Privacylawyer - Canadian privacy and technology law with David Fraser

Is Lawful Access Back? With comments on the govt’s’ disinformation-filled attempt to revive it

On November 19, government officials surprised many by apparently calling for the revival of #LawfulAccess measures from Bill C-2, the Strong Borders Act. The presser was filled with incorrect and misleading information. Here's my take on it, with some corrections/clarifications of some pretty problematic statements. The government's press conference is here: https://youtu.be/GoQ2lL0rAJ4My previous video on Part 14 of #BillC2: https://youtu.be/wOgo4TuoJecMy previous video on Part 15 of #BillC2: https://youtu.be/E1LV2fcD9Bs Hat-tip to Michael Geist: https://www.michaelgeist.ca/2025/11/reversing-the-reversal-government-puts-privacy-invasive-lawful-access-back-on-the-agenda/ Here's the decision in R. v. Owen, 2017 ONCJ 729 https://canlii.ca/t/hmx7sWhere you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/david-fraser► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

Online reviews and privacy claims: Lessons from RateMDs v Bluler (BCCA)

Canadian privacy lawyer David Fraser breaks down the British Columbia Court of Appeal’s recent decision in RateMDs Inc. v. Bleuler (https://canlii.ca/t/kfhmc), a case about whether hosting online profiles, anonymous reviews, and ranking health professionals on RateMDs.com can result in a claim of invasion of privacy. David walks through the background, the arguments, why the Court found there was no reasonable expectation of privacy in publicly available professional information, and what this means for privacy rights, online review platforms, and professionals across Canada.Where you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/david-fraser► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

Nova Scotia’s new Freedom of Information and Protection of Privacy Act (Bill 150)

With no notice and largely out of the blue (following an opaque process), the Nova Scotia government just passed a revamped public sector privacy and access to information law, Bill 150. In this episode, I provide a high level overview of what's new, including the good, the bad and the meh. The new law can be found here: https://www.canlii.org/en/ns/laws/astat/sns-2025-c-13/latest/sns-2025-c-13.html. Where you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/david-fraser► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

Canada’s Privacy Regulators vs. TikTok: A critical overview

In this episode, Canadian privacy lawyer David Fraser breaks down the joint investigation by Canada’s federal and provincial privacy commissioners into TikTok — an interesting, complex and consequential privacy finding. The report tackles three major issues: whether TikTok’s data practices (especially with respect to young users who circumvent age-gating) serve a legitimate purpose, whether its consent process is valid and meaningful, and whether it meets transparency obligations under Quebec law. This episode explains the key findings, including TikTok’s commitments to introduce new age-verification systems, restrict ad targeting for youth, and overhaul its privacy communications for Canadian users.But this case also raises a bigger question: Have Canada’s privacy regulators set an impossible standard? In seeking to protect children’s privacy, the Commissioners may have required TikTok to collect more sensitive information — including facial scans or identity documents — from all users. David argues that these well-intentioned recommendations risk making privacy compliance more invasive, not less. Watch (or listen) for a deep dive into how this decision reshapes the balance between privacy, practicality, and policy.The federal/provincial privacy finding is here: https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2025/pipeda-2025-003/Where you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/david-fraser► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

The words “use” and “loss” in privacy laws may not mean what you think in a cyber-security incident

In this episode, David Fraser, PrivacyLawyer, unpacks the recent Ontario Divisional Court decision in Hospital for Sick Children v. Information and Privacy Commissioner of Ontario. The case arose from ransomware attacks that temporarily encrypted servers at SickKids and the Halton Children’s Aid Society. No evidence suggested that hackers viewed, copied, or exfiltrated personal information—yet the Information and Privacy Commissioner found there had been an unauthorized “use” and “loss” of data, triggering notification obligations. The Court upheld those findings, deferring to the regulator’s broad interpretation.David explains why this matters for organizations across Ontario (and beyond), focusing on how common words like “use” and “loss” may not mean what you think when regulators are involved. He also contrasts Ontario’s strict approach with the federal private-sector law, PIPEDA, which only requires notification where there is a “real risk of significant harm.” The key takeaway: Ontario’s laws can demand notification even when no harm to individuals exists, a standard that may lead to over-notification and notice fatigue.The Divisional Court decision can be found here: https://canlii.ca/t/kffpmWhere you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

Recording conversations -- using AI gadgets and otherwise -- and the law in Canada

The law — and the practical realities — of recording conversations in Canada. From AI wearables like the Bee that promise “always-on” memory assistance, to built-in recording and transcription on Zoom and Teams, to employees secretly recording meetings, the legal framework hasn’t really changed: one-party consent under the Criminal Code means you can record if you’re part of the conversation and your purposes are 100% personal. But that doesn’t always make it wise, and in workplaces or commercial settings, privacy laws and policies come into play.David explores where the law draws the line, why secret recordings are often seen as hostile, and how policies can help manage new tools like AI transcription and wearables. Whether it’s a patient recording therapy sessions, an employee hitting record in a meeting, or an organization using AI-enabled tools for accessibility, this video unpacks the legal rules, the privacy risks, and the best practices for managing them responsibly.Where you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► BlueSky https://bsky.app/profile/privacylawyer.ca► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

Privacy finding: Hidden biometrics in on-campus vending machines

In August 2025, Ontario’s Information and Privacy Commissioner issued a revised finding against the University of Waterloo for a privacy breach involving “smart” vending machines that secretly used biometric face detection technology. Students discovered the issue when an error message revealed the machines were running FacialRecognition.App.exe.In this video, privacy lawyer David Fraser explains the Commissioner’s decision, why the University of Waterloo was found responsible under Ontario’s privacy law, and the lessons learned. The IPC finding can be found here: https://decisions.ipc.on.ca/ipc-cipvp/privacy/en/item/521985/index.do Where you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/...► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfr...Disclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

Regulation of privacy in Canadian workplaces

Where you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/david-fraser► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

Thinking about ”warrant canaries” as Canada’s government plans secret internet backdoors

This video delves into the idea of warrant canaries—a transparency tool used by tech companies to signal when they’ve received secret government surveillance orders. With Canada’s new Strong Borders Act (Bill C-2) giving the Minister of Public Safety power to secretly compel electronic service providers to alter their systems for surveillance, companies operating in Canada may want to consider these. I explain what a warrant canary is, how it works, and trace its history from the early USA Patriot Act era and National Security Letters in the U.S. through real-world examples. My previous episode on Part 15 of the Strong Borders Act: https://youtu.be/E1LV2fcD9BsWhere you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/david-fraser► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.

The really bad age verification bill is back in Canada’s Parliament

As other countries like the UK and Australia are joining conservative US states in implementing "age verification" under the rallying cry of "protecting the children", a Canadian Senator is determined to see it come to fruition for Canada, We had a very close call last year with this being passed, so you should know what's brewing in Parliament. Here's my video on the previous version of this bill, Bill S-210: https://youtu.be/UN8eP6LlWVY Where you can find me► Privacylawyer blog: https://blog.privacylawyer.ca► My law firm: https://www.mcinnescooper.com/people/david-fraser► Twitter: https://twitter.com/privacylawyer► LinkedIn: https://www.linkedin.com/in/davidtsfraserDisclaimer: This is intended for education and information only and should not be taken as legal advice. If you need advice for your particular situation, you should seek out qualified counsel. All views expressed are solely those of the creator and should not be attributed to his firm or any of its clients.