CIPP/CFeatured
Prorogation of Bill C-27 and Strategic Legislative Bifurcation
After Bill C-27 died on prorogation, privacy and AI split tracks. Build under PIPEDA and Law 25 now—don't wait for a reintroduced omnibus statute.
5 min read
Insights
Insights on privacy, AI governance & responsible innovation
CIPP/C practitioner notes on Canadian privacy (PIPEDA, Law 25), AI governance, security fundamentals, and controls that make AI trustworthy at scale—from Toronto.
Filter by topic to browse privacy, AI governance, security, and process excellence. By Mohammad Movahedi · Toronto, Canada.
40 articles
- CISSPFeatured
AI Security Platforms Are Not a Vendor Category You Can Ignore
GenAI and agentic AI break SaaS-era controls. AI security platforms unify shadow AI discovery, app runtime defense, and identity for models that act.
7 min read - CIPP/CFeatured
R v Bykovets: IP Addresses and Charter Section 8
R v Bykovets (2024 SCC 6): IP addresses attract Charter s.8 privacy. Map collection, retention, and law-enforcement disclosure for Canadian logs.
5 min read - CISSPFeatured
Agentic AI Oversight: Treat Agents Like Users You Cannot Interview
Agentic AI needs user-grade identity: least privilege, audit trails, and kill switches for agents that act—not chatbots you can only interview later.
7 min read - CIPP/C
Del Giudice and the Limits of Intrusion Upon Seclusion
Del Giudice limits intrusion upon seclusion after third-party hacks: being breached isn't automatic intentional intrusion—rebuild class-action risk maps.
5 min read - CISSP
Regulatory Volatility Is Turning Cyber Into Personal Accountability Work
Cyber is personal accountability work now: multi-jurisdiction rules, board duties, and evidence of decisions—not only control maturity scorecards.
7 min read - CIPP/C
Clearview BCCA and Extraterritorial Privacy Enforcement
Clearview's BCCA result backs extraterritorial privacy orders: scraping Canadians' images can create real connection—foreign servers aren't a shield.
5 min read - CISSP
Stop Bringing Crayons to a Balance Sheet Fight
Boards fund numbers, not heat maps. Cyber risk quantification turns qualitative ratings into loss ranges boards can compare with other capital bets.
7 min read - CIPP/C
Intentional Internal Data Misuse and Privacy Class Actions
After Del Giudice, external breaches face harder intrusion claims—but intentional internal misuse and soft credit probes still fuel privacy class actions.
5 min read - CISSP
CTEM: From Scan Fatigue to Exposure Decisions
CTEM replaces monthly scan PDFs with continuous exposure decisions—scope, discover, prioritize, validate, and mobilize so backlogs stop growing forever.
7 min read - CIPP/C
PPCDA and Bill C-36: Replacing PIPEDA for a New Privacy Era
How Bill C-36 / PPCDA could replace PIPEDA: consent, portability, deletion, anonymization, and private rights of action—as design targets under today's law.
5 min read - CISSP
DSPM Is Booming Because the Data Already Escaped the Perimeter
Sensitive data already lives in SaaS, copies, and AI prompts. DSPM answers where personal data actually sits when the perimeter stopped being the map.
6 min read - CIPP/C
Quebec Law 25 at Full Force: Portability, Defaults, and Real Penalties
Quebec Law 25 is fully in force: data portability, privacy by default, and CAI penalties up to 2–4% of global turnover reshape Canadian privacy design.
5 min read - CISSP
Closing the Visibility-Control Gap: When DSPM Has to Do More Than Scan
Discovery without control is ticket noise. Mature DSPM enforces access, quarantine, and policy on sensitive cloud and SaaS data—not only scans.
6 min read - CIPP/C
Joint Investigations and GenAI Scraping: Public Is Not Permission
Canadian joint investigations reject 'public web equals free training data.' Provenance, filtering, and contracts before GenAI scrape or fine-tune.
4 min read - CISSP
Shadow AI Is Unstructured Data Leaving Through the Front Door
Shadow AI is ordinary: staff paste drafts into public models. Treat it as unstructured data exfil—discover tools, set approved paths, log high-risk use.
7 min read - CIPP/C
Consumer-Driven Banking: APIs, Consent, and the End of Screen Scraping
Canada's Consumer-Driven Banking Act aims to replace screen scraping with consented APIs—scoped tokens, revoke paths, and auditable financial data sharing.
5 min read - CISSP
Data in Use Was Always the Awkward Middle Child — TEEs Are Catching Up
Encrypt rest and transit still leave data plain in memory. TEEs and confidential computing finally make data-in-use a first-class control.
7 min read - CIPP/C
Federal Private Right of Action: When Privacy Violations Become Civil Claims
Federal private rights of action would decentralize PIPEDA-era enforcement. Prepare courtroom-ready evidence, not only commissioner correspondence.
4 min read - CISSP
Sovereign Cloud Is Not a Region Dropdown — Especially Once Algorithms Enter the Chat
Data residency is not a region dropdown. Sovereign cloud for AI needs control of keys, operators, and model processing—not only storage geography.
8 min read - CIPP/C
Bill C-34 and the Digital Safety Commission: Canada's New Super-Regulator
Bill C-34 would create Canada's Digital Safety Commission with audits, orders, and revenue-based AMPs for social media and AI chatbot services.
5 min read - CISSP
Post-Quantum Cryptography Is Not a Future Project—It’s a Swap Problem
Harvest-now-decrypt-later makes PQC a crypto-inventory and migration problem today—not a lab future. Map RSA/ECC, plan hybrid, swap before data ages out.
7 min read - CIPP/C
24-Hour CSAM and NCII Duties: Speed, Process, and Deepfakes
Bill C-34's proposed 24-hour CSAM and NCII duties—including deepfakes—turn moderation clocks into evidence: logs, escalation, and privacy-safe reports.
5 min read - CISSP
GPU Confidential Computing for AI: What the Hardware Actually Changes
Classic encrypt-at-rest leaves AI data exposed in GPU memory. Confidential GPUs and TEEs close the data-in-use hole for model weights and prompts.
6 min read - CIPP/C
The Age Verification Privacy Paradox: Prove You Are 16, Then Forget You Exist
Bill C-34's under-16 age gate creates a privacy paradox: prove age effectively, then destroy verification data so the gate never becomes a registry.
5 min read - CISSP
Verifiable Trust for Confidential AI: Attestation Is the Control, Not the TED Talk
Confidential AI sovereignty without attestation is hope. Remote attestation, TEEs, and policy-bound keys turn marketing claims into verifiable trust.
7 min read - CIPP/C
Privacy Enforcement After C-27: Commission Models, Order Powers, and the Safety Merge
Post-C-27, Canadian privacy reform still pushes order powers, AMPs, and commission models—plus a safety merge that overlaps digital harms duties.
5 min read - CISSP
Zero Trust 2.0 Needs a Hardware Layer: TEEs Against Untrusted Infrastructure
Zero Trust 1.0 killed network trust. Zero Trust 2.0 needs TEEs and attestation when the host and cloud admin can no longer be the trusted compute base.
7 min read - CIPP/C
Ontario FIPPA Data Integration: Predictive Governance Meets Privacy Friction
Ontario FIPPA data integration units enable linked analysis under Part III.1 gates—predictive use needs de-id standards and function-creep controls.
5 min read - CISSP
CISA Secure by Design: Stop Making Customers the Last Line of Defense
CISA Secure by Design shifts default security to vendors—safe configs, memory safety, and customer-hardening burden that shouldn't be the last line.
7 min read - CIPP/C
PHIPA Decision 298: Ontario's First Health Privacy AMPs
PHIPA Decision 298 issued Ontario's first health privacy AMPs for commercial EHR misuse—proof that economic motive and weak clinic programs matter.
4 min read - CISSP
Wi-Fi 7 Meets WPA3: Why 6 GHz Closed the Door on WPA2
Wi-Fi 7's 6 GHz band requires WPA3—no WPA2 fallback. Plan Enterprise auth, GCMP, and client readiness before the band forces your migration calendar.
6 min read - CIPP/C
Economic Motivation as an Aggravating Factor: 146 Searches and a Business Pipeline
Decision 298's 146 targeted newborn searches show economic motive as an AMP aggravator—clinical access is not a private marketing pipeline.
4 min read - CISSP
GCMP-256 and WPA3-Enterprise: When “WPA3” Isn’t Enough for Wi-Fi 7
Labeling WPA3 is not enough for Wi-Fi 7. GCMP-256 and true WPA3-Enterprise cipher suites matter when high-throughput links raise the crypto bar.
5 min read - CIPP/C
Decision 334: 436 Records, One Clerk, and Why the Hospital Was Spared
PHIPA Decision 334: a clerk's 436-record snooping drew a personal AMP while CHEO's response mattered—unauthorized access needs no profit motive.
5 min read - CISSP
PMF Mandatory + SAE Instead of PSK: Closing Deauth and Offline Dictionary Gaps
Mandatory PMF stops easy deauth disruption; SAE replaces brittle PSKs to blunt offline dictionary attacks—core WPA3 personal-mode upgrades.
6 min read - CIPP/C
Demonstrable Accountability: Evidence Beats Paper Policies
PHIPA Decision 298 makes demonstrable accountability the test: policies only count when training, audits, and breach evidence prove they operate.
4 min read - CISSP
Securing Multi-Link Operation (MLO): When One Client Uses Several Radios at Once
Wi-Fi 7 MLO lets one client use several radios at once—security teams must rethink association, keys, and monitoring for multi-link sessions.
6 min read - CIPP/C
Privacy in Professional Staff Bylaws: Credentialing Is a Control
PHIPA Decision 298: put privacy duties in professional staff bylaws and reappointment—credentialing is the control for privileged EHR access.
5 min read - CISSP
OWE / Enhanced Open: Encrypting Guest Wi-Fi Without a Shared Password
Open guest Wi-Fi leaks traffic to anyone nearby. OWE / Enhanced Open encrypts the air without a shared PSK—fix guest isolation still matters.
6 min read