Canada: Data Protection

A personal health number can only legally be collected by certain organizations for certain purposes. Organizations now risk the over collection of personal information, which creates privacy management risks for employers who regularly collect employee identification information as part of their operations.

Employers hold vast amounts of sensitive employee data, from social insurance numbers to medical records, creating significant privacy risks. As technology enables unprecedented surveillance capabilities and Canada's privacy laws continue to evolve, organizations must proactively safeguard employee information through robust policies, access controls, and comprehensive training programs.

Canadian privacy regulators have issued comprehensive findings on OpenAI's ChatGPT practices, establishing new compliance expectations for AI developers across consent requirements, data accuracy, and individual rights. The joint investigation by federal and provincial privacy commissioners reveals critical divergences in how different jurisdictions interpret consent for training data, while providing practical guidance on implementing access, correction, and deletion rights within the technical constraints

Canada's privacy landscape is evolving rapidly with Bill C-36 and new cybersecurity legislation. This comprehensive guide examines practical steps organizations should take...

Artificial intelligence is transforming Canadian agriculture, offering producers new tools to work smarter and reduce costs. Before investing in AI technology for farm operations, producers must carefully evaluate what these tools can accomplish, understand data ownership and privacy implications, and assess the true costs versus potential returns.

Le ministère des Finances a publié le projet de règlement tant attendu pour faciliter la mise en œuvre de la Loi sur les services bancaires axés sur les consommateurs. Ce cadre réglementaire établit des exigences détaillées concernant l'accréditation, la sécurité, le consentement, l'authentification et le partage des données financières des consommateurs. Les institutions financières, les entreprises de technologie financière et

As artificial intelligence evolves, digital twins—AI-powered replicas of employees—are emerging in workplaces, capturing knowledge, communication styles, and decision-making patterns. While these systems promise enhanced productivity and knowledge preservation, they introduce complex legal questions around data privacy, ownership rights, employment relationships, and liability that employers must navigate carefully.

On June 15, 2026, the federal government introduced Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act (PPCDA). If enacted, this long‑awaited legislation would mark the most significant reform of Canada's federal private-sector privacy regime in more than two decades.

This is a monthly bulletin published by the Privacy and Cybersecurity Group at Fasken with noteworthy news and updates. If you have any questions about the items in this bulletin, please contact any member of the Privacy and Cybersecurity Group and we will be pleased to assist.