Canada: Privacy

BC’s Intimate Images Protection Act (“IIPA”) gives recourse to individuals who experience the non-consensual sharing of their intimate images.

Canadian privacy laws require organizations to notify privacy commissioners and affected individuals when breaches meet specific thresholds, but the process varies across federal and provincial jurisdictions. Understanding when notification is mandatory, what constitutes a "real risk of significant harm," and how to navigate the requirements under PIPEDA, Alberta's PIPA, and Quebec's Law 25 is essential for compliance.

The British Columbia Court of Appeal (BCCA) recently confirmed the British Columbia courts’ jurisdictional competence over foreign litigants that conduct business virtually with British Columbians. In Airbnb, Inc. v. Ware, the BCCA partially allowed Airbnb’s appeal of certification, finding that the real and substantial connection analysis cannot be based solely on a foreign entity’s relationship to other defendants or ancillary activities. In Clearview AI Inc. v. British Columbia (Information and Privacy Commissioner), the BCCA held that provincial privacy law applies to foreign businesses that operate online.