Data protection
The Personal Information Protection and Electronic Documents Act applies to commercial activity across Canada, except where a province has substantially similar legislation — Quebec, British Columbia and Alberta. Quebec's Law 25 imposes consent, breach notification and portability requirements comparable to the GDPR. Federal reform bills have repeatedly failed to pass.
Key points
| Federal | PIPEDA: access, correction and complaint to the Privacy Commissioner |
|---|---|
 Quebec | Law 25: explicit consent, privacy officer, breach reporting, portability since 2024, heavy penalties |
| British Columbia and Alberta | Substantially similar provincial statutes |
| Health data | Provincial health information statutes apply |
| Breach notification | Mandatory under PIPEDA where there is a real risk of significant harm |
| Enforcement | The federal Commissioner can investigate and recommend; Quebec can impose substantial penalties |
| Reform | Federal modernisation bills have not been enacted |
| PIPEDA | Applies to commercial activity; substantially similar provincial laws apply in three provinces |
| Findings not orders | The federal Commissioner makes findings; binding orders require the Federal Court |
| Quebec Law 25 | Adds breach notification, portability and de-indexing rights |
| Breach reporting | Mandatory where there is a real risk of significant harm |
In practice
- Complain to the organisation first: the Commissioner will ask whether you did.
- In Quebec, use the de-indexing right where search results are the problem.
Cost and coverage
Free; organisations may charge only minimal reproduction costs in limited circumstances.
Recent changes
Quebec's Law 25 has effectively become the national benchmark, because national companies apply its standards everywhere rather than run two systems.
Where to go
- Office of the Privacy Commissioner of Canada.
- Commission d'accès à l'information du Québec.
- Provincial commissioners in British Columbia and Alberta.
Worth knowing
If you deal with a company operating nationally, invoking Quebec's rules can be effective even outside Quebec, because most large organisations have aligned their practices to the strictest standard they face. The federal Commissioner cannot impose fines. Quebec's regime, by contrast, has substantial penalties and is the stronger route where it applies.
The general article: Data protection · Compare with another country
Privacy
PIPEDA governs personal information in commercial activity federally, while Quebec, Alberta and British Columbia have their own substantially similar laws. In 2012 the Ontario Court of Appeal recognised the tort of intrusion upon seclusion in Jones v Tsige, and other provinces have statutory privacy torts actionable without proof of damage.
Key points
| Federal statute | PIPEDA, supervised by the Privacy Commissioner of Canada |
|---|---|
| Provincial statutes | Quebec, Alberta and British Columbia have their own regimes |
| Quebec | Law 25 has added notification, portability and de-indexing rights |
| Tort | Intrusion upon seclusion, recognised in Ontario in 2012 |
| Statutory torts | British Columbia, Manitoba, Saskatchewan and Newfoundland: actionable without proof of damage |
| Charter | Section 8 protects against unreasonable search by the state |
| Public disclosure tort | Recognised in Ontario in addition to intrusion upon seclusion |
| Internet harassment tort | Recognised by an Ontario court for sustained online campaigns |
| Criminal Code | Voyeurism and interception offences supplement the civil remedies |
In practice
- Where the conduct is sustained and targeted, plead harassment as well as privacy.
Where to go
- Office of the Privacy Commissioner of Canada.
- Provincial privacy commissioner.
- Provincial small claims court for modest damages.
Worth knowing
The federal Commissioner can make findings and recommendations but has limited power to fine; for a financial remedy you usually have to go to court. The Ontario courts have been the engine of Canadian privacy law. Decisions there are persuasive but not binding in other provinces.
Image rights
Outside Quebec there is no general right to your image; the criminal law on intimate images and new provincial statutes do the work.
Common-law Canada has no general right to control one's likeness — Quebec is the exception, where the Civil Code protects image as an aspect of privacy. Section 162.1 of the Criminal Code makes publishing an intimate image without consent an offence, and several provinces have added civil statutes allowing fast take-down orders and damages without proving financial loss.
Key points
| Criminal Code | Section 162.1: publication of an intimate image without consent |
|---|---|
| Voyeurism | Section 162: surreptitious recording where privacy is reasonably expected |
| Provincial statutes | Intimate images protection acts in several provinces, with expedited procedures |
| Quebec | Image protected by the Civil Code, following Aubry v Editions Vice-Versa |
| Data protection | PIPEDA applies to images used commercially |
| Removal orders | Courts can order removal and destruction |
| Expedited provincial process | Several provinces allow an application without a lawyer, decided in days |
| Deemed distribution | Some statutes treat failure to remove as continuing distribution |
| Damages without proof of loss | Available under the provincial intimate image statutes |
In practice
- Use the provincial statute where one exists: it is far faster than a criminal complaint.
Where to go
- Canadian Centre for Child Protection, Cybertip.ca.
- NeedHelpNow.ca for young people.
- Provincial intimate image protection unit, where one exists.
Worth knowing
The provincial civil statutes are usually the fastest route: they were designed for quick removal orders without the delay of a criminal prosecution. The provincial statutes were designed for speed and allow orders against platforms as well as individuals. Check whether your province has one.
The general article: Image rights · Compare with another country
Speech and online harassment
Defamation is a civil matter with a reversed burden on falsity, and anti-SLAPP laws protect public interest speech in some provinces.
Canadian defamation law presumes a defamatory statement is false, placing the burden on the defendant to prove truth, fair comment or responsible communication on a matter of public interest. Ontario and British Columbia have anti-SLAPP legislation allowing early dismissal. Criminal libel exists but is very rarely used.
Key points
| Burden | Falsity is presumed; the defendant must establish a defence |
|---|---|
| Defences | Justification, fair comment, qualified privilege, responsible communication |
| Anti-SLAPP | Ontario, British Columbia and Quebec provide early dismissal mechanisms |
| Limitation | Short — often three months' notice and two years to sue in some provinces |
| Intimate images | Non-consensual distribution is a criminal offence since 2015; several provinces add civil remedies |
| Criminal harassment | Covers repeated online contact causing fear |
| Online Harms | Legislation on online harms has been proposed and debated |
| Notice requirement | Provincial acts require written notice to a newspaper or broadcaster within a short period |
| Responsible communication | A defence protecting publication on matters of public interest |
| Criminal defamation | Still on the books but very rarely used |
In practice
- Serve the statutory notice immediately where a media outlet is involved: the deadline is days, not months.
- Expect an anti-SLAPP motion if the subject is a matter of public interest.
Cost and coverage
Civil claims are expensive; criminal reporting is free. Anti-SLAPP motions can recover costs where they succeed.
Recent changes
Provincial intimate image statutes allow fast civil orders for removal, and some provide statutory damages without proving loss.
Where to go
- NeedHelpNow.ca for image removal support.
- Canadian Centre for Child Protection and Cybertip.ca.
- Provincial victim services and local police.
Worth knowing
Notice periods for defamation in some provinces are as short as three months. If you intend to sue, take advice immediately rather than after trying to resolve it informally. The notice period for claims against media outlets is extremely short in most provinces. Missing it ends the claim before it starts.
The general article: Speech and online harassment · Compare with another country
Copyright
The term moved to life plus seventy years at the end of 2022, and user-generated content has its own exception.
Canada extended its copyright term from life plus fifty to life plus seventy years with effect from 30 December 2022, without reviving works already in the public domain. Fair dealing is a closed list of purposes but a generous one, including education, parody and satire. Section 29.21 contains a distinctive non-commercial user-generated content exception, sometimes called the mashup provision.
Key points
| Term | Life plus 70 years since 30 December 2022; works already public domain stayed public domain |
|---|---|
| Fair dealing | Research, private study, education, parody, satire, criticism, review, news reporting |
| Section 29.21 | Non-commercial user-generated content exception, unique to Canada |
| Notice and notice | Rights holders' notices are forwarded to subscribers; no takedown obligation |
| Statutory damages | Capped at a low figure for non-commercial infringement |
| Moral rights | Cannot be assigned, only waived |
| Crown copyright | Reduced in scope, with much government material openly licensed |
| Statutory damages cap | Low for non-commercial infringement, deliberately |
In practice
- Do not pay a settlement demand attached to a forwarded notice without checking the statutory cap.
Recent changes
The term extension took effect on 30 December 2022 under the Canada-United States-Mexico Agreement.
Where to go
- Canadian Intellectual Property Office.
- Access Copyright and SOCAN.
- Federal Court for infringement claims.
Worth knowing
The cap on statutory damages for non-commercial infringement was introduced to stop mass letter campaigns against individuals: a demand for thousands of dollars over a personal download is usually not enforceable at that level. Forwarded notices often contain settlement demands that exceed what a court could award. The statutory cap for non-commercial infringement is deliberately low.
The general article: Copyright · Compare with another country
Identity theft
Identity theft has been a distinct criminal offence since 2010, and the Canadian Anti-Fraud Centre coordinates reporting.
Section 402.2 of the Criminal Code, added in 2010, made it an offence to obtain or possess another person's identity information with intent to use it to commit fraud — a step earlier than the fraud itself. Reports go to local police and to the Canadian Anti-Fraud Centre, and fraud alerts can be placed with Equifax Canada and TransUnion Canada.
Key points
| Offence | Criminal Code section 402.2, identity theft; section 403, identity fraud |
|---|---|
| Reporting | Local police and the Canadian Anti-Fraud Centre |
| Fraud alerts | Equifax Canada and TransUnion Canada; free credit reports on request |
| Quebec | Law 25 gives a right to a credit freeze-style protection and mandatory breach notification |
| Documents | Replace a lost SIN card through Service Canada; the number itself is rarely changed |
| Bank liability | Cardholder agreements and the code of conduct protect against unauthorised transactions |
| Six-year alerts | Fraud alerts can be extended; ask for the longest available period |
| Free credit reports | By mail from both bureaus, at no charge |
| CRA | Notify the tax authority if your SIN may have been used |
In practice
- Call your bank and the card issuer first.
- Report to local police and get a file number, then to the Canadian Anti-Fraud Centre.
- Place a fraud alert with both credit bureaus and request your free reports.
- Contact Service Canada if your Social Insurance Number has been compromised.
- Notify the Canada Revenue Agency: fraudulent benefit claims are a common follow-on.
Where to go
- Canadian Anti-Fraud Centre.
- Equifax Canada and TransUnion Canada.
- Service Canada for SIN issues.
Worth knowing
Canada does not change a Social Insurance Number simply because it was exposed. Monitoring and fraud alerts are the realistic protection, so set them up and renew them. The SIN is rarely reissued. Because it cannot be changed, monitoring and alerts are the only long-term protection.
The general article: Identity theft · Compare with another country
Online shopping
No general cooling-off period, but provincial consumer laws allow cancellation when a seller fails to deliver or disclose.
Consumer protection is provincial. Most provinces regulate internet agreements: the seller must disclose specified information before the contract, and the consumer may cancel within a set period if that information was not given, or if the goods are not delivered within thirty days of the promised date. Credit card issuers must then reverse the charge.
Key points
| Disclosure | Required before an internet agreement; failure allows cancellation |
|---|---|
| Non-delivery | Cancellation right where goods are not delivered within 30 days of the promised date |
| Chargeback | Card issuers must reverse charges on a valid cancellation in most provinces |
| Cooling-off | No general right to change your mind |
| Quebec | The Consumer Protection Act is the strictest, including rules on warranties of reasonable durability |
| Advertising | Misleading advertising is prohibited federally under the Competition Act |
| Small claims | Provincial courts with simple procedures and low limits |
| Provincial consumer law | Cooling-off rights exist for specific contract types, varying by province |
| Online purchases | Several provinces allow cancellation if required disclosure was not given |
| Implied warranties | Statutory conditions of merchantable quality apply in every province |
In practice
- Check whether the trader gave the required pre-contract disclosure — its absence may allow cancellation.
- File a complaint with the provincial consumer protection office; they mediate.
Cost and coverage
Provincial consumer complaints are free; small claims fees are modest.
Recent changes
Quebec's legal warranty of reasonable durability is regularly used to obtain free repairs for appliances and electronics well beyond the manufacturer's warranty.
Where to go
- Provincial consumer protection offices.
- Competition Bureau for misleading advertising.
- Small claims divisions of provincial courts.
Worth knowing
In Quebec, the legal warranty means goods must last a reasonable time given the price paid — a right that exists independently of any manufacturer's warranty and is worth invoking by name. Several provinces let you cancel an online contract within a year if the trader failed to give required disclosure. That is a much longer window than most people expect.
The general article: Online shopping · Compare with another country
Romance scams
A national anti-fraud centre that collects reports, and reimbursement that depends on the account agreement.
The Canadian Anti-Fraud Centre takes reports by phone and online and feeds police investigations, but does not recover funds itself. The police report goes to the local force. Credit cards allow a chargeback; electronic transfers are very difficult to recover. Investment fraud goes to the provincial securities regulator. Identity theft is handled through fraud alerts placed with the two national credit bureaus.
The Canadian Anti-Fraud Centre collects reports nationally and feeds intelligence to police forces, but it does not investigate individual cases — that falls to your local police. Reimbursement depends on your account agreement rather than on statute: for unauthorised transactions, card and banking codes generally protect you; for a transfer you authorised after being deceived, there is no equivalent to the British reimbursement rule.
Key points
| Reporting | Canadian Anti-Fraud Centre, by phone or online |
|---|---|
| Police report | Local police force, separately |
| Credit card | Chargeback available, with a short deadline |
| Electronic transfer | Very difficult to recover once accepted |
| Investment fraud | Provincial securities regulator |
| Identity theft | Fraud alerts with the two credit bureaus |
| Reimbursement | Governed by the account agreement, not by statute |
In practice
- Report to the anti-fraud centre even where nothing was lost: it is how networks are mapped.
- Request a chargeback in writing from the card issuer, within the scheme deadline.
- Place a fraud alert with both credit bureaus if identity documents were shared.
- Read the account agreement clause on unauthorised transactions before accepting a refusal.
Cost and coverage
Reporting is free; chargebacks are free to request.
Where to go
- Canadian Anti-Fraud Centre.
- Local police force.
- Your bank's fraud department, immediately.
- Provincial securities regulator, for investment fraud.
Worth knowing
Recovery here is contractual, not statutory. The wording of your account agreement, not the law, decides whether the bank pays — which makes reading it the first step in any dispute.
Frequently asked questions
Will the bank refund an e-transfer I sent myself?
Usually not. Interac e-Transfers are treated as authorised payments, and once claimed they are very difficult to recover. Unauthorised card transactions are a different matter and are generally covered. Report to your bank within minutes; if the transfer has not been deposited it can sometimes be cancelled.
Sources
- Canadian Anti-Fraud Centre — report online or call 1-888-495-8501
- Office of the Privacy Commissioner — if personal data was exposed
- Emergency — 911 — if the threat is immediate
- Canadian Securities Administrators — investor alerts — national registration search and alerts on unregistered platforms
- Canadian Centre for Cyber Security — alerts and advice for individuals
The general article: Romance scams · Compare with another country
General sources
- Canada.ca — official government portal
- Justice Laws Website — federal statutes and regulations