Privacy Pulse: Federal Privacy Law Bill, Privacy Law Damages, And More

This summer and spring brought important developments in privacy and access to information laws.

Freedom of information

July 1, 2026 – Amendments to the Ontario Freedom of Information and Protection of Privacy Act (FIPPA) came into force that include:

• An exception from FIPPA for the records of a Minister’s office, with certain qualifications. The exception is controversial and appears related to a request for the Premier’s cell phone records. The exception applies retroactively.
• An extension of the basic time period for responding to freedom of information requests from 30 calendar days to 45 business days.
• An ability to provide access to records in stages, if the request is extensive or otherwise burdensome.

Certain related amendments were also made to the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA).

Federal privacy legislation

June 15, 2026 – The federal government introduced a bill to modernize Canadian privacy law and enact the Protecting Privacy and Consumer Data Act (PPCDA). The PPCDA would replace the privacy provisions of the currently in force Personal Information Protection and Electronic Documents Act (known as PIPEDA). The bill is in first reading in the House of Commons and is likely to be amended throughout the parliamentary process. The bill follows previous parliamentary attempts to reform Canadian privacy law in 2020 and 2022. The bill contains variations from the 2020 and 2022 documents. Relative to PIPEDA, the most significant changes are:

• Penalties up to the greater of a) $10,000,000 or b) 3% of global revenue, for violation of certain listed sections of the PPCDA.
• Fines up to the greater of a) $25,000,000 or b) 5% of global revenue, for certain knowing misconduct and obstruction of enforcement processes.
• A Digital Safety and Data Protection Commission with expanded enforcement powers relative to the current Privacy Commissioner under PIPEDA.
• A private right of action enabling individuals to sue organizations that are found non-compliant under certain circumstances.
• An express individual right to request deletion of personal information
• A requirement to have, beyond a privacy policy, a privacy management program that addresses how privacy requests and complaints are handled, internal privacy training for staff, and the development of privacy policies and procedures.
• A requirement to perform privacy impact assessments if transferring personal information outside Canada
• New exceptions to the consent requirement for collecting personal information, including:
  • Specified business purposes including provision of a product or service and network security, subject to certain conditions.
  • Legitimate interests of the business that outweigh any adverse impact on the privacy of the individual, subject to certain conditions including a privacy impact assessment

The PPCDA would bring Canadian federal privacy law into closer alignment with the standards set by European privacy law and with Quebec’s provincial privacy legislation.

Privacy law civil damages

May 26, 2026 – The Ontario Superior Court of Justice awarded damages of $21.5 million for the privacy civil wrong of “intrusion upon seclusion” (as well as $1 million in punitive damages) to a class of about 7,000 patients in the case of J.C. et al. v. Jugenburg et al. In that case, the defendant plastic surgeon had installed surveillance cameras in consultation rooms, pre- and post-operation areas, and in operating rooms.

Customer accounts and privacy compliance

March 5, 2026 – The federal Office of the Privacy Commissioner (OPC) issued findings that Loblaws had failed to comply with PIPEDA with respect to PC Optimum customer accounts. The OPC found that Loblaws retained personal information longer than necessary by reason of a) failing to delete accounts within a reasonable time after customers requesting account closure, and b) applying insufficient measures to anonymize personal information in customer accounts after closure rather than deleting or truly anonymizing the information. The OPC’s findings also related to individuals’ right to raise privacy concerns with a business in relation to the business’s privacy policies and procedures.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.