Insights
CIPP/C practitioner notes on Canadian privacy (PIPEDA, Law 25), AI governance, security fundamentals, and controls that make AI trustworthy at scale—from Toronto.
Filter by topic to browse privacy, AI governance, security, and process excellence. By Mohammad Movahedi · Toronto, Canada.
Lire les analyses en français →
Prefer a weekly scan of Canadian privacy news? Read Privacy Pulse →
43 articles
The EU Kids Act, proposed September 17, 2026, would make age checks the entry ticket to social media, games, and AI chatbots. For Canadian teams, it is a preview of where Bill C-34 is heading and what the Brussels effect will demand.
Canada's privacy commissioners met in Ottawa while California expanded AI incident reporting. Different continents, same operational message: inventory AI by decision impact, practice incident reporting, and document like a stranger will audit you.
The best AI-privacy conversations are happening on podcasts. Here's the 16-show circuit I'm pitching — and one question I'd bring each host.
After Bill C-27 died on prorogation, privacy and AI split tracks. Build under PIPEDA and Law 25 now—don't wait for a reintroduced omnibus statute.
GenAI and agentic AI break SaaS-era controls. AI security platforms unify shadow AI discovery, app runtime defense, and identity for models that act.
R v Bykovets (2024 SCC 6): IP addresses attract Charter s.8 privacy. Map collection, retention, and law-enforcement disclosure for Canadian logs.
Agentic AI needs user-grade identity: least privilege, audit trails, and kill switches for agents that act—not chatbots you can only interview later.
Del Giudice limits intrusion upon seclusion after third-party hacks: being breached isn't automatic intentional intrusion—rebuild class-action risk maps.
Cyber is personal accountability work now: multi-jurisdiction rules, board duties, and evidence of decisions—not only control maturity scorecards.
Clearview's BCCA result backs extraterritorial privacy orders: scraping Canadians' images can create real connection—foreign servers aren't a shield.
Boards fund numbers, not heat maps. Cyber risk quantification turns qualitative ratings into loss ranges boards can compare with other capital bets.
After Del Giudice, external breaches face harder intrusion claims—but intentional internal misuse and soft credit probes still fuel privacy class actions.
CTEM replaces monthly scan PDFs with continuous exposure decisions—scope, discover, prioritize, validate, and mobilize so backlogs stop growing forever.
How Bill C-36 / PPCDA could replace PIPEDA: consent, portability, deletion, anonymization, and private rights of action—as design targets under today's law.
Sensitive data already lives in SaaS, copies, and AI prompts. DSPM answers where personal data actually sits when the perimeter stopped being the map.
Quebec Law 25 is fully in force: data portability, privacy by default, and CAI penalties up to 2–4% of global turnover reshape Canadian privacy design.
Discovery without control is ticket noise. Mature DSPM enforces access, quarantine, and policy on sensitive cloud and SaaS data—not only scans.
Canadian joint investigations reject 'public web equals free training data.' Provenance, filtering, and contracts before GenAI scrape or fine-tune.
Shadow AI is ordinary: staff paste drafts into public models. Treat it as unstructured data exfil—discover tools, set approved paths, log high-risk use.
Canada's Consumer-Driven Banking Act aims to replace screen scraping with consented APIs—scoped tokens, revoke paths, and auditable financial data sharing.
Encrypt rest and transit still leave data plain in memory. TEEs and confidential computing finally make data-in-use a first-class control.
Federal private rights of action would decentralize PIPEDA-era enforcement. Prepare courtroom-ready evidence, not only commissioner correspondence.
Data residency is not a region dropdown. Sovereign cloud for AI needs control of keys, operators, and model processing—not only storage geography.
Bill C-34 would create Canada's Digital Safety Commission with audits, orders, and revenue-based AMPs for social media and AI chatbot services.
Harvest-now-decrypt-later makes PQC a crypto-inventory and migration problem today—not a lab future. Map RSA/ECC, plan hybrid, swap before data ages out.
Bill C-34's proposed 24-hour CSAM and NCII duties—including deepfakes—turn moderation clocks into evidence: logs, escalation, and privacy-safe reports.
Classic encrypt-at-rest leaves AI data exposed in GPU memory. Confidential GPUs and TEEs close the data-in-use hole for model weights and prompts.
Bill C-34's under-16 age gate creates a privacy paradox: prove age effectively, then destroy verification data so the gate never becomes a registry.
Confidential AI sovereignty without attestation is hope. Remote attestation, TEEs, and policy-bound keys turn marketing claims into verifiable trust.
Post-C-27, Canadian privacy reform still pushes order powers, AMPs, and commission models—plus a safety merge that overlaps digital harms duties.
Zero Trust 1.0 killed network trust. Zero Trust 2.0 needs TEEs and attestation when the host and cloud admin can no longer be the trusted compute base.
Ontario FIPPA data integration units enable linked analysis under Part III.1 gates—predictive use needs de-id standards and function-creep controls.
CISA Secure by Design shifts default security to vendors—safe configs, memory safety, and customer-hardening burden that shouldn't be the last line.
PHIPA Decision 298 issued Ontario's first health privacy AMPs for commercial EHR misuse—proof that economic motive and weak clinic programs matter.
Wi-Fi 7's 6 GHz band requires WPA3—no WPA2 fallback. Plan Enterprise auth, GCMP, and client readiness before the band forces your migration calendar.
Decision 298's 146 targeted newborn searches show economic motive as an AMP aggravator—clinical access is not a private marketing pipeline.
Labeling WPA3 is not enough for Wi-Fi 7. GCMP-256 and true WPA3-Enterprise cipher suites matter when high-throughput links raise the crypto bar.
PHIPA Decision 334: a clerk's 436-record snooping drew a personal AMP while CHEO's response mattered—unauthorized access needs no profit motive.
Mandatory PMF stops easy deauth disruption; SAE replaces brittle PSKs to blunt offline dictionary attacks—core WPA3 personal-mode upgrades.
PHIPA Decision 298 makes demonstrable accountability the test: policies only count when training, audits, and breach evidence prove they operate.
Wi-Fi 7 MLO lets one client use several radios at once—security teams must rethink association, keys, and monitoring for multi-link sessions.
PHIPA Decision 298: put privacy duties in professional staff bylaws and reappointment—credentialing is the control for privileged EHR access.
Open guest Wi-Fi leaks traffic to anyone nearby. OWE / Enhanced Open encrypts the air without a shared PSK—fix guest isolation still matters.