--- title: "Canada — Lawful Processing & Special Data | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/canada/lawful-processing-and-special-data/ source_html: /jurisdictions/canada/lawful-processing-and-special-data/index.html description: "Canada — Lawful Processing & Special Data: lawful_processing_and_special_data Lawful Processing & Special Data 1 sub-module 1 claim Not assessed ▾ # No standing position recorded for this category. Sub-modules (1) Lawful Ba" generated_at: 2026-10-25T04:46:50Z content_sha256: c1b7d154a5b4103ad18577ee10d84de3fe24fdf5c399b09f5625a913946f6966 generator: "fe-fleet/md-twin@1.0" --- # Canada — Lawful Processing & Special Data | Data Protection Monitor ### D2Lawful Processing & Special Data1 sub-module1 claimNot assessed▾# No standing position recorded for this category. #### Sub-modules (1) #### Lawful BasesNot assessed No narrative recorded for this sub-module. Claims (1): - PIPEDA imposes: PIPEDA s.5(3) imposes an appropriate-purposes test independent of consent, applied by the OPC in its May 2026 joint investigation of OpenAI's ChatGPT. Category narrative 321 words #### Lawful Processing & Special Data Quebec's Commission d'acces a l'information continues to apply a necessity-and-proportionality analysis to the processing of biometric data under Law 25, an approach most recently illustrated in a facial-recognition ruling concerning retail-sector use of the technology. In that matter, the Commission retained jurisdiction over the organisation involved and imposed a semiannual reporting obligation running for two years, together with an express reservation of the right to revisit its conclusion during that period. This is a standing feature of Quebec's biometric-data enforcement posture: rather than issuing a one-off finding and closing the file, the Commission has adopted an ongoing-supervision model for at least this category of biometric processing, allowing it to monitor compliance and reassess its own conclusion as circumstances develop. At the federal level, Bill C-36 as introduced would, if enacted, propose to treat de-identified information as personal information for certain purposes, a position that would narrow the current PIPEDA-era distinction between personal information and de-identified or anonymised data. This proposed treatment has direct relevance to any organisation currently relying on de-identification as a basis for processing data outside PIPEDA's personal-information perimeter, since Bill C-36's approach would, on its face, bring at least some de-identified datasets back within scope. The practical effect of these two developments operating at different levels of government is that organisations handling biometric or de-identified data in Canada face a lawful-processing landscape that varies by province in its current operative state (Quebec's active necessity-and-proportionality enforcement under Law 25) while also facing a federal proposal (Bill C-36's de-identified-information treatment) that has not yet been enacted and would, if passed, apply nationally alongside or in place of Quebec's existing provincial regime. #### Outlook Whether the Commission d'acces a l'information's ongoing-supervision model for biometric processing becomes a template applied to future Quebec enforcement matters, and whether Bill C-36's de-identified-information provision survives committee review in its current form, are both open questions this cycle's material does not resolve. Read full narrative · 321 words no periodic updates on record for this sub-brief Evidence 1 Sources and claims (1) - Probableunavailable — PIPEDA imposes: PIPEDA s.5(3) imposes an appropriate-purposes test independent of consent, applied by the OPC in its May 2026 joint investigation of OpenAI's ChatGPT.