Blakes Data Governor: Spring 2026

Welcome to the Spring 2026 issue of Blakes Data Governor, published by the Blakes Privacy & Data Protection group. Blakes Data Governor provides actionable insights and practical overviews of recent developments impacting privacy, cybersecurity, access to information and artificial intelligence (AI) governance law in Canada.

In This Issue

• Data Portability Update. What businesses need to know about the potential for a targeted data portability framework under the Personal Information Protection and Electronic Documents Act (PIPEDA).
• OPC Releases Draft Age Assurance Guidance. To support its enforcement goal of protecting children’s privacy online, the Office of the Privacy Commissioner of Canada (OPC) has released two draft guidance documents regarding when and how to determine a user’s age online in a privacy-protective manner.
• Takeaways From the British Columbia Court of Appeal’s Clearview AI Decision. Unpacking the importance of the court’s reaffirmation of the extraterritoriality of provincial privacy laws.
• Manitoba Proposes Personalized Pricing Ban. Despite lacking provincial private sector privacy legislation, Manitoba takes a novel approach to consumer protection.
• Ontario Reforms Access to Information Laws. A significant provincial update to reduce the scope of the Freedom of Information and Protection of Privacy Act (FIPPA) and the burden on public institutions in responding to requests.
• Artificial Intelligence (AI) and Legal Privilege. Practical considerations for protecting privilege from emerging case law.
• Regulatory Round-Up. New regulatory guidance and enforcement decisions impacting privacy, cybersecurity, access to information and AI governance.

Scanning the Horizon

Update on Data Portability in Canada

The right for users to easily move or transfer data between service providers is an emerging right under international laws, intended to provide individuals with meaningful control over their choice of service provider and their personal information. A January 2026 report from the Competition Bureau titled “Your Data, Your Control” concludes that the right to data portability has the potential to “empower consumers, enhance market competition and drive innovation.”

While all Canadian privacy laws recognize an individual’s right to access their personal information, most laws do not require an organization to share personal information in a specific format to facilitate portability and switching providers. As of May 2026, only Quebec’s Act respecting the protection of personal information in the private sector (Quebec Privacy Act) expressly includes a right of data portability for individuals. Specifically, individuals have the right to request that computerized personal information that the organization collected from them be transferred in a structured, commonly used technological format to them or to another person or body authorized by law to collect such information. This extension of the right of access to personal information mirrors the data portability right provided under Article 20 of the European Union’s General Data Protection Regulation (GDPR).

However, Quebec is unlikely to be alone on the implementation of a data portability right in Canada for much longer. On March 26, 2026, the Budget 2025 Implementation Act, No. 1 (Bill C-15) received Royal Assent. Bill C-15 provides for amendments to the federal PIPEDA, which include the ability for the federal government to establish new “data mobility frameworks.” In particular, the Governor in Council may, after consulting with the OPC, make regulations prescribing the organizations that are subject to a data mobility framework and:

Safeguards that must be put in place by organizations to enable the secure disclosure of personal information subject to a data mobility framework, and the secure collection of that information

Parameters for the technical means for ensuring interoperability in respect of the disclosure and collection of that information

Ultimately, these new frameworks will provide an individual with the right to make a request that an organization transfer personal information directly to another designated organization that participates in the same, government-designated data mobility framework. Intended primarily to enable “open banking,” these amendments to PIPEDA will not go so far as the Quebec Privacy Act and EU GDPR to create broad entitlement to data portability.

Although the Alberta Legislature’s Final Report on its review of the Personal Information Protection Act did not address data portability, the report recommends that Alberta take necessary steps to ensure the law remains substantially similar to PIPEDA. As such, it is likely that future amendments to Alberta’s private sector privacy law will introduce a similar data portability right.

For more information on Quebec’s approach to data portability, see our Blakes Bulletin: New Data Portability Right in Force in Quebec.

Insights Radar

BCCA Clearview AI Decision Upholds Extraterritorial Application

The British Columbia Court of Appeal (BCCA) upheld an order of the Information and Privacy Commissioner (Commissioner) that required Clearview AI Inc. (Clearview) to make “best efforts” to delete existing biometric data scraped from British Columbians’ social media profiles and other online sources, as well as to cease all future collection, use and disclosure of such data. Our Blakes Bulletin: Connections Matter: BCCA Affirms Jurisdiction Over Foreign Entities Operating Virtually in the Province discusses the importance of the decision, which reaffirmed the application of British Columbia’s Personal Information Protection Act to organizations located outside of British Columbia whose online data practices have a real and substantial connection to the province.

OPC Releases Draft Age Assurance Guidance

On May 4, 2026, the OPC released two draft guidance documents on “age assurance” aimed at supporting safer and more age-appropriate online experiences for children while mitigating potential adverse privacy impacts. In our new Blakes Bulletin: OPC Releases Draft Age Assurance Guidance, we unpack the OPC’s emphasis on a risk-based and proportionate approach to age assurance.

Manitoba Proposes Personalized Pricing Ban

On March 12, 2026, Bill 49, The Business Practices Amendment Act, was introduced by the Government of Manitoba. The Bill targets the growing use of personalized algorithmic pricing and if passed would make Manitoba the first Canadian province to legislate in this area. Our Blakes Bulletin:Manitoba Proposes to Ban Personalized Pricing Under Bill 49 unpacks how the proposed legislation leverages Manitoba’s consumer protection law to regulate a specific use of consumer data.

Ontario Reforms Access to Information Laws

Following Alberta’s reform of its public sector privacy and access to information legislation, Ontario has made significant changes to FIPPA to recognize the struggles public institutions face in responding to growing demand for requests for information. Our Blakes Bulletin: Ontario Updates its Freedom of Information Legislative Frameworks discusses what these changes mean for third parties working with the public sector in Ontario.

Protecting Privilege in the Era of AI

As AI tools become embedded in legal workflows, critical questions around privilege have emerged. How will courts treat privilege claims over AI-generated content, or over prompts and documents shared with AI tools? Our Blakes Bulletin:AI and Legal Privilege: Practical Considerations From Emerging Case Law discusses the importance of protecting privilege in this new era.

Regulatory Watch

Key Legislative Developments

• The Connected Care for Canadians Act, which if passed would require interoperability for health information technology, was reintroduced in the Senate as Bill S-5 and is under consideration by the Standing Senate Committee on Social Affairs and Technology.
• Bill C-8, which if passed would enact the Critical Cyber Systems Protection Act, completed second reading in the Senate and is now under consideration by the Standing Senate Committee on National Security, Defense and Veterans Affairs.
• The Government of Canada launched a review of the Privacy Act to inform a modernization of the federal public sector privacy law.
• The Government of British Columbia tabled Bill 9, which, if passed, would amend the B.C. Freedom of Information and Protection of Privacy Act to modernize the province’s freedom of information and privacy system by addressing growing request volumes, digital service delivery and systemic delays.

New Decisions and Guidance

• Canadian privacy commissioners publish Joint Investigation of OpenAI, finding that the way that OpenAI had initially trained ChatGPT was not compliant with federal and provincial privacy laws.
• Federal Privacy Commissioner publishes an investigation into the personal information retention practices of Loblaw for the PC Optimum Loyalty Program.
• Commission d'accès à l'information du Quebec publishes a new checklist for private sector organizations responding to a confidentiality incident.
• Ontario Information and Privacy Commissioner provides new guidance on sharing information in situations involving a risk of serious harm.
• Alberta Information and Privacy Commissioner issues new guidance for public bodies when contracting with service providers, including a new service provider contract checklist that should be reviewed by vendors to the Alberta public sector.
• The Information and Privacy Commissioner for B.C. publishes a new infographic on the obligations of B.C. organizations when using AI scribes.

Contact Us

Please do not hesitate to contact your usual Blakes contact or any member of the Blakes Privacy & Data Protection group. To receive Privacy group Insights directly to your inbox, including Blakes Data Governor, sign up here.