected to take regarding its consent mechanisms for Canadian ChatGPT users likewise remain unconfirmed. Separately, Quebec's CAI's most recent enforcement activity under Law 25 was not independently retrieved this cycle, leaving a gap in the provincial enforcement picture alongside the federal/multi-regulator OpenAI finding.
Outlook
Follow-up developments to PIPEDA Findings #2026-002, including whether OpenAI implements changes to its consent practices for Canadian users or whether the matter proceeds to Federal Court, are the primary items to monitor arising from this cycle's enforcement activity. Independent retrieval of CAI's recent Law 25 enforcement record would fill a current gap in the provincial enforcement picture.
Enforcement & Redress
Bill C-36 proposes to establish a new Digital Safety and Data Protection Commission of Canada with binding enforcement powers against non-compliant organisations, a material departure from the Office of the Privacy Commissioner's current, more recommendation-oriented enforcement model under PIPEDA. The bill's proposed penalty ceiling, however, is reported inconsistently between contemporaneous secondary sources reviewed this cycle: one account states the figure at up to CAD 10 million or three percent of global revenue, while another states it at up to CAD 25 million or five percent of global revenue, a substantial increase in either case from PIPEDA's current maximum penalty of CAD 100,000. Neither figure has been reconciled against the bill's own text this cycle, and it is not established from the material reviewed whether the two figures describe different penalty tiers within the bill (for example, a tier for individual violations versus a tier for systemic or repeated violations) or whether one source is simply in error.
Independent of Bill C-36's still-proposed penalty structure, Quebec's Law 25 enforcement regime remains in force and continues to apply its own penalty framework: administrative monetary penalties of up to CAD 10 million or two percent of worldwide turnover, and penal fines of up to CAD 25 million or four percent of worldwide turnover, alongside a statutory-minimum private right of action set at CAD 1,000. Quebec's regime therefore already operates at a penalty scale broadly comparable to the higher of the two figures reported for Bill C-36, meaning that, depending on which Bill C-36 figure proves accurate, the federal regime may either introduce penalties below, or roughly in line with, Quebec's existing provincial ceiling.
The joint OpenAI finding issued May 6, 2026 by the Office of the Privacy Commissioner together with Quebec, British Columbia and Alberta counterparts stands as the most significant enforcement outcome of the cycle under the current, pre-C-36 framework, demonstrating that multi-regulator joint investigations remain an active enforcement mechanism available to Canadian privacy authorities notwithstanding the absence, so far, of the binding-powers Commission that Bill C-36 would create.
Outlook
Resolution of the discrepancy between the two reported Bill C-36 penalty figures against the bill's own text would materially sharpen the picture of how the new Commission's enforcement powers would compare to Quebec's existing Law 25 penalty regime; this remains unresolved as at this cycle.
1 earlier distinct update(s)
Enforcement & Redress
The Office of the Privacy Commissioner told Parliament directly, in a submission dated 14 May 2026, that under the Personal Information Protection and Electronic Documents Act as currently in force, it has no power to issue binding orders or impose administrative monetary penalties on private-sector organizations, and that it has asked Parliament for such powers — precisely the gap Bill C-36's proposed new Commission is designed to close. This structural limitation has not stopped the Office from pursuing active enforcement work within its existing powers: its 2025-26 annual report disclosed a joint investigation into TikTok, conducted together with provincial counterparts, that led to privacy-practice improvements; a new breach investigation was opened on 21 September 2026; and a notice of application was filed in Federal Court on 28 August 2026 in connection with a Google de-listing investigation. The combination illustrates an enforcement body that remains active across multiple matters while operating without the binding-order and penalty powers it has formally requested.
Outlook
The Federal Court proceeding on the Google de-listing matter and the newly opened breach investigation are the two enforcement threads most likely to produce dated developments before Bill C-36 could plausibly expand the Office's underlying powers.