Canada

Requires an organization to report to the Privacy Commissioner, and to notify the affected individual directly, any breach of security safeguards involving personal information under its control where it is reasonable to believe the breach creates a real risk of significant harm. Significant harm includes bodily harm, humiliation, damage to reputation, financial loss and identity theft; relevant factors include the sensitivity of the information and the probability of misuse. Added to PIPEDA by the 2015 Digital Privacy Act, with the reporting duty itself brought into force November 1, 2018.

Governs the collection, use and disclosure of personal information by private-sector organizations in the course of commercial activity, and by any organization in connection with the personal information of its employees where the organization is a federal work, undertaking or business.

Every organization must comply with the ten Schedule 1 fair information principles (accountability, identifying purposes, consent, limiting collection, limiting use and disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance) and may collect, use or disclose personal information only for purposes a reasonable person would consider appropriate.

It excludes government institutions covered by the Privacy Act, purely personal or domestic use, and journalistic, artistic or literary purposes.

Makes it an indictable offence, punishable by up to 10 years' imprisonment, to fraudulently and without colour of right obtain a computer service, intercept a function of a computer system, or use a computer system to commit those offences, or to traffic in a computer password enabling such access.

The offence turns on fraud and absence of authorization to use the service, not on the technique of access, so scraping a page a site has made publicly and unauthenticated is not, on its own, an unauthorized use; the analysis changes once a scraper circumvents an access control or continues after an unambiguous revocation of permission.

Fair dealing for the purpose of research, private study, education, parody or satire does not infringe copyright; further statutory dealings are enumerated elsewhere in the Act (including, at s. 29.2, news reporting).

The list is closed rather than illustrative, unlike US fair use, and Canada has enacted no text-and-data-mining exception of the kind the EU's Digital Single Market Directive or Japan's Copyright Act provide, so training an AI model on copyrighted text collected by crawling falls outside the enumerated fair-dealing categories and outside any text and data mining (TDM)-specific carve-out; a 2023-2024 government consultation on copyright and generative AI had not produced legislation as of mid-2026.

Applies to personal information an organization collects, uses or discloses in the course of commercial activity, without a general exemption for information that happens to be publicly accessible on the web.

A narrow regulatory carve-out lets an organization collect, use or disclose personal information without consent where it is both publicly available and specified by regulation, but that carve-out is defined by regulation rather than by the fact of public accessibility alone, so scraping a public page does not, by itself, take the resulting personal information outside PIPEDA's other obligations, including purpose limitation and accountability for onward transfer.

The full obligations this instrument imposes are researched in the privacy topic's PIPEDA entry for this jurisdiction; this row records only the personal_data dimension the scraping topic tracks separately. This is the same underlying statute as the privacy topic's PIPEDA instrument for this jurisdiction; its short_code is qualified to avoid colliding with that document's short_code in the shared /l/ namespace.

The CRTC granted Google a five-year exemption from the Online News Act's mandatory bargaining requirements after Google agreed to contribute C$100 million annually to the Canadian Journalism Collective (CJC) for distribution to eligible Canadian news businesses. Key conditions include annual admission of new eligible news businesses to the CJC, a 2% cap on indemnity claims, and notification of any agreement changes or breaches. Payment to the CJC was required within 60 days of the decision.

Requires operators of designated digital news intermediaries (large search engines and social media platforms meeting the revenue and user thresholds set in regulations, to bargain with eligible Canadian news businesses and reach compensation agreements; failing agreement, mandatory mediation and final offer arbitration apply. Administered by the CRTC. Received Royal Assent June 22, 2023; came into force December 19, 2023 (180 days after assent).

Sets the thresholds triggering the Online News Act: global revenue exceeding C$1 billion and at least 20 million Canadian monthly unique visitors (search) or active users (social media). Requires the largest search engine by Canadian advertising market share to provide at least C$100 million per year (CPI-indexed via formula: C$100M × CPIx ÷ CPI2023) to news businesses as a condition of exemption eligibility. Published in the Canada Gazette, Part II, Vol. 158, No. 1 (January 3, 2024); in force December 19, 2023.

Establishes operational procedures for mandatory bargaining under the Online News Act: a 90-day bargaining period, followed by a 120-day mediation phase, and a 45-day final offer arbitration (FOA) period. Also governs undue-preference complaints filed by eligible news businesses against platforms, and mandates data collection from both platforms and news businesses to support annual auditor reports.

A separate code-of-conduct regulation was consulted on in late 2024 (CRTC 2024-236 Notice of Consultation) but had not been registered as of the date shown.

Permits fair dealing with any copyrighted work for the purpose of news reporting, provided the source and the author's name (if given in the source) are attributed; no attribution is required for photographs. This exception may shield news aggregators from copyright infringement claims when reproducing limited news excerpts or snippets, subject to the six-factor fairness analysis established by the Supreme Court of Canada in CCH Canadian Ltd. v. Law Society of Upper Canada (2004 SCC 13). Canada has no separate press-publisher neighbouring right analogous to the EU's Article 15 Directive.