Data Privacy & Digital Rights
Canada operates a federated privacy framework: PIPEDA + Privacy Act federally, Quebec Law 25, BC/AB PIPA. OPC + provincial Privacy Commissioners enforce. Criminal Code s.162.1 covers NCII.
Covered in this guide:
Canada's privacy framework is federated. PIPEDA (Personal Information Protection and Electronic Documents Act) covers the federally-regulated private sector. The Privacy Act covers the federal public sector. Quebec's Law 25 (formerly Bill 64) applies stricter rules to private-sector data processing of Quebec residents. BC's PIPA and Alberta's PIPA are substantially similar provincial private-sector laws. Regulator: OPC (Office of the Privacy Commissioner of Canada) federally; provincial Privacy Commissioners in Quebec (Commission d'accès à l'information), BC, AB. For NCII, Criminal Code s.162.1 (in force from Bill C-13, 2014) criminalises non-consensual distribution of intimate images — up to 5 years.
Key Laws
PIPEDA — Personal Information Protection and Electronic Documents Act
SC 2000, c.5; in force 2004
Canada's federal private-sector privacy law. Applies to organisations engaged in commercial activities, except where a substantially similar provincial law applies (Quebec Law 25, BC PIPA, AB PIPA). Data-subject access, correction. Regulator: OPC. Reform-via-CPPA paused but ongoing.
Quebec Law 25 (Loi modernisant des dispositions législatives en matière de protection des renseignements personnels)
Bill 64 / Law 25; phased in 2022–2024
Significantly modernised Quebec's private-sector privacy law (Act Respecting the Protection of Personal Information in the Private Sector). Higher standards than PIPEDA: mandatory privacy officer, mandatory PIA for certain projects, breach notification, fines up to CAD 25 million or 4% of global turnover. Regulator: Commission d'accès à l'information du Québec.
Criminal Code s.162.1 (non-consensual distribution of intimate images)
Criminal Code RSC 1985 c C-46 s.162.1; introduced by Bill C-13, 2014
Criminalises publishing, distributing, transmitting, or making available an intimate image of another person knowing they did not give consent (or being reckless as to consent). Penalty: indictable, up to 5 years; summary, up to 6 months.
Removing Non-Consensual Intimate Imagery (NCII)
NCII in Canada is criminal under Criminal Code s.162.1 (in force from Bill C-13, 2014) — non-consensual distribution of intimate images, up to 5 years on indictment. Investigation: local police (RCMP...
Your Rights Under PIPEDA + Provincial Privacy Acts (Quebec Law 25, BC/AB PIPA)
Canadian privacy law is federated. PIPEDA federally + Quebec Law 25 + BC PIPA + AB PIPA for provincial private sector. The applicable law depends on where the organisation operates and where the data...
Cyberstalking and Online Harassment in Canada
Canadian cyberstalking and online harassment fall under Criminal Code s.264 (criminal harassment / stalking) — up to 10 years on indictment. s.162.1 covers NCII; s.372 (false messages, indecent commun...