Canada: Cybersecurity

Ce bulletin mensuel a été préparé par le groupe Protection des renseignements confidentiels, vie privée et cybersécurité de Fasken pour vous présenter les actualités et les développements récents qui ont attiré notre attention. Si vous avez des questions sur l’un des sujets abordés dans ce bulletin, communiquez avec l’un des membres de ce groupe, qui se fera un plaisir de vous aider.

The guidance emphasizes that organizations remain accountable for personal information under their control, including where it is collected, used, disclosed or processed by a third party, and should conduct privacy due diligence to identify compliance risks, inform contractual protections and demonstrate accountability. The OPC is accepting comments on the guidance until December 4, 2026.

The Ontario Court of Appeal's decision in Panasonic Canada Inc. v. XL Specialty Insurance Company establishes that coverage analysis must focus on the true nature of the loss rather than the coverage provision an insured selects. When a ransomware endorsement contains specific language governing losses connected to cyber-extortion threats, that endorsement may control the claim even when the insured seeks recovery under different policy provisions and never paid a ransom.

This is a monthly bulletin published by the Privacy and Cybersecurity Group at Fasken with noteworthy news and updates. If you have any questions about the items in this bulletin, please contact any member of the Privacy and Cybersecurity Group, and we will be pleased to assist.

AI is everywhere. It’s being tested, approved, and rolled out across organizations. Inaccurate and hallucinated outputs continue to surface, and legal and professional consequences make headlines. Earlier this year, the Georgia Supreme Court suspended a prosecutor after AI-generated fake citations appeared in a court filing, leading the court to vacate the ruling entirely.

Ontario's proposed Data Centre Playbook establishes a two-part assessment framework for grid connections, requiring data centres to fund full electricity costs while meeting strategic priorities around economic development, digital sovereignty, and community investment. The policy positions grid access as a key lever for governing data centre development amid surging demand that could reach 40% of the province's peak electricity capacity.

Canada's National Artificial Intelligence Strategy marks a significant shift in federal AI policy, moving away from standalone legislation toward a comprehensive framework that emphasizes privacy reform, data sovereignty, and business adoption. The Strategy outlines six interconnected pillars designed to position Canada as a global AI leader while addressing regulatory gaps through existing legal frameworks and new policy tools.

Canada's proposed federal privacy reform would integrate privacy oversight into a broader online harms prevention mandate through a new Digital Safety and Data Protection Commission. This consolidated regulator would wield expanded enforcement powers, including binding orders and substantial fines, while overseeing both privacy protection and digital safety legislation.

Following similar forums held in 2018 and 2023, the Canadian Securities Regulatory Organization (CIRO) is hosting another series of cybersecurity table-top exercises for investment dealers and mutual fund dealers on September 30 (Toronto) and October 7 (Calgary). The forum is intended to allow participants to discuss threats, gaps in response plans and best practices through targeted case scenarios. All CIRO members are invited to participate, and CIRO has separately requested input on the development of the case scenarios.