Insights
This hub collects regular practitioner analysis on Canadian privacy and AI governance, in English and French. Each piece starts from a current decision, bill, guidance, or enforcement action, and ends with what privacy teams should check next. Use it to follow OPC and CAI developments, Law 25 and PIPEDA changes, and AI governance questions in one place.
Each article ends with what to check next. Use atool to act on it, look up a term in theglossary, check theLaw 25 hub orPIPEDA hub, or follow the decision in theenforcement tracker. The newest articles are first, and the filter below groups them by topic.
92 articles
Three days of House debate left Bill C-34's under-16 social media ban with a new label, the 'earned exemption model', and the same mechanics: a ban that starts before the regulator exists, no exemption criteria, and age verification for millions of Canadians. What the debate record means for privacy teams before committee hearings open November 16.
On October 29, 2026, NSIRA published its review of DND and Canadian Armed Forces open-source intelligence on the internet: the collection is lawful, but the paperwork is not. Fifteen people-data providers went unevaluated, risk assessments went stale, and collection was not tied to approved operations. What the five findings mean for any team running OSINT.
On November 2, 2026, Privacy Commissioner Philippe Dufresne told the Senate national security committee that Bill C-22's new subscriber information production order is too wide: narrow the definition, limit who can be compelled, or at least carve out medical and privileged records. What the three asks change for your vendor and request-handling files.
On November 2, attackers using AI agents reached GitBook's infrastructure, and the questions visitors had typed into its AI assistant may have been reached too. That is the exact failure Poppy is designed to make impossible: no names, no accounts, no stored questions. How a zero-PII agent help desk works, and why 90 days is a promise you can keep.
In an October 30 announcement, OpenAI committed to a biannual Community Safety Report starting in early 2027 and moved teen protections upstream: no practical weapons or security-system information for under-18 accounts even without violent intent, and a model that can end its own chats when it detects fixation on violence. What the new transparency artifact means for your AI vendor files.
On October 30, 2026, Canada concluded its first Digital Trade Agreement with the EU in Montreal, alongside commitments on reciprocal cloud and AI market access and a transatlantic data cable study. Here is what the treaty settles, what it leaves open, and the vendor questions it puts back on your desk.
Ofcom's rapid assessment found four ways to verify someone is 16, and every one leans on photo ID. The UK did the technical assessment before legislating. Canada's Bill C-34 is set to enforce the ban first and sort out the how later.
On October 28, 2026, the Canadian Centre for Cyber Security published alert AL26-028 on a help-desk voice-phishing campaign bypassing conventional MFA at Canadian law firms. How the relay works, why your MFA approved it, and the breach file you now owe.
On October 29, 2026, Canada's federal, provincial, and territorial privacy commissioners and ombuds issued a joint resolution on responsible AI use in health care and health research. Six core principles, specific asks for vendors, providers, and researchers, and one contract clause your vendor files probably lack.
On October 26, 2026, OpenAI petitioned the BC Supreme Court to quash a production order from the BC privacy commissioner, issued in September as part of a June 2026 investigation into whether ChatGPT's use of the Tumbler Ridge shooter's personal information met the reasonable-person test. What the fight signals for AI vendor governance.
On October 27, 2026, the Privacy Commissioner opened an investigation into Navigate360, the commercial company behind the Crime Stoppers tip platform, after a breach exposed more than 1.5 million Canadian tips. The investigation answers the jurisdiction question that hung over the case, and it puts the vendor's safeguards on trial.
On October 26, 2026, the Privacy Commissioner announced Loblaw signed a compliance letter over the February cyberattack that affected about two million Canadians. Unlike WestJet two weeks earlier, Loblaw's file stays open until the Commissioner is satisfied. What the difference means for breach response.
On October 23, 2026, the Privacy Commissioner published its submission to ISED's AI transparency consultation. Its core test is simple: information about an AI system must be understandable and arrive at the moment of decision. What that means for privacy teams.
The Heritage Committee studied children and social media for a year and recommended banning targeted ads to kids. The government's response this week declined that ban and kept the under-16 account ban instead. What the reversal means for privacy teams.
Cloudflare's new PQ GeoKey Manager wraps customer decryption keys so they can only be unwrapped inside a chosen geography, and wraps them with hybrid post-quantum cryptography so a harvest now, decrypt later adversary gains nothing. Here is how the mechanism works, where it fails closed, and what Canadian privacy teams should ask before trusting a region promise.
CBC's investigation into the Crime Stoppers breach found 1.5 million Canadian tips spanning 25 years exposed through the P3 platform run by U.S. vendor Navigate360, including unredacted names and personal details. The vendor changed its story for months, and an internal memo told chapters not to call the privacy commissioner. What the case teaches about vendor due diligence when anonymity is the product.
Justice Canada tabled the Charter statement for Bill C-34's under-16 social media ban on October 19, 2026. The evidence for the ban is one unsupported sentence, the privacy case for mandatory age assurance is one word, 'perceived,' and the safeguards that would make the ban lawful arrive after the ban itself. What privacy teams should track.
On October 20, 2026, Philippe Dufresne launched Canada's first Children's Privacy Code: meaningful consent with parental consent for under-13s, age-appropriate communication, deletion on demand, no marketing profiling of children, and privacy by default. Here is what product and privacy teams need to check.
A data review of 10 published CAI and OPC enforcement actions: no fines, no cookie banners, and a clear pattern. Regulators are aiming at cameras, faces, AI training data, and old data that should have been destroyed.
Michael Geist published his digital sovereignty keynote today, while Bell's $50B sovereign AI campus and Saskatchewan's ownership framework turn the debate into poured concrete. Here is what the sovereignty wave means for your vendor files, residency map, and foreign-access questions.
Between October 8 and 14, four Canadian privacy developments landed AI obligations on privacy teams: the OPC's voiceprint guidance, Bill C-34's recommender-system duties, Newfoundland's ATIPPA review submission naming AI, and Bill C-36's automated decision-making rules. The separate discipline of AI governance is dissolving into privacy law.
AWS shipped a two-part series on post-quantum software supply chain signing: ML-DSA keys in KMS, an ML-DSA certificate hierarchy in Private CA, workload identity through IAM Roles Anywhere, SBOMs bound with in-toto statements, and the enforcement half most teams skip: turning the algorithm policy into SCPs and IAM controls with the kms:KeySpec condition key. How the threat works, how the pipeline is built, and the one condition key that makes the policy real.
On October 14, 2026, Newfoundland and Labrador's privacy commissioner published her submission to the five-year review of ATIPPA, 2015, the law she calls the strongest access regime in Canada. Her four asks, on privilege claims, political party data, AI, and oversight powers, read like a preview of where every province is heading.
On October 14, 2026 the OPC closed its WestJet breach investigation after the airline met every commitment in its July compliance letter. The case is the clearest public template of how the Commissioner resolves a major private-sector breach, and the root cause, social engineering that bypassed MFA on an admin account, is the part privacy teams should study.
Last week's Senate debate revealed Bill C-22's strangest feature: police powers go live 180 days after Royal Assent, while the SAAIA's capability and metadata-retention obligations wait years for regulations. Meanwhile section 7 lets the Minister impose those same obligations on any provider by secret order before the public rules exist.
A new CMAJ analysis by SickKids researchers backs Bill C-34, the Safe Social Media Act, and prescribes design-based duties: regulate recommender systems and defaults, and give the new Commission real enforcement teeth. The privacy catch is age assurance for every user, and privacy teams should read that part closely.
BC's privacy commissioner found Kamloops Mayor Reid Hamer-Jackson disclosed the personal information of four people in violation of FIPPA and ordered him to get written permission before sharing any staff personal information. What the order teaches municipal privacy teams about elected officials and insider breaches.
Four months after Bill C-34's first reading, Justice Canada has still not tabled the Charter statement the Department of Justice Act requires for every government bill, while later bills like C-36 have theirs. What the missing statement reveals about the under-16 ban's constitutional risk, and what privacy teams should track next.
OpenAI's answer to the EU AI Act's text provenance rule is textGrain, an invisible statistical watermark with published failure modes: 10% synonym swaps take detection from 92% to 66%, 25% take it to 17%. How the mechanism works, what the numbers honestly say, and the compliance homework for teams serving EU users.
On October 8, the OPC updated its guidance on recording customer calls, treating voiceprints as sensitive biometric information and clarifying when meaningful consent is required. Generic 'this call may be recorded' notices no longer cut it. What the update means for your IVR scripts, enrolment flows, and call-centre contracts.
Privacy Commissioner Philippe Dufresne told Parliament on October 7 that federal security screening must meet four tests: necessity, proportionality, effectiveness, and minimal intrusiveness. He singled out open-source checks, polygraphs, and clearance maintenance. If you run background checks of any kind, his test is now your benchmark too.
Three weeks after Nipigon District Memorial Hospital disclosed a ransomware incident, a group tracked as Storm added it to its leak site. For Ontario health custodians, the listing phase is where double extortion gets expensive. What the law expects, and a first-72-hours playbook.
Nova Scotia's new FOIPOP Act takes effect April 1, 2027 and makes it mandatory to withhold all Executive Council records for 15 years. The privacy commissioner says there was no valid reason for the change. What the mechanics mean for your records playbook.
The EU's proposed Cloud and AI Development Act would grade cloud providers on four sovereignty assurance levels, and a leaked draft for the October 29-30 Canada-EU summit points to Canada seeking associated-country status. Here is what the conditions mean for your vendor files, your data residency map, and Canada's adequacy finding.
I mapped the subprocessor lists of 87 tech companies, two levels deep: 1,498 nodes, 2,518 edges. Three hyperscalers sit under everything, AI labs arrive one layer down, and 58 companies publish no list at all.
On October 2, 2026, Kingston Police published its closing notice on a 160 GB breach discovered in January 2025. The 21-month gap, the corrupted forensic dataset, and the limits of dark-web monitoring give privacy teams a breach-response drill worth running now.
Perplexity's new engineering post describes real incidents where helpful AI agents crossed security boundaries on their own, then lays out three defense-in-depth design rules for building agents that fail safely. Here is what the rules mean in practice, and the questions Canadian privacy and security teams should ask any vendor selling them an agent.
Cloudflare is turning its Privacy Gateway into a managed OHTTP relay and launching a Cloudflare OHTTP gateway in closed beta. Here is how Oblivious HTTP splits every request in two, what it honestly protects, and the due-diligence questions Canadian privacy teams should ask before buying in.
Canada's Cyber Security Awareness Month launched October 1, 2026 with the theme 'Your best defence is you' and an explicit AI angle. Here is how privacy and security teams can turn the four weekly themes into a working internal awareness program instead of a poster campaign.
AI research firm Transluce found rogue agents probing Library and Archives Canada with SQL injection payloads this spring. The probes failed, but the incident hands privacy and security teams a new threat actor: the machine that acts at machine speed and answers to no interview.
Bill C-22 heads to the Senate this fall with an encryption compromise that law enforcement and technology companies both reject. What privacy teams should do now: map vendors against the uncertain core-provider category and the six-month metadata retention mandate before the regulations are written.
BC's privacy commissioner used Right to Know Week 2026 to call for three tiers of transparency: openness by default, proactive release, and a well-resourced request system. With large-volume FOI backlogs and Law 25 access requests on the same 30-day clock, private-sector privacy teams should borrow the playbook.
Bill C-39, introduced September 21, 2026, would enact the Enabling Digital Trade Act, Canada's first federal electronic trade documents law. Its section 26 would let federal officials share import/export information with other departments with no purpose limitation, no consent, and no notice, overriding confidentiality provisions in nine statutes. The bill is at first reading: the committee window is now.
On September 25, 2026, CTV News reported that Ontario's Information and Privacy Commissioner sees rising non-compliance with its orders and cannot take government institutions to court to enforce them. A look at what FIPPA actually gives the watchdog, and how that compares with British Columbia and Quebec.
A weekend-sized RAG evaluation on Canadian regulatory text: 12 questions, three Ragas metrics, and a chunking change that lifted faithfulness from 0.95 to 1.00. What the Directive on Automated Decision-Making and OSFI E-23 expect, in practice.
On September 24, 2026, the EFF reported that DraftKings trains machine learning models on customers' betting records to identify likely losing gamblers, then targets them with promotions. In Ontario, where DraftKings is a registered operator, the regulator requires that same player-monitoring data to feed harm reduction, not re-engagement.
On September 21, 2026, British Columbia sued OpenAI and Sam Altman in San Francisco federal court over the Tumbler Ridge school shooting. The province alleges the shooter's flagged ChatGPT conversations should have been referred to law enforcement. The operational lesson is about vendor escalation: what your AI vendors do with dangerous-content flags is now a due diligence question.
The federal consultation on AI transparency ran from July 23 to September 23, 2026, covering five areas from incident reporting to AI agents. A published submission by Michael Geist argues for a statutory AI Transparency Act. Here is what the process signals for Canadian privacy and AI governance teams.
On September 21, 2026, Commissioner Philippe Dufresne opened an OPC investigation into the IDScan.net breach of driver's licence scans. The operational lesson is about vendor risk: your customers' ID documents live in someone else's database, and you answer for the fallout.
The EU Kids Act, proposed September 17, 2026, would make age checks the entry ticket to social media, games, and AI chatbots. For Canadian teams, it is a preview of where Bill C-34 is heading and what the Brussels effect will demand.
Canada's privacy commissioners met in Ottawa while California expanded AI incident reporting. Different continents, same operational message: inventory AI by decision impact, practice incident reporting, and document like a stranger will audit you.
The best AI-privacy conversations are happening on podcasts. Here's the 16-show circuit I'm pitching. And one question I'd bring each host.
After Bill C-27 died on prorogation, privacy and AI split tracks. Build under PIPEDA and Law 25 now. Don't wait for a reintroduced omnibus statute.
GenAI and agentic AI break SaaS-era controls. AI security platforms unify shadow AI discovery, app runtime defense, and identity for models that act.
R v Bykovets (2024 SCC 6): IP addresses attract Charter s.8 privacy. Map collection, retention, and law-enforcement disclosure for Canadian logs.
Agentic AI needs user-grade identity: least privilege, audit trails, and kill switches for agents that act, not chatbots you can only interview later.
Del Giudice limits intrusion upon seclusion after third-party hacks: being breached isn't automatic intentional intrusion. Rebuild class-action risk maps.
Cyber is personal accountability work now: multi-jurisdiction rules, board duties, and evidence of decisions, not only control maturity scorecards.
Clearview's BCCA result backs extraterritorial privacy orders: scraping Canadians' images can create real connection. Foreign servers aren't a shield.
Boards fund numbers, not heat maps. Cyber risk quantification turns qualitative ratings into loss ranges boards can compare with other capital bets.
After Del Giudice, external breaches face harder intrusion claims, but intentional internal misuse and soft credit probes still fuel privacy class actions.
CTEM replaces monthly scan PDFs with continuous exposure decisions: scope, discover, prioritize, validate, and mobilize so backlogs stop growing forever.
How Bill C-36 / PPCDA could replace PIPEDA: consent, portability, deletion, anonymization, and private rights of action as design targets under today's law.
Sensitive data already lives in SaaS, copies, and AI prompts. DSPM answers where personal data actually sits when the perimeter stopped being the map.
Quebec Law 25 is fully in force: data portability, privacy by default, and CAI penalties up to 2–4% of global turnover reshape Canadian privacy design.
Discovery without control is ticket noise. Mature DSPM enforces access, quarantine, and policy on sensitive cloud and SaaS data, not only scans.
Canadian joint investigations reject 'public web equals free training data.' Provenance, filtering, and contracts before GenAI scrape or fine-tune.
Shadow AI is ordinary: staff paste drafts into public models. Treat it as unstructured data exfil: discover tools, set approved paths, log high-risk use.
Canada's Consumer-Driven Banking Act aims to replace screen scraping with consented APIs: scoped tokens, revoke paths, and auditable financial data sharing.
Encrypt rest and transit still leave data plain in memory. TEEs and confidential computing finally make data-in-use a first-class control.
Federal private rights of action would decentralize PIPEDA-era enforcement. Prepare courtroom-ready evidence, not only commissioner correspondence.
Data residency is not a region dropdown. Sovereign cloud for AI needs control of keys, operators, and model processing, not only storage geography.
Bill C-34 would create Canada's Digital Safety Commission with audits, orders, and revenue-based AMPs for social media and AI chatbot services.
Harvest-now-decrypt-later makes PQC a crypto-inventory and migration problem today, not a lab future. Map RSA/ECC, plan hybrid, swap before data ages out.
Bill C-34's proposed 24-hour CSAM and NCII duties (including deepfakes) turn moderation clocks into evidence: logs, escalation, and privacy-safe reports.
Classic encrypt-at-rest leaves AI data exposed in GPU memory. Confidential GPUs and TEEs close the data-in-use hole for model weights and prompts.
Bill C-34's under-16 age gate creates a privacy paradox: prove age effectively, then destroy verification data so the gate never becomes a registry.
Confidential AI sovereignty without attestation is hope. Remote attestation, TEEs, and policy-bound keys turn marketing claims into verifiable trust.
Post-C-27, Canadian privacy reform still pushes order powers, AMPs, and commission models, plus a safety merge that overlaps digital harms duties.
Zero Trust 1.0 killed network trust. Zero Trust 2.0 needs TEEs and attestation when the host and cloud admin can no longer be the trusted compute base.
Ontario FIPPA data integration units enable linked analysis under Part III.1 gates: predictive use needs de-id standards and function-creep controls.
CISA Secure by Design shifts default security to vendors: safe configs, memory safety, and customer-hardening burden that shouldn't be the last line.
PHIPA Decision 298 issued Ontario's first health privacy AMPs for commercial EHR misuse: proof that economic motive and weak clinic programs matter.
Wi-Fi 7's 6 GHz band requires WPA3: no WPA2 fallback. Plan Enterprise auth, GCMP, and client readiness before the band forces your migration calendar.
Decision 298's 146 targeted newborn searches show economic motive as an AMP aggravator. Clinical access is not a private marketing pipeline.
Labeling WPA3 is not enough for Wi-Fi 7. GCMP-256 and true WPA3-Enterprise cipher suites matter when high-throughput links raise the crypto bar.
PHIPA Decision 334: a clerk's 436-record snooping drew a personal AMP while CHEO's response mattered. Unauthorized access needs no profit motive.
Mandatory PMF stops easy deauth disruption; SAE replaces brittle PSKs to blunt offline dictionary attacks: core WPA3 personal-mode upgrades.
PHIPA Decision 298 makes demonstrable accountability the test: policies only count when training, audits, and breach evidence prove they operate.
Wi-Fi 7 MLO lets one client use several radios at once: security teams must rethink association, keys, and monitoring for multi-link sessions.
PHIPA Decision 298: put privacy duties in professional staff bylaws and reappointment: credentialing is the control for privileged EHR access.
Open guest Wi-Fi leaks traffic to anyone nearby. OWE / Enhanced Open encrypts the air without a shared PSK. Fixing guest isolation still matters.
Ask movahedi.ca
Answers from Mohammad's articles
