Canada: Data Protection

Employers hold vast amounts of sensitive employee data, from social insurance numbers to medical records, creating significant privacy risks. As technology enables unprecedented surveillance capabilities and Canada's privacy laws continue to evolve, organizations must proactively safeguard employee information through robust policies, access controls, and comprehensive training programs.

Canadian privacy regulators have issued comprehensive findings on OpenAI's ChatGPT practices, establishing new compliance expectations for AI developers across consent requirements, data accuracy, and individual rights. The joint investigation by federal and provincial privacy commissioners reveals critical divergences in how different jurisdictions interpret consent for training data, while providing practical guidance on implementing access, correction, and deletion rights within the technical constraints

Ce bulletin mensuel a été préparé par le groupe Protection des renseignements confidentiels, vie privée et cybersécurité de Fasken pour vous présenter les actualités et les développements récents qui ont attiré notre attention. Si vous avez des questions sur l’un des sujets abordés dans ce bulletin, communiquez avec l’un des membres de ce groupe, qui se fera un plaisir de vous aider.

Artificial intelligence is transforming Canadian agriculture, offering producers new tools to work smarter and reduce costs. Before investing in AI technology for farm operations, producers must carefully evaluate what these tools can accomplish, understand data ownership and privacy implications, and assess the true costs versus potential returns.

Le ministère des Finances a publié le projet de règlement tant attendu pour faciliter la mise en œuvre de la Loi sur les services bancaires axés sur les consommateurs. Ce cadre réglementaire établit des exigences détaillées concernant l'accréditation, la sécurité, le consentement, l'authentification et le partage des données financières des consommateurs. Les institutions financières, les entreprises de technologie financière et

Canada's proposed overhaul of its federal privacy regime would merge privacy oversight into a broader mandate to prevent online harm. A new Digital Safety and Data Protection Commission would hold that dual mandate.

On June 15, 2026, the federal government introduced Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act (PPCDA). If enacted, this long‑awaited legislation would mark the most significant reform of Canada's federal private-sector privacy regime in more than two decades.

This is a monthly bulletin published by the Privacy and Cybersecurity Group at Fasken with noteworthy news and updates. If you have any questions about the items in this bulletin, please contact any member of the Privacy and Cybersecurity Group and we will be pleased to assist.

Quebec's Commission d'accès à l'information is taking an increasingly proactive stance on privacy compliance, examining businesses' governance policies and practices even when investigations begin with limited complaints. Recent decisions reveal critical requirements for collecting social insurance numbers, implementing facial recognition systems, and maintaining proper transparency measures under Quebec's Private Sector Act.