--- title: "Canada Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/canada/ source_html: /jurisdictions/canada/index.html description: "Canada data protection and privacy regulation: 10 categories, 63 claims, updated 2026-11-03. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 71b61d06c66ced15b0e04e96191b120bd45263e859bf19c1a686b0c70da34e6a generator: "fe-fleet/md-twin@1.0" --- # Canada Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/canada/), [World Payments](https://payments.gi/jurisdictions/canada/), artificial-intelligence, [Advennt](https://advennt.io/jurisdictions/canada/) Last updated 2026-11-03 · 10 categories · 63 claims · 97 sources in the cumulative register Download report (PDF) Expand all Canada's federal privacy-reform track has reopened. Data collected 2026-11-02 · Data published 2026-11-03 AI-assembled from cited sources Not covered: Data Subject Rights, Cross-Border & Adequacy, AdTech & Commercial Privacy, Children & Vulnerable Groups, Enforcement & Redress. Not fully checked this cycle: Regulator & Framework, Sectoral Watch (3 open gaps). Evidence re-verified: 2026-11-03 · Position last changed: 2026-11-03 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=CANADA)[Build Report](/reports/?j=CANADA)[Compare](/compare/?j=CANADA) Framework posture Monitored baseline 0 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Office of the Privacy Commissioner of Canada Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) 2026-Q4 Draft Consumer-Driven Banking Regulations Module coverage & confidence 0 / 10 modules assessed 0 Confirmed · 0 Probable · 0 Uncertain · 10 Not yet assessed 10 Categories 0 Red categories 6 Sub-modules 63 Claims 37 Tier-1 sources Traffic-light mix 10 n/a (sums to 10 rendered categories; click to filter) No categories are currently flagged red. ## Member jurisdictions This page covers Canada federal law once. Each member’s page covers its own law, regulators and enforcement (5 of 7 members covered here). - [Alberta, Canada](/jurisdictions/alberta-canada/) - [British Columbia, Canada](/jurisdictions/british-columbia-canada/) - [New Brunswick, Canada](/jurisdictions/new-brunswick-canada/) - [Ontario, Canada](/jurisdictions/ontario-canada/) - [Quebec, Canada](/jurisdictions/quebec-canada/) ## Jurisdiction brief Jurisdiction lead brief 875 Full executive summary 203 ###### Latest update · 25 October 2026 #### Lead Signal The Office of the Privacy Commissioner of Canada launched the country's first Children's Privacy Code on 20 October 2026. The Code sets expectations for organisations handling children's personal information; it is supervisory guidance from the Commissioner rather than a binding statutory instrument, so it operates alongside the existing federal framework rather than amending it directly. Its launch marks the most concrete step yet toward a dedicated children's-data standard in Canada, ahead of any legislative codification. #### Other Developments Federal privacy-law reform remains at second reading. Bill C-36, which would enact the Protecting Privacy and Consumer Data Act, was introduced at first reading on 15 June 2026 and remains at second reading in the House of Commons. The bill would replace the Office of the Privacy Commissioner with a new Digital Safety and Data Protection Commission of Canada, housing a dedicated Privacy and Consumer Data Commissioner and Division. It is understood to propose administrative monetary penalties of up to the greater of $10 million or 3% of gross global revenue, rising to the greater of $25 million or 5% of gross global revenue for certain offences — a marked departure from the current regime, under which the Commissioner can investigate and recommend but cannot impose penalties directly. The Commissioner also weighed in on algorithmic governance. The Office published its comments to a government consultation on AI transparency on 23 October 2026, a non-binding regulatory intervention rather than a new rule, signalling the Commissioner's continuing interest in how automated systems handle personal information ahead of any dedicated AI-specific legislative framework. An enforcement matter was closed. The Commissioner closed its investigation into WestJet on 14 October 2026, stating satisfaction with the airline's enhanced security measures following a cyberattack — an outcome resolved through remediation rather than formal sanction, consistent with the Commissioner's current recommendation-based powers. #### Cross-Monitor Connections The proposed administrative-monetary-penalty regime under Bill C-36 is a development with direct relevance to financial-integrity monitoring, insofar as a materially strengthened penalty framework for personal-data mishandling would sit alongside existing financial-crime enforcement architecture administered by other federal bodies; readers tracking regulatory-penalty exposure across Canadian federal agencies should note this pending shift. The Commissioner's AI-transparency consultation comments also bear on work tracked separately under artificial-intelligence-focused regulatory monitoring, where the interaction between privacy oversight and emerging AI-governance frameworks is a live and developing area; this brief does not analyse the AI-governance dimension itself, only the privacy regulator's stated position. #### Outlook The principal item to watch is whether Bill C-36 advances beyond second reading toward committee referral; its passage would materially change Canada's enforcement architecture by introducing direct administrative monetary penalties and a new dedicated commission in place of the current Office of the Privacy Commissioner. The Children's Privacy Code, while not yet binding law, may also foreshadow the shape of any future statutory children's-data provisions should Bill C-36 or a successor instrument proceed. The WestJet investigation's closure on the basis of remediated security measures, rather than penalty, illustrates the practical limits of the Commissioner's current powers pending that reform. 3 earlier updates not shown here. ###### Standing brief · as of 28 September 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Canada's federal privacy-reform track has reopened. Following Bill C-27's death on the Order Paper at prorogation on January 6, 2025, and its non-reintroduction in its original form after the April 2025 election, federal privacy reform returned in June 2026 as Bill C-36, which proposes to replace the Personal Information Protection and Electronic Documents Act (PIPEDA) with a new Protecting Privacy and Consumer Data Act (PPCDA). This is reported at Probable confidence: the underlying source has not independently confirmed Bill C-36's legislative reading-stage status on LEGISinfo this cycle. What is established with higher confidence is the backdrop against which this reform is being read: the enforcement gaps that Bill C-27 was intended to close - the absence of order-making power and of administrative monetary penalties available to the Privacy Commissioner - remain features of the current PIPEDA regime as it stands today. #### Other Developments Regulator and framework architecture, unchanged in substance. Canada's federal private-sector privacy law continues to be PIPEDA, enforced by the Office of the Privacy Commissioner of Canada. Quebec, British Columbia and Alberta continue to operate their own "substantially similar" provincial statutes, which displace PIPEDA for intra-provincial commercial activity in those provinces. This structural feature of Canadian privacy federalism is unaffected by the Bill C-36 development and remains the baseline against which any federal reform will operate. #### Cross-Monitor Connections The enforcement-power gap this cycle's reform targets - no order-making power, no OPC-levied administrative monetary penalties - is a matter this brief notes only in its data-protection dimension. Where such gaps intersect with anti-money-laundering supervisory design or payments-sector conduct obligations, those intersections are the proper subject of the financial-integrity and world-payments monitors respectively, not analysed further here. #### Outlook The development to watch is whether Bill C-36 advances through further legislative readings toward enactment, and whether its proposed PPCDA framework would in fact close the order-making and administrative-monetary-penalty gaps that have persisted since Bill C-27's death. Confirmation of Bill C-36's precise reading-stage status on LEGISinfo would raise confidence in the reform's trajectory beyond the current Probable tier. Read full brief · 875 words Standing brief, as of 18 October 2026. #### Regulatory Status Canada's data-protection landscape this cycle is defined by the first reading of Bill C-36, the Protecting Privacy and Consumer Data Act, on June 15, 2026, which proposes to replace PIPEDA's privacy provisions with a new statute enforced by a dedicated Digital Safety and Data Protection Commission of Canada, alongside active enforcement under the current PIPEDA framework through the joint OpenAI finding issued May 6, 2026 with Quebec, British Columbia and Alberta counterparts. At the provincial level, Quebec's Law 25 regime continues active biometric-data enforcement, illustrated by a facial-recognition ruling in which the Commission d'acces a l'information retained jurisdiction and imposed ongoing semiannual reporting. The Consumer-Driven Banking Act, enacted via Bill C-15 with Royal Assent March 26, 2026, adds a sectoral open-banking dimension establishing a data-mobility right under Bank of Canada oversight. Canada continues to have no enacted federal AI-specific statute, Bill C-27's Artificial Intelligence and Data Act having failed to survive prorogation. #### Outlook Bill C-36's progress through committee, the resolution of its disputed penalty-ceiling figures, and the Bank of Canada's accreditation timetable under the Consumer-Driven Banking Act are the principal developments to track going forward; none of these was resolved within this cycle's material. Read full brief · 203 words Key regulatory facts for Canada Regulatory Dimension Canada Standing Position Jurisdiction Canada (CA) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 63 sourced findings) Primary Instruments Cited Office of the Privacy Commissioner of Canada, Cookie Script, Parliament of Canada, baseline.quebec, Osler, Hoskin & Harcourt LLP Last Confirmed / Updated 2026-11-03 (97 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Canada: D1 Regulator & Framework 11 claims Not assessed ▾ No standing position recorded for this category. #### Sub-modules (2) #### Regulator And AuthorityNot assessed No narrative recorded for this sub-module. Claims (2): - PIPEDA applies except where: PIPEDA applies to private-sector organisations except where a province has 'substantially similar' legislation; Quebec, British Columbia and Alberta are recognised as such. - Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, was introduced at first reading 15 June 2026 and remains at second reading in the House of Commons; it would replace the OPC with a new Digital Safety and Data Protection Commission of Canada housing a dedicated Privacy and Consumer Data Commissioner and Division. #### Act And InstrumentsNot assessed No narrative recorded for this sub-module. Claims (5): - Bill C-36 (Protecting Privacy and Consumer Data Act) introduced: Bill C-36 was introduced 15 June 2026 as a focused privacy/consumer-data bill, unbundling AI regulation (AIDA) from the privacy-reform package that Bill C-27 had combined before it died on the Order Paper at the 6 January 2025 prorogation. - Bill C-36 (Protecting Privacy and Consumer Data Act) — Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act (PPCDA), received first reading in the House of Commons on June 15, 2026; if enacted it would repeal the privacy provisions of PIPEDA and transfer private-sector enforcement to a new Digital Safety and Data Protection Commission of Canada - Bill C-36 (Protecting Privacy and Consumer Data Act) — Tabled at first reading 15 June 2026; drops AIDA entirely; proposes a new Digital Safety and Data Protection Commission of Canada with order-making and AMP powers to replace OPC's private-sector role. - Bill C-36 (Protecting Privacy and Consumer Data Act) — was introduced at first reading to repeal PIPEDA Part 1 and create the Digital Safety and Data Protection Commission of Canada: true - PIPEDA / Bill C-27 (died) / Bill C-36 — Federal reform of PIPEDA (Bill C-27) died on the Order Paper on 6 January 2025 when Parliament was prorogued; a successor, Bill C-36 (Protecting Privacy and Consumer Data Act), was introduced 15 June 2026 and remains at an early legislative stage; PIPEDA (2000) continues as the operative federal statute with no administrative-penalty regime for ordinary contraventions. #### Regulator & Framework Canada's federal private-sector privacy regime remains anchored in PIPEDA, enforced by the Office of the Privacy Commissioner of Canada, with Quebec, British Columbia and Alberta operating their own provincial statutes deemed "substantially similar" and which displace PIPEDA for intra-provincial commercial activity. This multi-layered architecture is unchanged as a structural matter this cycle. What has changed is the reform trajectory sitting above this baseline. Bill C-27, which had contained the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act, died on the Order Paper at prorogation on January 6, 2025, and was not reintroduced in its original form after the April 2025 general election. Federal privacy reform has now returned, reported in June 2026 as Bill C-36, proposing to replace PIPEDA outright with a new Protecting Privacy and Consumer Data Act. This is reported at Probable confidence; the bill's precise legislative reading-stage status has not been independently confirmed against LEGISinfo this cycle. The context in which this reform proposal is being read is a set of enforcement gaps that have persisted since Bill C-27's death: the Privacy Commissioner continues to lack order-making power and the ability to levy administrative monetary penalties directly, gaps that C-27 had been designed to close and which a successor bill would presumably need to address again. #### Outlook Watch for Bill C-36's progress through further legislative readings and for independent confirmation of its reading-stage status on LEGISinfo. Whether a revived reform effort can close the order-making and AMP enforcement gaps that outlived Bill C-27 will be the central substantive question as this bill advances. Read full narrative · 270 words Periodic update · new data 2026-10-25 #### Regulator & Framework Bill C-36, which would enact the Protecting Privacy and Consumer Data Act, was introduced at first reading in the House of Commons on 15 June 2026 and remains at second reading; no committee referral or further-reading movement has been identified. The bill's central institutional change would replace the Office of the Privacy Commissioner of Canada with a new Digital Safety and Data Protection Commission of Canada, housing a dedicated Privacy and Consumer Data Commissioner and Division. This would represent the most significant restructuring of Canada's federal privacy-regulatory architecture since the current Office was established, moving the regulator from a recommendation-based ombudsman model toward one with direct enforcement powers, discussed further under enforcement. The bill's progress to date has been slow: more than four months have passed since first reading without a confirmed move to the next legislative stage. Its eventual passage, amendment, or lapse would be the single most consequential variable in Canada's federal privacy-regulatory trajectory, given the scale of institutional and enforcement change it proposes relative to the current Personal Information Protection and Electronic Documents Act framework that the Office of the Privacy Commissioner presently administers. #### Outlook Whether Bill C-36 moves from second reading to committee referral is the key development to track. Any committee amendments to the proposed Digital Safety and Data Protection Commission's structure or mandate would materially affect how the new enforcement and penalty provisions, addressed separately under enforcement and redress, would ultimately operate in practice. 3 earlier distinct update(s) Periodic update · new data 2026-10-18 #### Regulator & Framework The central development in Canada's data-protection framework this cycle is the first reading of Bill C-36, the Protecting Privacy and Consumer Data Act, in the House of Commons on June 15, 2026. As introduced, the bill would enact the Protecting Privacy and Consumer Data Act to govern the protection of personal information while taking into account the needs of organisations, and it would repeal the privacy provisions currently found in the Personal Information Protection and Electronic Documents Act. In place of the Office of the Privacy Commissioner's current enforcement role under PIPEDA, the bill proposes a new Digital Safety and Data Protection Commission of Canada, a dedicated enforcement body with powers to issue binding orders against non-compliant organisations. This is a proposed instrument, not yet enacted, and its first-reading status means its provisions remain subject to committee review, amendment and further readings before any final form is settled. The scale of the proposed change, however, is substantial on its face: a shift from PIPEDA's current enforcement model, which relies on the Privacy Commissioner's recommendation-based powers with limited direct penalty authority, to a dedicated Commission with binding enforcement powers would represent the most significant architectural change to Canadian federal private-sector privacy law since PIPEDA's original enactment. The bill's introduction does not alter the current operative framework. PIPEDA remains in force in its existing form, and the Office of the Privacy Commissioner continues to exercise its existing powers, including the capacity demonstrated this cycle through its joint investigation of OpenAI, while Bill C-36 proceeds through the legislative process. Organisations operating in Canada should therefore treat the current PIPEDA framework, including the Privacy Commissioner's existing oversight role, as the operative regime, with Bill C-36 representing a proposed future state rather than a present obligation. #### Outlook The pace and outcome of Bill C-36's passage through committee and subsequent House and Senate readings will determine when, and in what final form, the Digital Safety and Data Protection Commission comes into existence and PIPEDA's privacy provisions are repealed. As at this cycle, the bill has passed only first reading, and no committee timetable was located in the material reviewed. Periodic update · new data 2026-10-11 #### Regulator & Framework Canada's federal privacy-framework reform advanced procedurally this cycle with the first reading of Bill C-36, the Protecting Privacy and Consumer Data Act, on 15 June 2026. The bill drops the Artificial Intelligence and Data Act entirely and proposes a new Digital Safety and Data Protection Commission of Canada, carrying order-making and administrative-monetary-penalty powers that would take over the private-sector enforcement role currently held by the Office of the Privacy Commissioner under the Personal Information Protection and Electronic Documents Act. The Privacy Commissioner has publicly welcomed several of the bill's features, including its recognition of privacy as a fundamental right, its best-interests-of-the-child provisions, its mandatory privacy-impact-assessment requirements and its stronger enforcement powers, while also noting that the bill would transfer private-sector oversight responsibilities away from the Office itself to the new Commission. As of 11 October 2026, the bill remains at first reading with no committee or passage activity recorded. #### Outlook The bill's progress through committee stage is the development most likely to determine the shape of Canada's private-sector privacy enforcement over the coming year; its proposed Commission, if enacted, would mark a structural departure from the current OPC-centred model. Periodic update · new data 2026-10-04 #### Regulator & Framework Canada's federal private-sector privacy framework remains anchored in PIPEDA, which applies except where a province has enacted substantially similar legislation, with Quebec, British Columbia and Alberta recognised as meeting that standard. This jurisdictional-scope rule continues to define the practical division of regulatory authority between the federal Office of the Privacy Commissioner and the recognised provincial regulators. On 15 June 2026 the federal government introduced Bill C-36, the Protecting Privacy and Consumer Data Act, as the successor to Bill C-27, which died on the Order Paper when Parliament prorogued on 6 January 2025. The most structurally significant feature of Bill C-36 is understood to be what it does not contain: whereas Bill C-27 had combined privacy reform with the Artificial Intelligence and Data Act in a single package, Bill C-36 addresses only privacy and consumer-data matters, leaving AIDA, and AI governance generally, without any legislative successor. This is reported as a deliberate unbundling rather than an oversight, separating the comparatively more settled privacy-reform agenda from the more contested AI-governance debate. Whether Bill C-36 has progressed past first reading since its 15 June 2026 introduction had not been independently established this cycle. The bill's introduction nonetheless represents the most concrete sign of continued federal legislative activity on private-sector privacy reform since the C-27 prorogation, and its privacy-only scope is understood to reduce at least one source of legislative complexity, AI-governance controversy, that had previously slowed the combined package's progress. #### Outlook The pace of Bill C-36's progress through Parliament is the central open question for Canada's federal privacy-framework trajectory. Its unbundled, privacy-only scope may improve its prospects relative to the combined C-27 package, though no committee-stage or second-reading developments had been established this cycle. The continued absence of a legislative vehicle for AI-specific governance means that, for the foreseeable future, AI-adjacent personal-information practices will likely continue to be addressed through general-purpose PIPEDA tools rather than dedicated AI law. Sources and claims (11) - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/) — PIPEDA applies except where: PIPEDA applies to private-sector organisations except where a province has 'substantially similar' legislation; Quebec, British Columbia and Alberta are recognised as such. - [Cookie Script](https://cookie-script.com/privacy-laws/bill-c27) — Bill C-36 (Protecting Privacy and Consumer Data Act) introduced: Bill C-36 was introduced 15 June 2026 as a focused privacy/consumer-data bill, unbundling AI regulation (AIDA) from the privacy-reform package that Bill C-27 had combined before it died on the Order Paper at the 6 January 2025 prorogation. - [Parliament of Canada](https://www.parl.ca/DocumentViewer/en/45-1/bill/C-36/first-reading) — Bill C-36 (Protecting Privacy and Consumer Data Act) — Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act (PPCDA), received first reading in the House of Commons on June 15, 2026; if enacted it would repeal the privacy provisions of PIPEDA and transfer private-sector enforcement to a new Digital Safety and Data Protection Commission of Canada - [baseline.quebec](https://baseline.quebec/en/news/bill-c-36/) — Bill C-36 (Protecting Privacy and Consumer Data Act) — Tabled at first reading 15 June 2026; drops AIDA entirely; proposes a new Digital Safety and Data Protection Commission of Canada with order-making and AMP powers to replace OPC's private-sector role. - [Osler, Hoskin & Harcourt LLP](https://www.osler.com/en/insights/reports/the-protecting-privacy-and-consumer-data-act-bill-c-36-key-obligations-and-enforcement-overview/) — Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, was introduced at first reading 15 June 2026 and remains at second reading in the House of Commons; it would replace the OPC with a new Digital Safety and Data Protection Commission of Canada housing a dedicated Privacy and Consumer Data Commissioner and Division. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/02_05_d_15/) — Personal Information Protection and Electronic Documents Act — governs collection, use and disclosure of personal information by private-sector organisations in commercial activity: true - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/02_05_d_15/) — Privacy Act — covers how federal government institutions handle personal information: true - [Parliament of Canada (LEGISinfo)](https://www.parl.ca/legisinfo/en/bill/45-1/c-36) — Bill C-36 (Protecting Privacy and Consumer Data Act) — was introduced at first reading to repeal PIPEDA Part 1 and create the Digital Safety and Data Protection Commission of Canada: true - [BCLP](https://www.bclplaw.com/en-US/events-insights-news/quebec-law-no-25-a-little-known-privacy-law-with-a-big-reach.html) — Act respecting the protection of personal information in the private sector (Quebec, as amended by Law 25) — applies to every person carrying on an enterprise in Quebec, with extraterritorial reach to organisations outside Quebec processing personal information of Quebec individuals, with no minimum volume/revenue threshold: true - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/gd_53_201805/) — PIPEDA — An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances (s.5(3)), applied via a four-part OPC test alongside, not instead of, consent. - [offlist.me](https://www.offlist.me/what-is-pipeda) — PIPEDA / Bill C-27 (died) / Bill C-36 — Federal reform of PIPEDA (Bill C-27) died on the Order Paper on 6 January 2025 when Parliament was prorogued; a successor, Bill C-36 (Protecting Privacy and Consumer Data Act), was introduced 15 June 2026 and remains at an early legislative stage; PIPEDA (2000) continues as the operative federal statute with no administrative-penalty regime for ordinary contraventions. ### Canada: D2 Lawful Processing & Special Data 3 claims Not assessed ▾ No standing position recorded for this category. #### Sub-modules (1) #### Lawful BasesNot assessed No narrative recorded for this sub-module. Claims (3): - PIPEDA imposes: PIPEDA s.5(3) imposes an appropriate-purposes test independent of consent, applied by the OPC in its May 2026 joint investigation of OpenAI's ChatGPT. - PIPEDA s.5(3) imposes an appropriate-purposes test independent of consent, applied by the OPC in its May 2026 joint investigation of OpenAI's ChatGPT. - Quebec Private Sector Act s.9.1 — full lifecycle scope confirmed by CAI #### Lawful Processing & Special Data Quebec's Commission d'acces a l'information continues to apply a necessity-and-proportionality analysis to the processing of biometric data under Law 25, an approach most recently illustrated in a facial-recognition ruling concerning retail-sector use of the technology. In that matter, the Commission retained jurisdiction over the organisation involved and imposed a semiannual reporting obligation running for two years, together with an express reservation of the right to revisit its conclusion during that period. This is a standing feature of Quebec's biometric-data enforcement posture: rather than issuing a one-off finding and closing the file, the Commission has adopted an ongoing-supervision model for at least this category of biometric processing, allowing it to monitor compliance and reassess its own conclusion as circumstances develop. At the federal level, Bill C-36 as introduced would, if enacted, propose to treat de-identified information as personal information for certain purposes, a position that would narrow the current PIPEDA-era distinction between personal information and de-identified or anonymised data. This proposed treatment has direct relevance to any organisation currently relying on de-identification as a basis for processing data outside PIPEDA's personal-information perimeter, since Bill C-36's approach would, on its face, bring at least some de-identified datasets back within scope. The practical effect of these two developments operating at different levels of government is that organisations handling biometric or de-identified data in Canada face a lawful-processing landscape that varies by province in its current operative state (Quebec's active necessity-and-proportionality enforcement under Law 25) while also facing a federal proposal (Bill C-36's de-identified-information treatment) that has not yet been enacted and would, if passed, apply nationally alongside or in place of Quebec's existing provincial regime. #### Outlook Whether the Commission d'acces a l'information's ongoing-supervision model for biometric processing becomes a template applied to future Quebec enforcement matters, and whether Bill C-36's de-identified-information provision survives committee review in its current form, are both open questions this cycle's material does not resolve. Read full narrative · 321 words No periodic updates recorded in this cycle Sources and claims (3) - [billc27.ca](https://billc27.ca/) — PIPEDA imposes: PIPEDA s.5(3) imposes an appropriate-purposes test independent of consent, applied by the OPC in its May 2026 joint investigation of OpenAI's ChatGPT. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/opc-news/news-and-announcements/) — PIPEDA s.5(3) imposes an appropriate-purposes test independent of consent, applied by the OPC in its May 2026 joint investigation of OpenAI's ChatGPT. - [Gowling WLG](https://gowlingwlg.com/en/insights-resources/articles/2026/practical-compliance-guide-ai-developers) — Quebec Private Sector Act s.9.1 — full lifecycle scope confirmed by CAI ### Canada: D3 Data Subject Rights Not assessed ▾ No standing position recorded for this category. #### Data Subject Rights Bill C-36, as introduced at first reading on June 15, 2026, proposes a new deletion right for individuals that would extend to AI-generated content, allowing a person to request that an organisation delete personal data including AI deepfakes depicting them. This is a notable extension of the deletion-right concept beyond data an individual originally supplied or that was collected about them in the conventional sense, reaching instead into synthetically generated content that uses or depicts their personal information or likeness. Separately, and operating under a different legislative vehicle, the Budget 2025 Implementation Act has begun operationalising a data-mobility right within the existing Personal Information Protection and Electronic Documents Act framework, intended to facilitate economy-wide data sharing. This data-mobility right is connected to, though distinct from, the Consumer-Driven Banking Act's open-banking data-access framework: the PIPEDA-level mobility right provides the general data-protection law basis, while the Consumer-Driven Banking Act provides the sector-specific implementing structure for the financial-services context specifically. Both developments point toward an expansion of individual data-subject rights in Canada beyond PIPEDA's current baseline, which does not include an explicit, general-purpose data-portability or deletion right of the scope now proposed. Bill C-36's deepfake-deletion right remains proposed rather than in force, while the data-mobility right's operationalisation under the Budget 2025 Implementation Act appears to be further along, tied as it is to the enacted Consumer-Driven Banking Act framework, though the precise state of the mobility right's own implementation timeline was not independently confirmed against primary legislative text this cycle. #### Outlook The deepfake-deletion right's fate depends entirely on Bill C-36's passage; the data-mobility right's practical availability to individuals depends on the Consumer-Driven Banking Act's own implementing regulations and the Bank of Canada's accreditation timetable for participating entities, neither of which was confirmed as finalised this cycle. Read full narrative · 296 words No periodic updates recorded in this cycle Sources and claims (2) - [Recording Law](https://www.recordinglaw.com/canada/privacy/pipeda-explained/) — PIPEDA was amended in March 2026 to add a data-mobility (portability) framework linked to the open-banking build-out, but the new right is not yet in force as at the run date. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda-complaints-and-enforcement-process/federal-court-applications-under-pipeda/) — PIPEDA s.14 — one-year right to apply to Federal Court ### Canada: D4 Controller/Processor Duties 7 claims Not assessed ▾ No standing position recorded for this category. #### Sub-modules (1) #### Accountability And DpiaNot assessed No narrative recorded for this sub-module. Claims (2): - Office of the Privacy Commissioner of Canada released guidance: On 10 September 2026 the OPC released draft guidance to help PIPEDA-regulated organisations assess the privacy practices of prospective third-party service providers before procurement. - Office of the Privacy Commissioner of Canada — On 10 September 2026 the OPC released draft guidance to help PIPEDA-regulated organisations assess the privacy practices of prospective third-party service providers before procurement. #### Controller/Processor Duties On 10 September 2026 the Office of the Privacy Commissioner of Canada released draft guidance aimed at helping PIPEDA-regulated organisations assess the privacy practices of prospective third-party service providers before procurement. The guidance is reported as draft and non-binding, meaning it does not itself create new statutory obligations but is understood to elaborate on accountability expectations already embedded in PIPEDA's existing principles, particularly around an organisation's responsibility for personal information it transfers to third parties for processing. This guidance is understood to respond to a practical compliance gap: organisations subject to PIPEDA's accountability principle remain responsible for personal information in the hands of third-party processors, but PIPEDA itself provides limited granular direction on how to conduct pre-procurement privacy due diligence. The OPC's draft guidance is reported as intended to fill that gap with practical assessment criteria, though its specific content, beyond the general purpose of helping organisations evaluate prospective providers, has not been independently detailed this cycle. For organisations currently engaging or renewing third-party service-provider relationships involving personal information, the draft guidance signals that the OPC views pre-procurement privacy assessment as an increasingly important component of PIPEDA accountability compliance, even though the guidance remains non-binding and draft in status. #### Outlook Whether the OPC's draft guidance progresses to final, binding-in-effect status, and what specific assessment criteria it ultimately contains, remain open questions not resolved this cycle. Organisations with significant third-party data-processing arrangements are understood to be a natural audience for monitoring the guidance's finalisation, given its direct relevance to existing PIPEDA accountability obligations. Read full narrative · 254 words No periodic updates recorded in this cycle Sources and claims (7) - [ThinSky](https://thinsky.com/privacy-law-canada/cppa-bill-c27-status/) — Office of the Privacy Commissioner of Canada released guidance: On 10 September 2026 the OPC released draft guidance to help PIPEDA-regulated organisations assess the privacy practices of prospective third-party service providers before procurement. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/about-the-opc/) — Office of the Privacy Commissioner of Canada — On 10 September 2026 the OPC released draft guidance to help PIPEDA-regulated organisations assess the privacy practices of prospective third-party service providers before procurement. - [McCarthy Tétrault](https://www.mccarthy.ca/en/insights/blogs/techlex/sweeping-privacy-reform-comes-force-quebec) — Act respecting the protection of personal information in the private sector (Quebec, as amended by Law 25) — requires an organisation to inform individuals when a decision about them is rendered exclusively through automated processing, and to provide reasons and a review route on request: true - [Justice Laws Website (Government of Canada)](https://laws-lois.justice.gc.ca/eng/acts/p-8.6/page-3.html) — Personal Information Protection and Electronic Documents Act — requires an organisation to report to the Commissioner any breach of security safeguards creating a real risk of significant harm: true - [Quebec Official Publisher (LegisQuébec)](https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1%20/20230630) — Act respecting the protection of personal information in the private sector (Quebec, as amended by Law 25) — requires an organisation to promptly notify the CAI of a confidentiality incident presenting a risk of serious injury: true - [Quebec Official Publisher (LegisQuébec)](https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1%20/20230630) — Act respecting the protection of personal information in the private sector (Quebec) — If a confidentiality incident presents a risk of serious injury, the enterprise must promptly notify the CAI and every affected individual; no fixed 72-hour deadline applies, unlike GDPR. - [Canada Gazette](https://gazette.gc.ca/rp-pr/p2/2018/2018-04-18/html/sor-dors64-eng.html) — PIPEDA s.10.1 — RROSH reporting duty ### Canada: D5 Cross-Border & Adequacy Not assessed ▾ No standing position recorded for this category. Absence reason not determinable No narrative exists and the JID records no gap or review marker explaining why. The renderer will not invent a reason. Sources and claims (2) - [Fasken](https://www.fasken.com/en/knowledge/2019/05/van-the-quebec-private-sector-privacy-act) — Personal Information Protection and Electronic Documents Act — extends to organizations outside Canada where their activities have a real and substantial connection to Canada, though the statute is silent on territorial scope on its face: true - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ab_20240924/is_ab_20240924/) — Commission Decision 2002/2/EC (EU adequacy decision for Canada) — On 15 January 2024 the European Commission completed its first review of the 2002 Canada adequacy decision and concluded Canada continues to provide adequate protection under the GDPR, with no fixed expiry but ongoing monitoring. ### Canada: D6 Sectoral Watch 6 claims Not assessed ▾ No standing position recorded for this category. #### Sub-modules (1) #### Data Access SharingNot assessed No narrative recorded for this sub-module. Claims (3): - OpenAI OpCo, LLC found non compliant: The OPC, Quebec's CAI, and the BC and Alberta privacy commissioners jointly investigated OpenAI OpCo LLC (PIPEDA Findings #2026-002), finding that appropriate purposes existed for ChatGPT's development but that valid consent was not obtained for certain collection, use and disclosure of personal information. - OpenAI OpCo, LLC — The OPC, Quebec's CAI, and the BC and Alberta privacy commissioners jointly investigated OpenAI OpCo LLC (PIPEDA Findings #2026-002), finding that appropriate purposes existed for ChatGPT's development but that valid consent was not obtained for certain collection, use and disclosure of personal information. - Bill C-15 (Royal Assent March 26, 2026) repealed the original 2024 Consumer-Driven Banking Act and replaced it with a comprehensive new Consumer-Driven Banking Act establishing Canada's open-banking framework, with the Bank of Canada as lead regulator overseeing accreditation and supervision of participating entities #### Sectoral Watch The Office of the Privacy Commissioner of Canada, together with Quebec's Commission d'acces a l'information, and the British Columbia and Alberta privacy commissioners, jointly investigated OpenAI OpCo, LLC's ChatGPT service. The joint findings, PIPEDA Findings #2026-002, concluded that appropriate purposes existed under PIPEDA's section 5(3) test for ChatGPT's development, but that valid consent was not obtained for certain collection, use and disclosure of personal information. This is a Tier-1 primary-source finding directly from the OPC's own publication, giving it a stronger evidentiary basis than most other developments in this cycle's Canadian privacy coverage. The joint, multi-regulator character of the investigation is itself notable: coordination across the federal OPC and three provincial regulators on a single AI-adjacent matter illustrates an emerging pattern of cross-sectoral regulatory cooperation specifically targeted at large-scale AI systems processing personal information, rather than each regulator acting independently on its own jurisdictional slice. This coordination pattern is understood to reflect the practical reality that AI systems such as ChatGPT operate across provincial boundaries, making siloed single-regulator investigation less effective for assessing nationwide data practices. The finding that appropriate purposes existed, but that valid consent was lacking for certain processing, draws a specific legal line: PIPEDA's dual test of purpose-appropriateness and consent-validity operates independently, and an AI developer may satisfy one prong while failing the other. This distinction is understood to be directly relevant to other AI developers and deployers handling Canadian personal information, as it signals which specific PIPEDA requirement, consent mechanics rather than purpose-legitimacy, was found deficient in this instance. #### Outlook The practical remedial steps OpenAI is expected to take in response to the PIPEDA Findings #2026-002, including any changes to consent mechanisms for ChatGPT's Canadian users, had not been established this cycle. This joint investigation is understood to be a likely reference point for how the OPC and provincial regulators coordinate on future AI-system investigations involving personal information across Canadian jurisdictions. Read full narrative · 317 words Periodic update · new data 2026-10-18 #### Sectoral Watch Canada's open-banking framework reached a significant milestone with the Royal Assent of Bill C-15 on March 26, 2026, which repealed the original Consumer-Driven Banking Act enacted in 2024 and replaced it with a comprehensive new Consumer-Driven Banking Act. Division 9 of Part 5 of Bill C-15 carries out this repeal-and-replace, establishing the Bank of Canada as the lead regulator responsible for accreditation and supervision of entities participating in the open-banking ecosystem. This is a structural, architecture-level development: Canada now has a second-generation open-banking statute in place of its original 2024 framework, with a named lead regulator and an accreditation-and-supervision model built into the statute itself. The Act's data-protection dimension lies in its establishment of a data-mobility right situated within the Personal Information Protection and Electronic Documents Act, intended to facilitate economy-wide data sharing rather than being confined to the banking sector alone in its underlying legal basis, even though its initial implementing focus is the financial-services open-banking context. This sectoral development therefore sits at the boundary between data-protection law proper and financial-services market-access regulation, with the Consumer-Driven Banking Act providing the sector-specific implementing mechanism for a more general PIPEDA-level right. Draft Consumer-Driven Banking Regulations reported in commentary following the Act's passage would, among other operational requirements, require participating entities to maintain a minimum monthly API uptime standard, make a substantial period of transaction history available to accredited third parties, and renew customer consent on a recurring basis rather than treating consent as a one-time event. These operational requirements, while reported in secondary commentary rather than confirmed against the regulations' own text this cycle, illustrate the kind of granular, consent-renewal-oriented compliance obligations that are likely to accompany the Act's eventual full implementation. #### Outlook The Consumer-Driven Banking Act's practical effect on data sharing depends on the Bank of Canada's accreditation process for participating entities and on the finalisation of the Consumer-Driven Banking Regulations, including the reported API-uptime, transaction-history and consent-renewal requirements, none of which were confirmed as finalised against primary regulatory text this cycle. 1 earlier distinct update(s) Periodic update · new data 2026-10-11 #### Sectoral Watch The Department of Finance pre-published draft Consumer-Driven Banking Regulations in the Canada Gazette on 27 June 2026, opening a sixty-day comment period that closed on 26 August 2026. The Office of the Privacy Commissioner filed formal comments on that same closing date, giving the privacy regulator a direct, documented role in shaping the financial-data-sharing framework before it is finalised. A staggered commencement has been proposed, beginning with accreditation requirements rather than full operational rollout. This is an active rulemaking in which the privacy regulator is a formal participant rather than an after-the-fact commentator, distinguishing it from the more passive sectoral-watch postures typical of other financial-data frameworks. #### Outlook The finalised regulations, once published, will be the first concrete indication of how far the Department of Finance has incorporated the Privacy Commissioner's formal comments of 26 August 2026, particularly regarding the staggered, accreditation-first commencement structure. Sources and claims (6) - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-002-overview/) — OpenAI OpCo, LLC found non compliant: The OPC, Quebec's CAI, and the BC and Alberta privacy commissioners jointly investigated OpenAI OpCo LLC (PIPEDA Findings #2026-002), finding that appropriate purposes existed for ChatGPT's development but that valid consent was not obtained for certain collection, use and disclosure of personal information. - [Gowling WLG](https://gowlingwlg.com/en/insights-resources/articles/2026/understanding-bill-c36) — OpenAI OpCo, LLC — The OPC, Quebec's CAI, and the BC and Alberta privacy commissioners jointly investigated OpenAI OpCo LLC (PIPEDA Findings #2026-002), finding that appropriate purposes existed for ChatGPT's development but that valid consent was not obtained for certain collection, use and disclosure of personal information. - [Open Banking Expo](https://www.openbankingexpo.com/news/canadas-proposed-consumer-driven-banking-regulations-what-do-we-know/) — Draft Consumer-Driven Banking Regulations — Department of Finance pre-published draft regulations in the Canada Gazette 27 June 2026, 60-day comment period closed 26 August 2026; OPC filed formal comments 26 August 2026; staggered commencement proposed beginning with accreditation. - [DLA Piper](https://www.dlapiper.com/en-pl/insights/publications/2026/04/the-new-consumer-driven-banking-act-explained) — Bill C-15 (Royal Assent March 26, 2026) repealed the original 2024 Consumer-Driven Banking Act and replaced it with a comprehensive new Consumer-Driven Banking Act establishing Canada's open-banking framework, with the Bank of Canada as lead regulator overseeing accreditation and supervision of participating entities - [Facephi](https://facephi.com/observatory/en/open-banking-canada-real-time-payments-2026/) — Consumer-Driven Banking Act (as re-enacted by Bill C-15) — Bill C-15 (Budget Implementation Act 2025 No.2) received Royal Assent on 26 March 2026, repealing and re-enacting the Consumer-Driven Banking Act, moving supervision of all participants from the FCAC to the Bank of Canada, and expressly prohibiting screen scraping. - [Canadian Radio-television and Telecommunications Commission](https://crtc.gc.ca/eng/com500/faq500.htm) — CASL s.8 consent regime; penalties up to $1M individual / $10M corporate per violation ### Canada: D7 AdTech & Commercial Privacy ▾ No standing position recorded for this category. Absence reason not determinable No narrative exists and the JID records no gap or review marker explaining why. The renderer will not invent a reason. ### Canada: D8 Algorithmic, Biometric & Surveillance Governance 10 claims Not assessed ▾ No standing position recorded for this category. #### Sub-modules (1) #### Ai Risk AssessmentsNot assessed No narrative recorded for this sub-module. Claims (3): - Artificial Intelligence and Data Act (AIDA) has no successor: AIDA, the AI-governance component of the former Bill C-27, has no legislative successor: Bill C-36 (PPCDA), introduced 15 June 2026, addresses only privacy and consumer data, not AI regulation. - The Office of the Privacy Commissioner of Canada published its comments to a government consultation on AI transparency on 23 October 2026. - OpenAI OpCo, LLC — The joint OPC/CAI/OIPC-BC/OIPC-AB investigation (PIPEDA Findings #2026-002, May 6, 2026) found that OpenAI's manner of collecting personal information from publicly accessible websites and licensed third-party sources to train its models was 'overbroad and therefore inappropriate' given the scale, nature and sensitivity of the data collected and used #### Algorithmic, Biometric & Surveillance Governance The Artificial Intelligence and Data Act, the AI-governance component of the former Bill C-27, has no legislative successor. Bill C-36, the Protecting Privacy and Consumer Data Act, introduced 15 June 2026, addresses only privacy and consumer-data matters, not AI regulation. This is a negative finding of direct significance: Canada currently has no dedicated federal AI-governance statute moving through the legislative process, a materially different position from the one that existed while AIDA was bundled into Bill C-27 prior to the January 2025 prorogation. In the continued absence of dedicated AI-governance legislation, AI-adjacent personal-information practices in Canada are understood to be addressed through existing general-purpose privacy law. The joint OPC/CAI/BC/Alberta investigation into OpenAI's ChatGPT service, applying PIPEDA's section 5(3) appropriate-purposes test and finding a consent deficiency, illustrates this: Canadian privacy regulators are applying established PIPEDA tools to AI-system data practices rather than waiting for dedicated AI legislation that currently has no clear path forward. This gap is understood to leave algorithmic accountability, biometric processing, and automated-decision-making oversight in Canada dependent on the general adequacy of PIPEDA's existing principles for these more specialised contexts, a dependency that commentary suggests may become more strained as AI systems' scale and complexity increase, though no specific statutory gap beyond the absence of a dedicated AI statute has been identified this cycle. #### Outlook Whether any future legislative vehicle for AI-specific governance will be introduced, and on what timeline, is not established. For the foreseeable period, AI-adjacent personal-information practices in Canada are understood to remain governed through the application of general PIPEDA principles, as demonstrated by the joint OpenAI/ChatGPT investigation, rather than through dedicated algorithmic-governance statute. Read full narrative · 274 words Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance The Office of the Privacy Commissioner of Canada published its comments to a government consultation on AI transparency on 23 October 2026. This is a non-binding regulatory intervention — the Commissioner's own submitted view into an ongoing government process — rather than a new rule or binding guidance document in itself. It nonetheless signals that the privacy regulator continues to engage actively with AI-governance policy development ahead of any dedicated federal AI-specific legislative framework being enacted. No further detail on the substance of the Commissioner's comments, nor on the government consultation's own scope or timeline, was established. The development should be read as evidence of continuing regulatory attention to algorithmic systems' handling of personal information, rather than as a change to any binding obligation currently in force. #### Outlook The substantive content of the Office's AI-transparency comments, and the government consultation's eventual outcome, are open items for a future cycle. Any resulting legislative or regulatory product from this consultation would be the next material development to track in this area. 2 earlier distinct update(s) Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance The Office of the Privacy Commissioner of Canada, together with Quebec's Commission d'acces a l'information and the privacy regulators of British Columbia and Alberta, published a joint finding on May 6, 2026 concerning OpenAI OpCo, LLC. The finding, published as PIPEDA Findings number 2026-002, concluded that the manner in which OpenAI initially collected personal information from publicly accessible websites and licensed third-party sources to train its models was overbroad and therefore inappropriate, given the scale, nature and sensitivity of the data collected and used. This is a Confirmed, in-force finding from Canada's primary federal privacy regulator acting jointly with three provincial counterparts, representing one of the more significant AI-training-data enforcement actions issued by a Canadian privacy authority to date. The joint and multi-regulator nature of the finding is itself notable: it reflects coordinated action across the federal regulator and three provincial regulators with their own independent statutory mandates, rather than a single regulator acting alone, suggesting a degree of cross-jurisdictional alignment on how AI-training-data collection practices should be assessed under Canada's various privacy statutes. This enforcement activity occurs against the backdrop of Canada's continued absence of an enacted, federal AI-specific statute. Bill C-27, which would have enacted the Artificial Intelligence and Data Act, spent over two years in committee review and never reached a final vote, dying when the bill did not survive prorogation. Canada's AI-related privacy enforcement, including the OpenAI finding, therefore currently proceeds entirely under existing general-purpose privacy statutes, PIPEDA at the federal level and Law 25 and equivalent provincial statutes, rather than under any AI-specific legal framework, since no enacted replacement for the Artificial Intelligence and Data Act exists as at this cycle. #### Outlook Whether the joint OpenAI finding's overbroad-collection standard becomes a template applied to other AI-training-data investigations by Canadian privacy regulators, and whether any federal AI-specific statute re-emerges following Bill C-27's failure to pass, both remain open questions not resolved by this cycle's material. Periodic update · new data 2026-10-11 #### Algorithmic, Biometric & Surveillance Governance The Artificial Intelligence and Data Act is confirmed dead rather than merely paused: it died along with the remainder of Bill C-27 at prorogation on 5 and 6 January 2025 and has not been reintroduced in any form. Bill C-36, Canada's current federal privacy-reform vehicle, does not revive a standalone AI statute; instead, it confines AI-adjacent oversight to automated-decision-making transparency provisions within the proposed successor privacy law. This means Canada's algorithmic-governance landscape, for the foreseeable term, will be shaped through general privacy legislation's automated-decision-making transparency requirements rather than through dedicated AI-specific rules, a materially narrower scope than AIDA would have provided. #### Outlook Whether Bill C-36's automated-decision-making transparency provisions prove adequate to the governance gap AIDA's death leaves behind will likely become clearer only once the bill progresses beyond first reading and its specific transparency obligations are tested against real automated-decision-making deployments. Sources and claims (10) - [Cookie Script](https://cookie-script.com/privacy-laws/bill-c27) — Artificial Intelligence and Data Act (AIDA) has no successor: AIDA, the AI-governance component of the former Bill C-27, has no legislative successor: Bill C-36 (PPCDA), introduced 15 June 2026, addresses only privacy and consumer data, not AI regulation. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/opc-news/news-and-announcements/) — The Office of the Privacy Commissioner of Canada published its comments to a government consultation on AI transparency on 23 October 2026. - [Resemble AI](https://www.resemble.ai/laws-and-regulations/canada-aida-bill-c-27-failed) — Artificial Intelligence and Data Act (AIDA) — Died with the rest of Bill C-27 at prorogation on 5-6 January 2025; not reintroduced; Bill C-36 confines AI-adjacent oversight to ADM transparency within the proposed CPPA rather than a standalone AI statute. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-002-overview/) — OpenAI OpCo, LLC — The joint OPC/CAI/OIPC-BC/OIPC-AB investigation (PIPEDA Findings #2026-002, May 6, 2026) found that OpenAI's manner of collecting personal information from publicly accessible websites and licensed third-party sources to train its models was 'overbroad and therefore inappropriate' given the scale, nature and sensitivity of the data collected and used - [WorkAxle](https://www.workaxle.com/blog/law-25-biometrics) — Act to establish a legal framework for information technology (Quebec) — Biometric identity verification requires express consent and must be disclosed to the CAI no later than 60 days before being brought into service; CAI interprets s.44 broadly to include video-surveillance-derived facial recognition. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ethi_frt_20210510/is_frt_20210510/) — PIPEDA — no statutory right to meaningful explanation or human intervention outside Quebec - [McMillan LLP](https://mcmillan.ca/insights/publications/identity-verification-and-facial-recognition-systems-key-takeaways-from-a-recent-decision-by-the-quebec-privacy-regulator/) — Quebec IT Act s.44 — express consent required - [Biometric Update](https://www.biometricupdate.com/202501/quebec-privacy-act-sets-high-legal-threshold-for-biometric-data-collection) — Quebec IT Act s.45 — 60-day advance declaration duty - [Torkin Manes LLP](https://www.torkin.com/insights/publication/privacy-commissioner-of-canada-publishes-guidance-on-biometrics) — OPC Guidance for Processing Biometrics — necessity/proportionality test required - [Ogletree Deakins](https://ogletree.com/insights-resources/blog-posts/the-cais-facial-recognition-ruling-shaping-the-future-of-retail-biometrics-in-quebec/) — Metro Inc. — necessity standard met (2026); s.44 consent finding unaffected ### Canada: D9 Children & Vulnerable Groups Not assessed ▾ No standing position recorded for this category. #### Children & Vulnerable Groups Bill C-36, as introduced at first reading on June 15, 2026, proposes to require organisations to meet a higher standard when handling the personal information of children, and would require the future Digital Safety and Data Protection Commission of Canada to consider children's best interests in the exercise of its enforcement powers. This represents a proposed elevation of children's personal information to a specially protected category under Canadian federal privacy law, a status it does not currently hold under PIPEDA in its present form. The bill's approach of requiring both a heightened organisational handling standard and a best-interests consideration built into the enforcement Commission's own decision-making process suggests a two-pronged structure: a substantive obligation on organisations collecting or processing children's data, and a procedural obligation on the regulator itself when assessing compliance or imposing penalties in matters involving children's data. Neither obligation is yet in force, as Bill C-36 remains at first reading. No provincial development specific to children's or vulnerable groups' data protection was located in the material reviewed this cycle beyond the federal Bill C-36 proposal; Quebec's Law 25 enforcement activity reviewed this cycle, including the biometric facial-recognition matter, did not concern children's data specifically. #### Outlook The fate of Bill C-36's children's-data provisions, both the heightened handling standard and the Commission's best-interests consideration duty, depends on the bill's progress through committee and subsequent readings; no indication of the bill's committee timetable was located this cycle. Read full narrative · 241 words Periodic update · new data 2026-10-25 #### Children & Vulnerable Groups The Privacy Commissioner of Canada, Philippe Dufresne, launched Canada's first Children's Privacy Code on 20 October 2026. The Code sets out expectations for organisations handling children's personal information. It is supervisory guidance issued by the Commissioner's office rather than a binding statutory instrument, meaning it does not itself carry the force of law or create new enforceable obligations beyond those already present in the Personal Information Protection and Electronic Documents Act framework; rather, it articulates how the Commissioner expects organisations to apply existing obligations specifically in the context of children's data. The Code's launch is the first dedicated children's-privacy instrument of its kind from the federal regulator, and represents a material step in Canada's children's-data governance landscape even though it does not amend the underlying statutory framework. Organisations processing children's personal information now have a specific supervisory reference point against which the Commissioner is likely to assess compliance with existing obligations, even absent new binding law. #### Outlook Whether the Children's Privacy Code's expectations are subsequently codified into binding law — whether through Bill C-36 or a dedicated children's-data provision — is the key question for future cycles. Its practical effect on the Commissioner's enforcement and investigation activity involving children's data, addressed separately under enforcement and redress, is also worth monitoring going forward. Sources and claims (3) - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/opc-news/news-and-announcements/2026/nr-c_261020) — The Privacy Commissioner of Canada launched Canada's first Children's Privacy Code on 20 October 2026, setting expectations for organizations handling children's personal information; it is supervisory guidance, not a binding statutory instrument. - [Conforme](https://conforme.ca/en/loi-25-compliance/consent/) — Law 25 s.4.1 — age 14 threshold - [Office of the Information and Privacy Commissioner for British Columbia](https://www.oipc.bc.ca/documents/news-releases/2830) — websites/apps aimed at children — deceptive design patterns found, at least as frequent as on adult sites ### Canada: D10 Enforcement & Redress Not assessed ▾ No standing position recorded for this category. #### Enforcement & Redress The most material enforcement and redress development in Canada this cycle is PIPEDA Findings #2026-002, the joint investigation by the Office of the Privacy Commissioner of Canada, Quebec's CAI, and the British Columbia and Alberta privacy commissioners into OpenAI OpCo, LLC's ChatGPT service. The investigation found that appropriate purposes existed for ChatGPT's development under PIPEDA's section 5(3) test, but that OpenAI had failed to obtain valid consent for certain collection, use and disclosure of personal information. This is a Tier-1 primary-source finding, directly published by the OPC. The multi-regulator structure of this investigation, spanning the federal regulator and three provincial regulators with their own substantially similar legislative regimes, is notable as an enforcement-coordination mechanism distinct from a single regulator acting alone. It suggests that for matters involving nationwide AI-system data practices, Canadian privacy regulators are willing to coordinate formal joint investigations rather than pursue separate, potentially inconsistent, provincial and federal actions. Whether this finding will be followed by a compliance order, further OPC proceedings, or referral to the Federal Court, which PIPEDA permits following OPC findings, had not been established this cycle. The specific remedial steps OpenAI is expected to take regarding its consent mechanisms for Canadian ChatGPT users likewise remain unconfirmed. Separately, Quebec's CAI's most recent enforcement activity under Law 25 was not independently retrieved this cycle, leaving a gap in the provincial enforcement picture alongside the federal/multi-regulator OpenAI finding. #### Outlook Follow-up developments to PIPEDA Findings #2026-002, including whether OpenAI implements changes to its consent practices for Canadian users or whether the matter proceeds to Federal Court, are the primary items to monitor arising from this cycle's enforcement activity. Independent retrieval of CAI's recent Law 25 enforcement record would fill a current gap in the provincial enforcement picture. Read full narrative · 292 words Periodic update · new data 2026-10-25 #### Enforcement & Redress The Office of the Privacy Commissioner of Canada closed its investigation into WestJet on 14 October 2026, stating that it was satisfied with WestJet's enhanced security measures implemented following a cyberattack. The closure was achieved through remediation rather than through a formal penalty, which is consistent with the Commissioner's current powers under the Personal Information Protection and Electronic Documents Act: the Commissioner can investigate and make recommendations but cannot presently impose administrative monetary penalties directly on an organisation. That limitation is squarely what Bill C-36 proposes to change. The bill is understood to propose administrative monetary penalties of up to the greater of $10 million or 3% of gross global revenue for standard contraventions, rising to the greater of $25 million or 5% of gross global revenue for certain more serious offences, with enforcement vested in the new Digital Safety and Data Protection Commission of Canada that the bill would establish. This would be a fundamental shift from the Commissioner's current ombudsman-style model, under which an outcome like the WestJet closure — resolved by remediation rather than sanction — represents the practical ceiling of the regulator's present enforcement reach. #### Outlook The WestJet closure illustrates the practical limits of the Commissioner's current enforcement toolkit pending reform. Should Bill C-36 advance and its proposed administrative-monetary-penalty regime take effect, future enforcement outcomes of this kind could carry direct financial penalties rather than resolution through remediation alone; the bill's progress through Parliament, discussed under regulator and framework, is the determining variable. 2 earlier distinct update(s) Periodic update · new data 2026-10-18 #### Enforcement & Redress Bill C-36 proposes to establish a new Digital Safety and Data Protection Commission of Canada with binding enforcement powers against non-compliant organisations, a material departure from the Office of the Privacy Commissioner's current, more recommendation-oriented enforcement model under PIPEDA. The bill's proposed penalty ceiling, however, is reported inconsistently between contemporaneous secondary sources reviewed this cycle: one account states the figure at up to CAD 10 million or three percent of global revenue, while another states it at up to CAD 25 million or five percent of global revenue, a substantial increase in either case from PIPEDA's current maximum penalty of CAD 100,000. Neither figure has been reconciled against the bill's own text this cycle, and it is not established from the material reviewed whether the two figures describe different penalty tiers within the bill (for example, a tier for individual violations versus a tier for systemic or repeated violations) or whether one source is simply in error. Independent of Bill C-36's still-proposed penalty structure, Quebec's Law 25 enforcement regime remains in force and continues to apply its own penalty framework: administrative monetary penalties of up to CAD 10 million or two percent of worldwide turnover, and penal fines of up to CAD 25 million or four percent of worldwide turnover, alongside a statutory-minimum private right of action set at CAD 1,000. Quebec's regime therefore already operates at a penalty scale broadly comparable to the higher of the two figures reported for Bill C-36, meaning that, depending on which Bill C-36 figure proves accurate, the federal regime may either introduce penalties below, or roughly in line with, Quebec's existing provincial ceiling. The joint OpenAI finding issued May 6, 2026 by the Office of the Privacy Commissioner together with Quebec, British Columbia and Alberta counterparts stands as the most significant enforcement outcome of the cycle under the current, pre-C-36 framework, demonstrating that multi-regulator joint investigations remain an active enforcement mechanism available to Canadian privacy authorities notwithstanding the absence, so far, of the binding-powers Commission that Bill C-36 would create. #### Outlook Resolution of the discrepancy between the two reported Bill C-36 penalty figures against the bill's own text would materially sharpen the picture of how the new Commission's enforcement powers would compare to Quebec's existing Law 25 penalty regime; this remains unresolved as at this cycle. Periodic update · new data 2026-10-11 #### Enforcement & Redress The Office of the Privacy Commissioner told Parliament directly, in a submission dated 14 May 2026, that under the Personal Information Protection and Electronic Documents Act as currently in force, it has no power to issue binding orders or impose administrative monetary penalties on private-sector organizations, and that it has asked Parliament for such powers — precisely the gap Bill C-36's proposed new Commission is designed to close. This structural limitation has not stopped the Office from pursuing active enforcement work within its existing powers: its 2025-26 annual report disclosed a joint investigation into TikTok, conducted together with provincial counterparts, that led to privacy-practice improvements; a new breach investigation was opened on 21 September 2026; and a notice of application was filed in Federal Court on 28 August 2026 in connection with a Google de-listing investigation. The combination illustrates an enforcement body that remains active across multiple matters while operating without the binding-order and penalty powers it has formally requested. #### Outlook The Federal Court proceeding on the Google de-listing matter and the newly opened breach investigation are the two enforcement threads most likely to produce dated developments before Bill C-36 could plausibly expand the Office's underlying powers. Sources and claims (19) - [Gowling WLG](https://gowlingwlg.com/en/insights-resources/articles/2026/understanding-bill-c36) — PIPEDA currently empowers the OPC to investigate and make recommendations but not to impose administrative monetary penalties directly; Bill C-36 proposes penalties up to the greater of $10 million or 3% of gross global revenue, rising to the greater of $25 million or 5% for certain offences, enforced by a new Digital Safety and Data Protection Commission of Canada. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/opc-actions-and-decisions/advice-to-parliament/2026/parl_sub_260514_ethi/) — Office of the Privacy Commissioner of Canada — Under PIPEDA as currently in force, OPC has no power to issue binding orders or impose AMPs on private-sector organizations; has asked Parliament for such powers; Bill C-36 proposes a new Commission with order-making/AMP powers. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/opc-news/news-and-announcements/2026/nr-c_260604/) — Office of the Privacy Commissioner of Canada — 2025-26 annual report disclosed joint TikTok investigation with provincial counterparts leading to privacy-practice improvements; new breach investigation opened 21 September 2026; Federal Court notice of application filed 28 August 2026 in Google de-listing investigation. - [IAPP](https://iapp.org/news/a/canada-s-bill-c-36-introduces-privacy-reforms-enforcement-changes) — Bill C-36 (Protecting Privacy and Consumer Data Act) — As introduced, Bill C-36 would grant the new Digital Safety and Data Protection Commission of Canada power to issue binding enforcement actions on non-compliant organizations with penalties reported at up to CAD 10 million or 3% of global revenue (per one contemporaneous source) - [Cloudforces](https://www.cloudforces.ca/blog/bill-c36-canada-privacy-law-ppcda-guide-2026) — Bill C-36 (Protecting Privacy and Consumer Data Act) — As introduced, Bill C-36 would raise federal private-sector privacy penalties to up to the greater of CAD 25 million or 5% of gross global revenue (per two independent contemporaneous sources), a substantial increase from PIPEDA's current CAD 100,000 maximum - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/about-the-opc/) — Office of the Privacy Commissioner of Canada — The Privacy Commissioner of Canada closed its investigation into WestJet on 14 October 2026, stating satisfaction with WestJet's enhanced security measures following a cyberattack. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-002-overview/) — OpenAI / ChatGPT (PIPEDA Findings #2026-002) — was found by the OPC, OIPC-AB and OIPC-BC to have failed to obtain valid consent for collection and use of personal information from publicly accessible sources for model training purposes: true - [DEV Community](https://dev.to/codacon/quebec-law-25-and-generative-ai-what-to-settle-before-production-58j1) — Quebec Law 25 administrative monetary penalties — no administrative monetary penalty decision had been published as of recent review despite the CAI holding AMP power since September 2023: true - [Osler, Hoskin & Harcourt LLP](https://www.osler.com/en/insights/blogs/risk/law-25-a-new-enforcement-scheme-for-protection-of-personal-information-in-the-private-sector-in-que/) — Act respecting the protection of personal information in the private sector (Quebec) — The CAI may impose administrative monetary penalties of up to C$10 million or 2% of worldwide turnover, whichever is greater, for enumerated privacy violations; individual AMPs are capped at C$50,000. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/opc-news/news-and-announcements/2021/nr-c_210203/) — Clearview AI, Inc. — violation found; cease-and-delete orders issued - [Osler, Hoskin & Harcourt LLP](https://www.osler.com/en/insights/updates/high-bar-for-biometric-data-processing/) — unnamed printing company (CAI decision) — cease-and-destroy order issued - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-002-overview/) — OpenAI OpCo, LLC — consent failure found - [Clym](https://www.clym.io/blog/quebec-law-25) — Law 25 ss.90-93 — CAD $10m/2% AMP; CAD $25m/4% penal fine - [DPO Consulting](https://www.dpo-consulting.com/blog/what-is-quebec-law-25) — Law 25 ss.90-93 — CAD $50,000 cap for individuals - [SecurePrivacy](https://secureprivacy.ai/blog/what-is-pipeda) — PIPEDA s.28 — CAD $10,000-$100,000 fine - [My Privacy Rights](https://myprivacyrights.ca/guides/filing-pipeda-complaint) — PIPEDA s.13(1) — one-year deadline - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/opc-actions-and-decisions/ar_index/201920/ar_201920/) — PIPEDA s.16 — corrective order and damages available - [JD Supra](https://www.jdsupra.com/legalnews/what-is-quebec-s-law-25-4852126/) — Law 25 — private right of action; CAD $1,000 statutory minimum damages - [Quebec Official Publisher / CanLII](https://www.canlii.org/en/qc/laws/stat/cqlr-c-c-25/latest/cqlr-c-c-25.html) — Code of Civil Procedure (Quebec) art. 578 — authorization required ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) data localisation Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties