Privacylawyer - Canadian privacy and technology law with David Fraser

Canada's federal private-sector privacy law may be about to undergo its biggest transformation in more than 25 years.Bill C-36 would repeal the privacy provisions of PIPEDA and replace them with the new Protecting Privacy and Consumer Data Act (PPCDA). The bill introduces mandatory privacy management programs, enhanced consent requirements, new rights to dispose of personal information, privacy impact assessments for cross-border data transfers, significant administrative monetary penalties, and an entirely new enforcement model that replaces the current role of the Privacy Commissioner of Canada.This episode explains the key provisions of Bill C-36, compares it with the earlier Bills C-11 and C-27, and discusses what these proposed changes could mean for Canadian businesses, privacy professionals, and individuals.Follow the progress of the Bill here: https://www.parl.ca/LegisInfo/en/bill/45-1/C-36Read Professor Michael Geist's commentary here: https://www.michaelgeist.ca/2026/06/canadas-digital-super-regulator-bill-c-36-pushes-out-the-privacy-commissioner-and-hands-private-sector-privacy-to-an-overloaded-commission/Read Professor Teresa Scassa's commentary here: https://teresascassa.substack.com/p/canadas-new-privacy-reform-bill-bill#Privacy #PIPEDA #BillC36 #CanadianPrivacyLaw #DataProtection #PrivacyLaw #Canada #PPCDA #DigitalPrivacy #LegalUpdate #privacylawyer Where you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/david-fraser► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

A breakdown of Canada's newly introduced Bill C-34, the Safe Social Media Act. Reintroduced as an update to the controversial and stalled Bill C-63 (the Online Harms Act), Bill C-34 expands the government's regulatory scope to include not only traditional social media platforms but also AI-driven chatbots and other interactive online services. This overview covers the bill’s major changes—including new under-16 account restrictions, mandatory age-verification for all, explicit labeling of synthetic AI content, and the Digital Safety Commission of Canada. I refer to Michael Geist's blog post, which you can find here: https://www.michaelgeist.ca/2026/06/the-law-to-be-named-later-bill-c-34-punts-50-key-decisions-to-cabinet-and-a-digital-safety-commission-that-does-not-yet-exist/ Follow the progress of this bill and read the latest version here: https://www.parl.ca/LegisInfo/en/bill/45-1/C-34 Where you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/david-fraser► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

An Overview of Part 2 of Bill C-22, the Lawful Access Act 2026. Part 2 creates the "Supporting Authorized Access to Information Act", which will require electronic service providers to create new capabilities for law enforcement and national security folks to get access to customer information. #lawfulaccess #surveillance #privacy #charterofrights Where you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/david-fraser► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

A deep dive into the "Production Order for Subscriber Information" proposed in Bill C-22, the Lawful Access Act. What is it? What does it do? What is different from the original proposal in Bill C-2 (the Strong Borders Act)? And what's the likely fatal flaw that will mean it will be found to be unconstitutional? My "Lawful Access" playlist, including episodes from this channel and other commentators: https://www.youtube.com/playlist?list=PLV759uJFOchhpCq8rakXDYdwJP3xYSrtf Where you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/david-fraser► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

Lawful Access playlist, including my videos and from others on the topic: https://www.youtube.com/playlist?list=PLV759uJFOchhpCq8rakXDYdwJP3xYSrtf My Bill C-22 Lawful Access "deep dive" episode: https://youtu.be/tZFbTYttuN8?list=PLV759uJFOchhpCq8rakXDYdwJP3xYSrtfWhere you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/david-fraser► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

On March 12, 2026, the Canadian Public Safety Minister tabled Bill C-22 in Parliament: the Lawful Access Act, 2026, which will create new police information demands and require "electronic service providers" to create new capabilities for the interception and retrieval of data for the police and national security authorities. Part 1 is much improved since it was first introduced as Part 14 of the "Strong Borders Act." Part 2, however, is deeply problematic as it has the potential to create a expansive surveillance infrastructure -- mostly in the shadows -- beyond what I think Canadians can tolerate. Where you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/david-fraser► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

An overview of privacy law that regulates private sector businesses in Canada (or those outside of the country who deal with personal information of Canadians): the Personal Information Protection and Electronic Documents Act (PIPEDA).0:00 Beginning 0:57 Introduction2:23 Why Canada has a mess of privacy laws5:43 The Canadian Standards Association Model Code for the protection of personal information6:40 How was the Personal Information Protection and Electronic Documents Act (PIPEDA) developed? 8:11 Key concepts - "commercial activity"9:02 Key concepts - "personal information"10:53 PIPEDA's baseline "reasonableness" requirement at s. 5(3)12:16 Principle 1 - Accountability16:09 Principle 2 - Identifying purposes16:47 Principle 3 - Consent20:13 Principle 4 - Limiting collection20:58 Principle 5 - Limiting use, disclosure and retention22:08 Principle 6 - Accuracy22:47 Principle 7 - Safeguards24:23 Principle 8 - Openness25:49 Principle 9 - Individual access26:58 Principle 10 - Challenging compliance27:40 Enforcement under PIPEDA31:22 Court applications under PIPEDA34:16 Data breach notification37:38 Real risk of significant harm (RROSH) analysis40:25 Data breach record-keeping requirements41:36 Wrap-upWhere you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/david-fraser► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

Online fraud is a widespread, everyday risk that affects individuals, families, businesses, and public institutions. Drawing on real-world examples from my privacy law practice, I walk through how common scams work, from email account compromises and funds-transfer fraud to tech-support scams, ransomware, and “grandparent” scams (increasingly powered by AI).I also focus on practical, concrete steps that individuals can take to reduce their risk. There’s no such thing as perfect security, but understanding how scammers exploit urgency, trust, and information asymmetry can make a real difference. This episode is based on a presentation I was invited to give on Data Privacy Day for a client's employees. 0:00 Introduction0:53 What is privacy and why does it matter?6:13 Common frauds I'm seeing12:19 So what can you do to protect yourself? 16:07 Wrap-upWhere you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/david-fraser► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

In this episode, I examine a recent Report of Findings and Order issued by British Columbia’s Information and Privacy Commissioner concerning the City of Richmond’s “Public Safety Camera System” field test. The City installed high-resolution intersection cameras intended to provide footage to police to help identify criminal suspects. The Commissioner concluded that the City lacked lawful authority under BC’s Freedom of Information and Protection of Privacy Act to collect this personal information, failed to meet statutory notice requirements, and could not rely on planning or law-enforcement exceptions to justify the program. Because the City declined to follow the Commissioner’s recommendations, a binding order was issued requiring the City to stop collection, delete the footage, and dismantle the system.The OIPC-BC finding can be found here (PDF): https://www.oipc.bc.ca/documents/orders/3071 Where you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/david-fraser► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

This episode of PrivacyLawyer examines proposed amendments to the Criminal Code of Canada in Bill C-16, the Protecting Victims Act, which would expand the definition of “intimate image” to include certain AI-generated and deepfake images. The episode explains how the existing offence for the non-consensual distribution of intimate images was designed around real photographs and video recordings, and why that definition has struggled to keep pace with the rapid growth of synthetic and generative imagery.I walk through the current legal framework, including recent provincial civil legislation, and highlight the gap that exists for purely synthetic images that are realistic but not based on altered source photos. The discussion then focuses on the specific language proposed in Bill C-16, which would capture realistic visual representations that could reasonably be mistaken for actual recordings of an identifiable person, even where no real image ever existed.The episode also explores potential freedom of expression concerns under section 2(b) of the Charter of Rights and Freedoms, particularly where AI-generated imagery is used for political satire or commentary, and considers whether the existing “public good” defence is sufficient. Finally, it reviews Bill C-16’s proposed new offence of threatening to distribute intimate images, explaining how it goes beyond traditional sextortion and why it represents a significant change to Canadian criminal law.Information on Bill C-16 can be found here: https://www.parl.ca/LegisInfo/en/bill/45-1/C-16Where you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/david-fraser► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.