Ships a mobile app, in Canada

S.C. 2000, c. 5, Part 1 · Read the law's page

• Obtain knowing, meaningful consent before collecting, using or disclosing personal information, and limit collection to what a reasonable person would consider appropriate for the stated purpose.
• Comply with the ten Schedule 1 fair information principles, including limiting use and disclosure to the purposes for which information was collected and keeping it only as long as necessary.
• Remain accountable for personal information transferred to a third party for processing, in Canada or abroad, and use contractual or other means to ensure a comparable level of protection.
• Give individuals access to their own personal information on request and a way to challenge the organization's compliance with these obligations.

S.C. 2000, c. 5, ss. 10.1-10.3 · Read the law's page

• Report any breach of security safeguards involving personal information under the organization's control to the Privacy Commissioner as soon as feasible, if it is reasonable to believe the breach creates a real risk of significant harm to an individual.
• Notify each affected individual directly, in a conspicuous form, with enough information to let them understand the significance of the breach and take steps to reduce or mitigate the resulting harm.

SOR/2019-244, ss. 3 to 9 (communication of information, websites, mobile websites and applications) · Read the law's page

• If you are a carrier to which Part 3 applies or a terminal operator to which Division 1 of Part 4 applies, ensure that every website, mobile website and application you own, operate or control that is made available to the public meets the requirements for a Level AA conformance of the Web Content Accessibility Guidelines, which the Regulations define as WCAG 2.0, the World Wide Web Consortium Recommendation dated December 2008, as amended from time to time (ss. 3(1) and 9).
• If your website can be used to access a client account, travel itinerary, travel schedule or trip status, to obtain contact information, to make or modify a reservation or to check in, offer persons with disabilities the option of doing those things by a communication system that does not require a website, such as a telephone, an email or a third party's telephone relay or video relay service, and publish with each website address a description of how to use that option, including your telephone number and email address and the relay service number (s. 8).
• If you make available to the public a telephone number that may be used to make travel reservations or obtain information about your transportation-related services or facilities, offer persons who are deaf, hard of hearing or have a communication impairment the option of doing those things by email or a third party's telephone relay or video relay service, and publish with every instance of that telephone number a description of how to access those services, including your email address and the relay service's telephone number (s. 7).
• If you make information about any transportation-related service or facility available to the public, make an electronic format compatible with adaptive technology that assists persons with disabilities, make paper-only information available on request in large print, in Braille or in an electronic format, make audio information available on request in a visual format, and make visual information available on request in an audio format, and provide the requested format without delay (s. 4).
• Publish on your website, in an electronic format, a notice that you are subject to the Regulations and the provisions that apply to you, the services you offer to persons with disabilities and any conditions that apply, and the complaint resolution services you offer and how to access them, or publish them in another format if you do not have a website (s. 5(1)); the notice in paragraph 5(1)(a) is also owed by every carrier to which Part 2 applies and every terminal operator to which Division 2 of Part 4 applies (s. 3(2)).
• Ensure that members of personnel who interact with passengers take into account, when communicating with a person with a disability, the nature of the disability, whether the person uses an assistive device to hear, see or communicate, and methods of communication the person may use, such as an augmentative or alternative communication system, sign language or clear, concise and plain language (s. 6).

2020 SCC 16, [2020] 2 SCR 118

• Do not assume an arbitration clause in standard form online terms will be enforced against an individual who could not negotiate it: the Supreme Court of Canada held an arbitration clause in Uber's driver services agreement, which required mediation and arbitration in the Netherlands with about US$14,500 in up-front fees, unconscionable and invalid.
• Make the cost, place and governing law of any arbitration clause in standard form terms clear to the person who must accept it: the joint reasons found the clause unconscionable in part because the agreement gave no information about the costs of mediation and arbitration and a person in the driver's position could not be expected to appreciate them.
• Do not rely on an arbitrator to decide a clause's own validity where its fees or location put arbitration out of reach: the joint reasons held a court should not refer a bona fide challenge to the arbitrator if there is a real prospect that doing so would leave the challenge never resolved.

Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, 45th Parliament, 1st Session · Read the law's page

• Would require organizations to be transparent about their use of automated decision making for significant decisions about individuals, set higher standards for handling children's information, and obtain meaningful consent supported by plain-language explanations.

Regulations Amending the Accessible Canada Regulations, SOR/2025-255 · Read the law's page

• These requirements do not yet bind: the training duty applies from December 5, 2027 (SOR/2025-255, ss. 6 and 18(1)), and the web page, mobile application, non-web document, accessibility statement, procurement and conformity-assessment record duties as amended apply from December 5, 2028 (SOR/2025-255, ss. 10 to 14 and 18(2)); each section first applies to an entity on the later of that day and the first day the entity falls within it (s. 19.2).
• If you are a regulated entity described in paragraph 7(1)(e) of the Act, other than a broadcasting or telecommunications entity or a transportation service provider, that had an average of 100 or more employees during the preceding three-year period, make each web page you create or update that is not employee-facing conform, to the extent feasible, to the applicable requirements in clauses 4 to 7 and 9 of the ICT Standard, CAN/ASC - EN 301 549, for as long as it remains available to the public (s. 19.5(1)(b), as replaced by SOR/2025-255, s. 11).
• If you are a regulated entity described in paragraph 7(1)(e) of the Act that had an average of 100 or more employees during the preceding three-year period, including a broadcasting or telecommunications entity, but not a transportation service provider to which Part 1 of the Accessible Transportation for Persons with Disabilities Regulations does not apply, make each employee-facing web page you create or update conform, to the extent feasible, to clauses 4 to 7 and 9 of the ICT Standard for as long as it remains available to employees (s. 19.4(1)(b), as replaced by SOR/2025-255, s. 10).
• If you are a regulated entity described in paragraph 7(1)(e) of the Act, other than a broadcasting or telecommunications entity or a transportation service provider, that had an average of 500 or more employees during the preceding three-year period, make any mobile application you launch after the section first applies to you that is not employee-facing conform, to the extent feasible, to clauses 4 to 7 and 11 of the ICT Standard for as long as it remains available for download, and for an earlier application you still offer for download, conduct or obtain a conformity assessment, including a gap analysis, against those clauses (s. 19.51(1) and (5)).
• If you are a regulated entity described in paragraph 7(1)(e) of the Act, other than a broadcasting or telecommunications entity or a transportation service provider, that had an average of 500 or more employees during the preceding three-year period, make any non-web document made available for download from your web pages or mobile applications that are not employee-facing, after the section first applies to you, conform, to the extent feasible, to clauses 4 to 7 and 10 of the ICT Standard for as long as it remains available for download (s. 19.52(1)).
• Where conformity is not feasible and the non-conformity imposes barriers on users or potential users, take other reasonable measures to remove those barriers, including alternative means for accessing the key information or performing the tasks; this does not apply to maps, mapping services, technical drawings or images, and the duties do not apply to heritage content or user-generated content, nor, for employee-facing web pages, to content accessed through a collaborative digital environment (ss. 19.4(2) to (4), 19.5(2) to (4), 19.51(2) to (4), 19.52(2) to (4)). Feasibility turns on the availability of technology that would permit conformity, significant obstacles to implementing it and your efforts to overcome them, and your degree of control over the web page, application or document, including under an agreement with a third party (s. 19.3).
• If you are a regulated entity described in paragraph 7(1)(e) of the Act that had an average of 500 or more employees during the preceding three-year period and has an obligation under this Part, publish an accessibility statement no later than the day the obligation first applies to you and then once every 12 months, written in simple, clear and concise language, dated, giving at least two of an email address, a telephone number and a mailing address for accessibility matters, acknowledging your obligations under this Part, describing the accessibility features of the web pages, mobile applications and non-web documents it relates to, giving an overview of where you do not meet the ICT Standard and of the other measures taken where conformity is not feasible, describing your plans and timelines for closing the gaps, and accessible from a prominent location on each web page, on the application's home screen, and on each web page or home screen from which a non-web document is downloaded; keep an electronic copy until the fourth anniversary of its publication (s. 19.6, as amended by SOR/2025-255, s. 13).
• If you are a regulated entity described in paragraph 7(1)(e) of the Act, other than a broadcasting or telecommunications entity, that had an average of 500 or more employees during the preceding three-year period, obtain a conformity assessment, including a gap analysis, against the applicable requirements of the ICT Standard as part of any procurement you initiate of products or services for developing or providing a web page or mobile application covered by this Part (s. 19.61, added by SOR/2025-255, s. 14).
• If you are a regulated entity described in paragraph 7(1)(e) of the Act that had an average of 100 or more employees during the preceding three-year period, other than a transportation service provider to which Part 1 of the Accessible Transportation for Persons with Disabilities Regulations does not apply, ensure each employee involved in the development, maintenance or procurement of information and communication technologies has received training on accessibility fundamentals in relation to those technologies, with refresher training at least once every three years, and keep an electronic record of the training until the fourth anniversary of the day it is provided (s. 19.8).
• Keep an electronic copy of the report of any conformity assessment against the ICT Standard, including any gap analysis, for a web page or mobile application in relation to which you have obligations under this Part, until the fourth anniversary of the day the assessment is completed (s. 19.7, as replaced by SOR/2025-255, s. 14).
• If you are a regulated entity described in paragraph 7(1)(f) of the Act and act in the name of or for the benefit of an entity that has obligations under this Part, you have those same obligations in relation to that other entity, and a failure to meet one is treated as a violation of the provision that imposes it on the other entity (s. 19.31, added by SOR/2025-255, s. 9).
• You may meet a requirement to conform to the ICT Standard by conforming to a version of ETSI EN 301 549 published more recently than the current version of the ICT Standard, or to the version of the ICT Standard that immediately precedes its current version if the current version was published within the last three years (s. 19.9).