Canada

The Protecting Victims Act received royal assent on 18 June 2026. Section 15 of the Act redefines intimate image in section 162.1 of the Criminal Code to include a visual representation made by any electronic or mechanical means, including by means of artificial intelligence software. The depiction must show an identifiable person as nude, nearly nude, exposing their sexual organs or engaged in explicit sexual activity, and be likely to be mistaken for a visual recording of that person.

Section 15 also creates an offence of knowingly threatening, with the intent to intimidate or to be taken seriously, to publish, distribute, transmit, sell, make available or advertise an intimate image of a person who would not consent, or where the accused is reckless as to consent. The threat offence is punishable by up to 10 years' imprisonment on indictment, or on summary conviction. The Act's provisions, other than those it lists, came into force on the 30th day after royal assent.

Section 465 of the Bank Act provides that the directors of a bank shall establish, and the bank shall adhere to, investment and lending policies, standards and procedures that a reasonable and prudent person would apply in respect of a portfolio of investments and loans to avoid undue risk of loss and obtain a reasonable return.

Subsection 157(2) of the Act lists, among the specific duties of the directors of a bank, establishing investment and lending policies, standards and procedures in accordance with section 465. Section 581 of the Act provides that an authorized foreign bank shall establish and adhere to investment and lending policies, standards and procedures that a reasonable and prudent person would apply in respect of a portfolio of investments and loans.

The Bank Act received royal assent on December 13, 1991. The Library of Parliament records that on June 1, 1992 the federal government proclaimed its new legislative framework for federally regulated financial institutions, including banks. Section 980 of the Act makes it an offence for a person, without reasonable cause, to contravene any provision of the Act or the regulations.

Under section 985 of the Act, an entity guilty of an offence under any of sections 980 to 984 is liable to a fine of not more than $500,000 on summary conviction, or of not more than $5,000,000 on conviction on indictment.

A natural person guilty of such an offence is liable on summary conviction to a fine of not more than $100,000 or to imprisonment for a term of not more than twelve months, or to both, and on conviction on indictment to a fine of not more than $1,000,000 or to imprisonment for a term of not more than five years, or to both.

The Office of the Superintendent of Financial Institutions supervises financial institutions to determine whether they are in sound financial condition and are complying with their governing statute law and supervisory requirements under that law.

CIRO Rule 3110 requires a Dealer Member to take reasonable steps to identify existing material conflicts of interest, and material conflicts of interest that are reasonably foreseeable, between the Dealer Member and the client and between each Approved Person acting on the Dealer Member's behalf and the client.

An Approved Person must take reasonable steps to identify existing and reasonably foreseeable material conflicts of interest between the Approved Person and the client and must promptly report any it identifies to the Dealer Member.

A Dealer Member must address all material conflicts of interest between itself, including each Approved Person acting on its behalf, and the client in the best interest of the client, and must avoid a material conflict that is not, or cannot be, otherwise addressed in the best interest of the client. A Dealer Member must adequately supervise how all material conflicts of interest between the client and the Approved Person are addressed by its Approved Persons.

An Approved Person must address all material conflicts of interest between the client and the Approved Person in the best interest of the client, must avoid a conflict that cannot otherwise be so addressed, and must not engage in any trading or advising activity in connection with a material conflict unless it has been addressed in the best interest of the client and the Dealer Member has given its consent to proceed.

A Dealer Member must disclose in writing all material conflicts of interest it identifies to the client whose interests are affected if a reasonable client would expect to be informed of those conflicts of interest.

The disclosure must describe the nature and extent of the conflict of interest, the potential impact on and risk that it could pose to the client and how it has been or will be addressed, must be prominent, specific and written in plain language, and must be made before the account is opened if the conflict has been identified at that time and otherwise in a timely manner.

A Dealer Member and an Approved Person do not satisfy the duty to address a material conflict of interest in the client's best interest solely by providing disclosure to the client. A Dealer Member's policies and procedures must specifically address identifying, disclosing and avoiding or otherwise addressing material conflict of interest situations.

A Dealer Member must comply with all relevant Corporation requirements, securities laws and applicable laws that are applicable to its activities, under section 1406 of the Investment Dealer and Partially Consolidated Rules. Under the Investment Dealer and Partially Consolidated Rules the term Dealer Member has the meaning given in the CIRO General By-law and excludes a Mutual Fund Dealer Member.

CIRO states that a Dealer Member found to have violated CIRO rules may be fined up to a maximum of $5 million per contravention or an amount equal to three times the profit made, or loss avoided. The Investment Dealer and Partially Consolidated Rules replaced the IIROC Rules and became effective on January 1, 2023. The Client Focused Reforms' conflicts of interest requirements came into force on June 30, 2021.

CIRO Rule 3400 requires a Dealer Member, before it purchases, sells, withdraws, exchanges or transfers-out securities or precious metals bullion, or transacts in derivatives for a retail client's account, takes any other investment action for a client, makes a recommendation or exercises discretion to take any such action, to determine on a reasonable basis that the action is suitable for the retail client and puts the retail client's interest first.

The suitability factors are the retail client's information collected under the know-your-client rule, the Dealer Member's assessment of the security or derivative under Rule 3300, the impact of the action on the retail client's account including concentration and liquidity, the potential and actual impact of costs on the client's returns, and a consideration of a reasonable range of alternative actions available at the time of the determination.

A Dealer Member must review the retail client's account and the securities, derivatives or precious metals bullion in it, and take reasonable steps within a reasonable time, after events that include a deposit or transfer-in, a change in the client's information and a change in a security or derivative in the account.

A Dealer Member must determine on a reasonable basis, putting the retail client's interest first, that it is suitable for the client to continue having an account with the Dealer Member and that the scope of products, services and account relationships available to the client within the account is suitable.

A Dealer Member must also determine on a reasonable basis that the retail client's account portfolio of investments that would result from the investment action it takes, recommends or exercises discretion to take is suitable for the client and puts the client's interest first.

A Dealer Member that receives a retail client's instruction to take an action that would not satisfy the determination may carry it out only if it has informed the client of the basis for the determination and advised against proceeding, recommended an alternative action that satisfies the determination, and received recorded confirmation of the client's instruction to proceed.

For an institutional client a suitability determination must be made before any order is accepted and before a recommendation is made, and the Dealer Member must determine whether the client is sufficiently sophisticated and capable of making its own investment decisions in order to determine the level of suitability owed. Rule 3400 does not apply, other than clauses 3402(3)(i) and 3403(4)(i), to an order execution only account or a direct electronic access account.

Compliance with the suitability determination requirements is primarily the responsibility of the Registered Representative, Portfolio Manager or Associate Portfolio Manager assigned to the client account, who must not delegate the responsibility for suitability assessment obligations to any other person.

A Dealer Member must comply with all relevant Corporation requirements, securities laws and applicable laws that are applicable to its activities, under section 1406 of the Investment Dealer and Partially Consolidated Rules. Under the Investment Dealer and Partially Consolidated Rules the term Dealer Member has the meaning given in the CIRO General By-law and excludes a Mutual Fund Dealer Member.

CIRO states that a Dealer Member found to have violated CIRO rules may be fined up to a maximum of $5 million per contravention or an amount equal to three times the profit made, or loss avoided. The Investment Dealer and Partially Consolidated Rules replaced the IIROC Rules and became effective on January 1, 2023. The Client Focused Reforms' enhancements to the know-your-client, know-your-product and suitability determination requirements came into force on December 31, 2021.

A Dealer Member must not issue, participate in or knowingly allow the use of its name in any advertisement, sales literature or correspondence that contains an untrue statement or omission of a material fact or is otherwise false or misleading, contains an unjustified promise of specific results, fails to fairly present the potential risks to the client, or fails to comply with Corporation requirements or any applicable laws.

Correspondence means any advertisement or business related communication, including any written or electronic communication, prepared for distribution to a single current or prospective client. Sales literature means any written or electronic communication for client use which contains a recommendation relating to a security or derivative, or trading strategy.

An advertisement includes any commercials, commentaries and any published materials promoting a Dealer Member's business, including materials disseminated or made available electronically. A Dealer Member's policies and procedures must specifically address communication with the public, and the Dealer Member must monitor compliance with them.

A Dealer Member's policies and procedures must specifically address the review and supervision of advertisements, sales literature and correspondence relating to its business.

A Dealer Member must ensure that research reports, market letters, telemarketing scripts, promotional seminar texts, original advertisements or original template advertisements, and any material containing performance reports or summaries used to solicit clients are approved by a designated Supervisor before use or publication. All other advertising, sales literature or correspondence must be reviewed through pre-use approval, post-use review or post-use sampling.

A Dealer Member must retain copies of all advertisements, sales literature and correspondence and all records of supervision for the period set out in section 3803, and these items must be readily available for inspection by CIRO.

A Dealer Member must not hold itself or its Approved Persons out, including through the use of a trade name, in a manner that could reasonably be expected to deceive or mislead any person or company as to the proficiency, experience, qualifications or category of registration or approval of the Approved Person, the nature of the person's relationship with the Dealer Member or the Approved Person, or the products or services provided or to be provided.

A Dealer Member must comply with all relevant Corporation requirements, securities laws and applicable laws that are applicable to its activities, under section 1406 of the Investment Dealer and Partially Consolidated Rules. Under the Investment Dealer and Partially Consolidated Rules the term Dealer Member has the meaning given in the CIRO General By-law and excludes a Mutual Fund Dealer Member.

CIRO states that a Dealer Member found to have violated CIRO rules may be fined up to a maximum of $5 million per contravention or an amount equal to three times the profit made, or loss avoided. The Investment Dealer and Partially Consolidated Rules replaced the IIROC Rules and became effective on January 1, 2023.

A Dealer Member must retain copies of all records required under Corporation requirements, in durable and accessible form, for a minimum of seven years from the date the record is created unless Corporation requirements or securities laws relating to the specific type of record require a different retention period.

A Dealer Member must maintain current records that properly record its business activities, financial position, financial operating results and client transactions, and that demonstrate its compliance with securities laws and Corporation requirements. Those records include records that provide an audit trail for client instructions, orders and transactions and for each trade transmitted or transaction executed for a client or by the Dealer Member on its own behalf.

They also include records that demonstrate compliance with the know-your-client, account appropriateness, product due diligence, know-your-product and suitability determination requirements and with the complaint handling requirements, and records that document correspondence with clients. A Dealer Member must maintain appropriate internal controls to provide reasonable assurance that its records are correct, provide clear and accurate information, and remain current.

A Dealer Member must make its records available to CIRO on request, in the manner requested by CIRO. A Dealer Member must send a quarterly statement to each client who, at the end of the quarter, has a debit or credit balance or one or more securities, derivatives or precious metals bullion in their account. A Dealer Member must send a monthly statement to each client who requests one or who had a transaction during the month, among other triggers stated in the rule.

A Dealer Member must send an annual performance report to each retail client who meets the conditions in the rule. A Dealer Member must send an annual fee and charge report to each retail client who paid a reportable fee, charge or other payment during the period covered by the report. All confirmations, statements, reports and other documents required to be sent to clients under sections 3803 through 3819 must be sent promptly.

A Dealer Member must comply with all relevant Corporation requirements, securities laws and applicable laws that are applicable to its activities, under section 1406 of the Investment Dealer and Partially Consolidated Rules. Under the Investment Dealer and Partially Consolidated Rules the term Dealer Member has the meaning given in the CIRO General By-law and excludes a Mutual Fund Dealer Member.

CIRO states that a Dealer Member found to have violated CIRO rules may be fined up to a maximum of $5 million per contravention or an amount equal to three times the profit made, or loss avoided. The Investment Dealer and Partially Consolidated Rules replaced the IIROC Rules and became effective on January 1, 2023.

The Dealer Member's board of directors is responsible for ensuring that an appropriate supervision system is in place. A Dealer Member's policies and procedures must establish a supervisory system to supervise the activities of all its employees and Approved Persons that provides reasonable assurance they comply with Corporation requirements and securities laws. A Dealer Member must ensure all supervisory policies and procedures are in writing.

A Dealer Member must amend its policies and procedures relating to supervision within a reasonable time after changes in Corporation requirements or securities laws are made. A Dealer Member must assign sufficient personnel and commit adequate resources necessary to fully and properly apply and enforce its policies and procedures.

A Dealer Member must take reasonable steps to ensure its Supervisors and Executives are fully proficient and understand the products that the employees and Approved Persons under their supervision trade in or advise on, and the services they provide, and must have procedures in place that ensure Supervisors are properly performing their supervisory functions.

A Supervisor may delegate supervisory tasks and procedures but not the responsibility for their performance, a delegate must be qualified by registration, training or experience, the Supervisor must inform the delegate of the delegated tasks in writing, ensure that the delegate adequately performs them and establish reporting mechanisms, and the Dealer Member must maintain a record of the terms of the delegation and of the Supervisor's follow up and review.

A Dealer Member must maintain adequate records of supervisory activity, including compliance issues identified and the resolution of such issues, and keep them for the period set out in section 3803. At least annually the Chief Compliance Officer must provide a written report to the Dealer Member's board of directors for the purpose of assessing compliance by the Dealer Member, and its employees and Approved Persons, with Corporation requirements and securities laws.

The board of directors must review the reports and recommendations to determine the appropriate action to be taken to remedy any compliance deficiencies, must ensure that such action is taken, and must maintain records of the actions and of the monitoring done to ensure that they are carried out. A Dealer Member must effectively supervise account activity and take reasonable steps to provide reasonable assurance of compliance with Corporation requirements, securities laws and applicable laws.

A Dealer Member's policies and procedures must include controls for accessing and amending client records. A Dealer Member must review account activity as required by Corporation requirements. A Dealer Member must record and keep evidence of completed supervisory reviews, including details of inquiries about issues and their resolution, for the period required in section 3803.

A Dealer Member that has retail client accounts must have policies and procedures that specifically address daily and monthly supervision of trading activity in those accounts, including the detection of unsuitable trading, undue concentration and excessive trading.

A Dealer Member must supervise each Registered Representative, Investment Representative, Portfolio Manager and Associate Portfolio Manager to confirm that they are complying with their responsibilities relating to the suitability determination to retail clients under Rule 3400.

A Dealer Member must comply with all relevant Corporation requirements, securities laws and applicable laws that are applicable to its activities, under section 1406 of the Investment Dealer and Partially Consolidated Rules. Under the Investment Dealer and Partially Consolidated Rules the term Dealer Member has the meaning given in the CIRO General By-law and excludes a Mutual Fund Dealer Member.

CIRO states that a Dealer Member found to have violated CIRO rules may be fined up to a maximum of $5 million per contravention or an amount equal to three times the profit made, or loss avoided. The Investment Dealer and Partially Consolidated Rules replaced the IIROC Rules and became effective on January 1, 2023.

CIRO Rule 3200 requires a Dealer Member to take reasonable steps to learn and remain informed of the essential facts relative to every order, account and client it accepts, including by collecting sufficient information about the client's personal circumstances, financial circumstances, investment needs and objectives, investment knowledge, risk profile and investment time horizon to enable it to meet its obligations under Rule 3400.

Within a reasonable time after receiving the information, a Dealer Member must take reasonable steps to have the client confirm the accuracy of it. A Dealer Member must review the information collected on the client's circumstances no less frequently than once every 36 months, and no less frequently than once every 12 months for a managed account and a discretionary account.

Compliance with the know-your-client requirements is primarily the responsibility of the Registered Representative, Portfolio Manager or Associate Portfolio Manager assigned to the client account, and that responsibility must not be delegated to any other person.

A Dealer Member must restrict the access of Registered Representatives, Portfolio Managers, Associate Portfolio Managers and other persons to its systems so that material client information cannot be changed without the required approval.

A Dealer Member must not make securities or derivatives available to clients unless it has taken reasonable steps to assess their structure, features, risks, initial and ongoing costs and the impact of those costs, to approve them, and to monitor them for significant changes. An Approved Person must not purchase securities or derivatives for, or recommend them to, a client unless the Dealer Member has approved them to be made available to clients.

An Approved Person of a Dealer Member must not purchase or sell securities or transact in derivatives for, or recommend them to, a client unless the Approved Person takes steps to understand their structure, features, risks, initial and ongoing costs and the impact of those costs.

Rule 3301 does not apply to an account at a Dealer Member that is a carrying broker, or only provides trade execution, clearing, settlement or custody services, for another Dealer Member, portfolio manager, exempt market dealer or their clients, and Rule 3302 does not apply to an order execution only account or a direct electronic access account.

A Dealer Member must comply with all relevant Corporation requirements, securities laws and applicable laws that are applicable to its activities, under section 1406 of the Investment Dealer and Partially Consolidated Rules. Under the Investment Dealer and Partially Consolidated Rules the term Dealer Member has the meaning given in the CIRO General By-law and excludes a Mutual Fund Dealer Member.

CIRO states that a Dealer Member found to have violated CIRO rules may be fined up to a maximum of $5 million per contravention or an amount equal to three times the profit made, or loss avoided. The Investment Dealer and Partially Consolidated Rules replaced the IIROC Rules and became effective on January 1, 2023. The Client Focused Reforms' enhancements to the know-your-client, know-your-product and suitability determination requirements came into force on December 31, 2021.

Section 2 states that the purpose of the Canadian Human Rights Act is to extend the laws in Canada to give effect, within the purview of matters coming within the legislative authority of Parliament, to the principle that all individuals should have an opportunity equal with other individuals to make for themselves the lives that they are able and wish to have and to have their needs accommodated.

According to the Library of Parliament, Parts I and III of the Canadian Human Rights Act, dealing with rights and procedures, came into force on 1 March 1978.

Section 3(1) lists the prohibited grounds of discrimination as race, national or ethnic origin, colour, religion, age, sex, sexual orientation, gender identity or expression, marital status, family status, genetic characteristics, disability and conviction for an offence for which a pardon has been granted or in respect of which a record suspension has been ordered.

Section 3.1 provides that a discriminatory practice includes a practice based on one or more prohibited grounds of discrimination or on the effect of a combination of prohibited grounds.

Section 5 makes it a discriminatory practice, in the provision of goods, services, facilities or accommodation customarily available to the general public, to deny, or to deny access to, any such good, service, facility or accommodation to any individual, or to differentiate adversely in relation to any individual, on a prohibited ground of discrimination.

Section 6 makes it a discriminatory practice, in the provision of commercial premises or residential accommodation, to deny occupancy of such premises or accommodation to any individual, or to differentiate adversely in relation to any individual, on a prohibited ground of discrimination.

Section 7 makes it a discriminatory practice, directly or indirectly, to refuse to employ or continue to employ any individual, or in the course of employment to differentiate adversely in relation to an employee, on a prohibited ground of discrimination.

Section 8 makes it a discriminatory practice to use or circulate any form of application for employment, or in connection with employment or prospective employment to publish any advertisement or make any written or oral inquiry that expresses or implies any limitation, specification or preference based on a prohibited ground of discrimination.

Section 10 makes it a discriminatory practice for an employer, employee organization or employer organization to establish or pursue a policy or practice, or to enter into an agreement affecting recruitment, referral, hiring, promotion, training, apprenticeship, transfer or any other matter relating to employment or prospective employment, that deprives or tends to deprive an individual or class of individuals of any employment opportunities on a prohibited ground of discrimination.

Section 15(1)(g) provides that, in the circumstances described in section 5 or 6, a denial or an adverse differentiation is not a discriminatory practice if there is bona fide justification for it.

Section 15(2) requires it to be established, for a practice to be considered to be based on a bona fide occupational requirement or to have a bona fide justification, that accommodation of the needs of an individual or a class of individuals affected would impose undue hardship on the person who would have to accommodate those needs, considering health, safety and cost.

Section 15(8) applies section 15 in respect of a practice regardless of whether it results in direct discrimination or adverse effect discrimination. Section 40(1) allows any individual or group of individuals having reasonable grounds for believing that a person is engaging or has engaged in a discriminatory practice to file a complaint with the Canadian Human Rights Commission.

Under section 49(1), at any stage after the filing of a complaint, the Canadian Human Rights Commission may request the Chairperson of the Canadian Human Rights Tribunal to institute an inquiry into the complaint if the Commission is satisfied that an inquiry is warranted.

If the member or panel conducting the inquiry finds the complaint substantiated, section 53(2) lets the member or panel order the person to cease the discriminatory practice and take measures, in consultation with the Commission, to redress or prevent the practice, to make available the rights, opportunities or privileges denied, to compensate the victim for lost wages and expenses and for the additional costs of obtaining alternative goods, services, facilities or accommodation, and to compensate the victim by an amount not exceeding twenty thousand dollars for pain and suffering.

Section 53(3) lets the member or panel order the person to pay compensation not exceeding twenty thousand dollars to the victim if it finds that the person is engaging or has engaged in the discriminatory practice wilfully or recklessly.

In a statement of 8 June 2026 responding to the national artificial intelligence strategy, the Commission said that strong oversight, clear regulatory alignment, proactive safeguards, and human rights impact assessment are required before AI systems are deployed in areas that affect people's access to services, benefits, employment, education, housing, health care, policing, or justice.

Section 11.1 of National Instrument 31-103 requires a registered firm to establish, maintain and apply policies and procedures that establish a system of controls and supervision sufficient to provide reasonable assurance that the firm and each individual acting on its behalf complies with securities legislation and to manage the risks associated with its business in accordance with prudent business practices.

A registered firm must also provide training to its registered individuals on compliance with securities legislation, including the obligations under sections 13.2, 13.2.1, 13.3, 13.4 and 13.4.1. Section 11.5 requires a registered firm to maintain records to accurately record its business activities, financial affairs and client transactions and to demonstrate the extent of the firm's compliance with applicable requirements of securities legislation.

The records must include records that demonstrate compliance with sections 13.2, 13.2.01, 13.2.1 and 13.3 and records that document the compliance, training and supervision actions taken by the firm. The records must also provide an audit trail for client instructions and orders and for each trade transmitted or executed for a client or by the registered firm on its own behalf. A registered firm is a registered dealer, a registered adviser or a registered investment fund manager.

A registered individual is an individual registered in a category that authorizes the individual to act as a dealer or an adviser on behalf of a registered firm, as ultimate designated person, or as chief compliance officer. Under section 5.2, the chief compliance officer of a registered firm must monitor and assess compliance by the firm, and individuals acting on its behalf, with securities legislation.

The chief compliance officer must also submit an annual report to the firm's board of directors, or individuals acting in a similar capacity for the firm, for the purpose of assessing compliance by the firm, and individuals acting on its behalf, with securities legislation. Outside Ontario the instrument came into force on September 28, 2009.

In Ontario it came into force on the later of that day and the day on which sections 4 and 5 and subsections 20(1) to (11) of Schedule 26 of the Budget Measures Act, 2009 were proclaimed in force.

The Canadian Securities Administrators stated in 2019 that amendments to National Instrument 31-103 would be implemented as a rule in each of Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Northwest Territories, Nova Scotia, Nunavut, Ontario, Prince Edward Island and Yukon. In Québec the amendments were to be adopted as a regulation made under section 331.1 of the Securities Act (Québec). In Saskatchewan they were to be implemented as a commission regulation.

Section 143 of the Securities Act (Ontario) lets the Commission make rules prescribing requirements for registrants, including standards of practice and business conduct in dealing with clients and requirements for the prevention or regulation of conflicts of interest. The Act defines regulations as the regulations made under the Act and, unless the context otherwise indicates, the rules.

The Act defines Ontario securities law as the Act, the regulations and, in respect of a person or company, a decision of the Commission, the Tribunal or a Director to which the person or company is subject. A person or company that contravenes Ontario securities law is guilty of an offence and on conviction is liable to a fine of not more than $10 million or to imprisonment for a term of not more than five years less a day, or to both.

The Act provides for an order requiring a person or company that has not complied with Ontario securities law to pay an administrative penalty of not more than $5 million for each failure to comply. The offence and penalty amounts above are those of the Securities Act (Ontario), and National Instrument 14-101 lists a separate securities act for each other province and territory.

Section 13.2 of National Instrument 31-103 requires a registrant to take reasonable steps to establish the identity of a client and, if the registrant has cause for concern, to make reasonable inquiries as to the reputation of the client.

A registrant must also take reasonable steps to ensure that it has sufficient information about the client's personal circumstances, financial circumstances, investment needs and objectives, investment knowledge, risk profile and investment time horizon to enable it to meet its obligations under section 13.3.

A registrant must take reasonable steps to have a client confirm the accuracy of that information within a reasonable time after receiving it, and to keep it current, including by updating it within a reasonable time after the registrant becomes aware of a significant change.

A registrant must review that information no less frequently than once every 12 months for managed accounts, within 12 months before making a trade for or recommending a trade to the client if the registrant is an exempt market dealer, and in any other case no less frequently than once every 36 months. Section 13.2 does not apply if the client is a registered firm, a Canadian financial institution or a Schedule III bank.

Paragraph 13.2(2)(c) and subsection 13.2(4.1) do not apply to a registered dealer in respect of a client if the registered dealer purchases or sells securities for the client only as directed by a registered adviser acting for the client. Section 13.1 provides that the Division does not apply to an investment fund manager in respect of its activities as an investment fund manager.

Section 13.2.1 provides that a registered firm must not make securities available to clients unless it has taken reasonable steps to assess the relevant aspects of the securities, including their structure, features, risks, initial and ongoing costs and the impact of those costs, to approve the securities to be made available to clients, and to monitor the securities for significant changes.

A registered individual must not purchase or sell securities for, or recommend securities to, a client unless the individual takes steps to understand the securities, including their structure, features, risks, initial and ongoing costs and the impact of those costs. The steps required to understand a security are those that are reasonable to enable the registered individual to meet their obligations under section 13.3.

A registered individual must not purchase securities for, or recommend securities to, a client unless the securities have been approved by the firm to be made available to clients. Section 13.2.1 does not apply to a registered dealer in respect of a security if it purchases or sells the security for a client only as directed by a registered adviser acting for the client. The 2019 amending instrument replaced paragraph 13.2(2)(c). It also added section 13.2.1.

The Canadian Securities Administrators provided that the amendments other than those on conflicts of interest and relationship disclosure information would take effect on December 31, 2021. In Ontario a registrant is a person or company registered or required to be registered under the Securities Act. A term defined in the statute of a jurisdiction has, in a national instrument, the meaning ascribed to it in that statute unless the context otherwise requires.

The Canadian Securities Administrators stated in 2019 that amendments to National Instrument 31-103 would be implemented as a rule in each of Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Northwest Territories, Nova Scotia, Nunavut, Ontario, Prince Edward Island and Yukon. In Québec the amendments were to be adopted as a regulation made under section 331.1 of the Securities Act (Québec). In Saskatchewan they were to be implemented as a commission regulation.

Section 143 of the Securities Act (Ontario) lets the Commission make rules prescribing requirements for registrants, including standards of practice and business conduct in dealing with clients and requirements for the prevention or regulation of conflicts of interest. The Act defines regulations as the regulations made under the Act and, unless the context otherwise indicates, the rules.

The Act defines Ontario securities law as the Act, the regulations and, in respect of a person or company, a decision of the Commission, the Tribunal or a Director to which the person or company is subject. A person or company that contravenes Ontario securities law is guilty of an offence and on conviction is liable to a fine of not more than $10 million or to imprisonment for a term of not more than five years less a day, or to both.

The Act provides for an order requiring a person or company that has not complied with Ontario securities law to pay an administrative penalty of not more than $5 million for each failure to comply. The offence and penalty amounts above are those of the Securities Act (Ontario), and National Instrument 14-101 lists a separate securities act for each other province and territory.

Section 13.4 of National Instrument 31-103 requires a registered firm to take reasonable steps to identify existing material conflicts of interest, and material conflicts of interest that are reasonably foreseeable, between the firm and the client and between each individual acting on the firm's behalf and the client. A registered firm must address all material conflicts of interest between a client and itself, including each individual acting on its behalf, in the best interest of the client.

A registered firm must avoid any material conflict of interest between a client and the firm, including each individual acting on its behalf, if the conflict is not, or cannot be otherwise addressed in the best interest of the client.

A registered firm must disclose in writing all material conflicts of interest identified to a client whose interests are affected by them, if a reasonable client would expect to be informed, describing the nature and extent of the conflict, its potential impact on and risk to the client, and how it has been or will be addressed. The disclosure must be presented in a manner that, to a reasonable person, is prominent, specific and written in plain language.

A registrant does not satisfy the duty to address a material conflict of interest in the best interest of the client solely by providing disclosure to the client. Section 13.4.1 separately requires a registered individual who identifies a material conflict of interest between the individual and the client to promptly report it to the individual's sponsoring firm.

Sections 13.4 and 13.4.1 do not apply to an investment fund manager in respect of an investment fund that is subject to National Instrument 81-107. A registered firm is a registered dealer, a registered adviser or a registered investment fund manager. The 2019 amending instrument replaced section 13.4.

The Ontario Securities Commission ordered, in parallel with the other jurisdictions of the Canadian Securities Administrators, that the day by which a registrant must comply with the conflicts of interest reforms be postponed by six months from December 31, 2020, and the order ceased to have effect on June 30, 2021.

The Canadian Securities Administrators stated in 2019 that amendments to National Instrument 31-103 would be implemented as a rule in each of Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Northwest Territories, Nova Scotia, Nunavut, Ontario, Prince Edward Island and Yukon. In Québec the amendments were to be adopted as a regulation made under section 331.1 of the Securities Act (Québec). In Saskatchewan they were to be implemented as a commission regulation.

Section 143 of the Securities Act (Ontario) lets the Commission make rules prescribing requirements for registrants, including standards of practice and business conduct in dealing with clients and requirements for the prevention or regulation of conflicts of interest. The Act defines regulations as the regulations made under the Act and, unless the context otherwise indicates, the rules.

The Act defines Ontario securities law as the Act, the regulations and, in respect of a person or company, a decision of the Commission, the Tribunal or a Director to which the person or company is subject. A person or company that contravenes Ontario securities law is guilty of an offence and on conviction is liable to a fine of not more than $10 million or to imprisonment for a term of not more than five years less a day, or to both.

The Act provides for an order requiring a person or company that has not complied with Ontario securities law to pay an administrative penalty of not more than $5 million for each failure to comply. The offence and penalty amounts above are those of the Securities Act (Ontario), and National Instrument 14-101 lists a separate securities act for each other province and territory.

Section 14.2 of National Instrument 31-103 requires a registered firm to deliver to a client all information that a reasonable investor would consider important about the client's relationship with the registrant. That information must include a statement that the registered firm must determine that any investment action it takes, recommends or decides on, for the client is suitable for the client and puts the client's interest first.

It must also include a general description of any limits on the products and services the registered firm will offer to the client, including whether the firm will primarily or exclusively offer proprietary products to the client. It must include a description of the conflicts of interest that the registered firm is required to disclose to a client under securities legislation, and the information the registered firm has collected about the client under section 13.2.

The firm must deliver the information in writing, except that the description of products and services may be provided orally or in writing, before the firm first purchases or sells a security for the client or advises the client to purchase, sell or hold a security. If there is a significant change in the information delivered, the registered firm must take reasonable steps to notify the client of the change in a timely manner.

The text current to September 13, 2023 exempts an investment dealer that is a member of IIROC, unless it is also registered as an investment fund manager, from subsections 14.2(2) to (6). A registered firm is a registered dealer, a registered adviser or a registered investment fund manager. The 2019 amending instrument amended section 14.2.

The Ontario Securities Commission ordered, in parallel with the other jurisdictions of the Canadian Securities Administrators, that the day by which a registrant must comply with the relationship disclosure information reforms be postponed to December 31, 2021.

The Canadian Securities Administrators stated in 2019 that amendments to National Instrument 31-103 would be implemented as a rule in each of Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Northwest Territories, Nova Scotia, Nunavut, Ontario, Prince Edward Island and Yukon. In Québec the amendments were to be adopted as a regulation made under section 331.1 of the Securities Act (Québec). In Saskatchewan they were to be implemented as a commission regulation.

Section 143 of the Securities Act (Ontario) lets the Commission make rules prescribing requirements for registrants, including standards of practice and business conduct in dealing with clients and requirements for the prevention or regulation of conflicts of interest. The Act defines regulations as the regulations made under the Act and, unless the context otherwise indicates, the rules.

The Act defines Ontario securities law as the Act, the regulations and, in respect of a person or company, a decision of the Commission, the Tribunal or a Director to which the person or company is subject. A person or company that contravenes Ontario securities law is guilty of an offence and on conviction is liable to a fine of not more than $10 million or to imprisonment for a term of not more than five years less a day, or to both.

The Act provides for an order requiring a person or company that has not complied with Ontario securities law to pay an administrative penalty of not more than $5 million for each failure to comply. The offence and penalty amounts above are those of the Securities Act (Ontario), and National Instrument 14-101 lists a separate securities act for each other province and territory.

Section 13.3 of National Instrument 31-103 requires a registrant, before it opens an account for a client, purchases, sells, deposits, exchanges or transfers securities for a client's account, takes any other investment action for a client, makes a recommendation to a client or exercises discretion to take any such action, to determine on a reasonable basis that the action is suitable for the client and puts the client's interest first.

The factors for suitability are the client's information collected under section 13.2, the registrant's assessment or understanding of the security consistent with section 13.2.1, the impact of the action on the client's account including the concentration of securities within the account and the liquidity of those securities, the potential and actual impact of costs on the client's return on investment, and a reasonable range of alternative actions available to the registrant through the registered firm at the time the determination is made.

A registrant must review a client's account and the securities in it to determine whether the criteria are met, and take reasonable steps within a reasonable time, after a registered individual is designated as responsible for the account, after the registrant becomes aware of a change in a security in the account or in the client's information that could result in the security or account not satisfying the criteria, and after the registrant reviews the client's information under subsection 13.2(4.1).

A registrant may carry out a client's instruction to take an action that does not satisfy the criteria only if it has informed the client of the basis for the determination, recommended an alternative action that satisfies the criteria and received recorded confirmation of the client's instruction to proceed. Section 13.3 does not apply if the client is a registered firm, a Canadian financial institution or a Schedule III bank.

Section 13.3 does not apply to a registered dealer in respect of a client if it purchases or sells securities for the client only as directed by a registered adviser acting for the client. Section 13.3.1 provides that section 13.3 does not apply to a registrant in respect of a permitted client that has requested in writing that the registrant not make suitability determinations, if the client is not an individual or, if the client is an individual, the account is not a managed account.

The text current to September 13, 2023 relieves a dealing representative of an investment dealer that is a member of IIROC from section 13.3, if the individual complies with the corresponding IIROC provisions that are in effect. It relieves a dealing representative of a mutual fund dealer that is a member of the MFDA from section 13.3 on the same condition as to the corresponding MFDA provisions. The 2019 amending instrument replaced subsection 13.3(1). It also added section 13.3.1.

The Canadian Securities Administrators provided that the amendments other than those on conflicts of interest and relationship disclosure information would take effect on December 31, 2021. In Ontario a registrant is a person or company registered or required to be registered under the Securities Act.

The Canadian Securities Administrators stated in 2019 that amendments to National Instrument 31-103 would be implemented as a rule in each of Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Northwest Territories, Nova Scotia, Nunavut, Ontario, Prince Edward Island and Yukon. In Québec the amendments were to be adopted as a regulation made under section 331.1 of the Securities Act (Québec). In Saskatchewan they were to be implemented as a commission regulation.

Section 143 of the Securities Act (Ontario) lets the Commission make rules prescribing requirements for registrants, including standards of practice and business conduct in dealing with clients and requirements for the prevention or regulation of conflicts of interest. The Act defines regulations as the regulations made under the Act and, unless the context otherwise indicates, the rules.

The Act defines Ontario securities law as the Act, the regulations and, in respect of a person or company, a decision of the Commission, the Tribunal or a Director to which the person or company is subject. A person or company that contravenes Ontario securities law is guilty of an offence and on conviction is liable to a fine of not more than $10 million or to imprisonment for a term of not more than five years less a day, or to both.

The Act provides for an order requiring a person or company that has not complied with Ontario securities law to pay an administrative penalty of not more than $5 million for each failure to comply. The offence and penalty amounts above are those of the Securities Act (Ontario), and National Instrument 14-101 lists a separate securities act for each other province and territory.

Requires an organization to report to the Privacy Commissioner, and to notify the affected individual directly, any breach of security safeguards involving personal information under its control where it is reasonable to believe the breach creates a real risk of significant harm. Significant harm includes bodily harm, humiliation, damage to reputation, financial loss and identity theft; relevant factors include the sensitivity of the information and the probability of misuse. Added to PIPEDA by the 2015 Digital Privacy Act, with the reporting duty itself brought into force November 1, 2018.

Governs the collection, use and disclosure of personal information by private-sector organizations in the course of commercial activity, and by any organization in connection with the personal information of its employees where the organization is a federal work, undertaking or business.

Every organization must comply with the ten Schedule 1 fair information principles (accountability, identifying purposes, consent, limiting collection, limiting use and disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance) and may collect, use or disclose personal information only for purposes a reasonable person would consider appropriate.

It excludes government institutions covered by the Privacy Act, purely personal or domestic use, and journalistic, artistic or literary purposes.

Makes it an offence, prosecuted either on indictment (imprisonment for a term of not more than 10 years) or on summary conviction, to fraudulently and without colour of right obtain a computer service, intercept a function of a computer system, or use a computer system to commit those offences, or to traffic in a computer password enabling such access.

The offence turns on fraud and absence of authorization to use the service, not on the technique of access, so scraping a page a site has made publicly and unauthenticated is not, on its own, an unauthorized use; the analysis changes once a scraper circumvents an access control or continues after an unambiguous revocation of permission. The provisions this entry describes came into force on different days.

Section 41 of the Copyright Act defines a technological protection measure as any effective technology, device or component that, in the ordinary course of its operation, controls access to a work, a performer's performance fixed in a sound recording or a sound recording and whose use is authorized by the copyright owner, or restricts the doing of an act referred to in section 3, 15 or 18 or an act for which remuneration is payable under section 19.

For a measure that controls access, to circumvent means to descramble a scrambled work or computer program, or decrypt an encrypted work or computer program, or to otherwise avoid, bypass, remove, deactivate or impair the measure, unless it is done with the authority of the copyright owner. Paragraph 41.1(1)(a) prohibits any person from circumventing a technological protection measure within the meaning of paragraph (a) of that definition, which is a measure that controls access to the work.

Paragraph 41.1(1)(b) separately prohibits offering or providing services to the public if the services are offered or provided primarily for the purposes of circumventing a technological protection measure, if their uses are not commercially significant other than for circumvention, or if the person markets them as being for that purpose.

Paragraph 41.1(1)(c) prohibits manufacturing, importing, distributing, offering for sale or rental or providing a technology, device or component that is designed or produced primarily for the purposes of circumventing a technological protection measure, whose uses are not commercially significant other than for circumvention, or that the person markets as being for that purpose.

The owner of the copyright in the work is entitled, subject to the Act and any regulations made under section 41.21, to all remedies by way of injunction, damages, accounts, delivery up and otherwise that are or may be conferred by law for the infringement of copyright against a person who contravened paragraph 41.1(1)(a). The owner may not elect to recover statutory damages from an individual who contravened that paragraph only for his or her own private purposes.

Paragraph 41.1(1)(a) does not apply if a technological protection measure is circumvented for the purposes of an investigation related to the enforcement of any Act of Parliament or any Act of the legislature of a province, or for the purposes of activities related to the protection of national security.

Paragraph 41.1(1)(a) does not apply to a person who circumvents a technological protection measure that protects a lawfully obtained computer program for the purpose of obtaining information that would allow the program or a device in which it is embedded to be made interoperable with any other computer program, device or component, or of making it interoperable.

Paragraph 41.1(1)(a) also does not apply to a person who, for the purposes of encryption research, circumvents a technological protection measure by means of decryption if it would not be practical to carry out the research without circumventing it, the person has lawfully obtained the protected work, and the person has informed the owner of the copyright who applied the measure.

A person who knowingly and for commercial purposes contravenes section 41.1 commits an offence, unless acting on behalf of a library, archive, museum or educational institution, and is liable on conviction on indictment to a fine not exceeding $1,000,000 or imprisonment for up to five years or both, or on summary conviction to a fine not exceeding $25,000 or imprisonment for up to six months or both.

Sections 41 to 41.21 were enacted by section 47 of the Copyright Modernization Act, which came into force on November 7, 2012, the day on which the order fixing its commencement was published in the Canada Gazette, Part II.

Fair dealing for the purpose of research, private study, education, parody or satire does not infringe copyright; further statutory dealings are enumerated elsewhere in the Act (including, at s. 29.2, news reporting).

The list is closed rather than illustrative, unlike US fair use, and Canada has enacted no text-and-data-mining exception of the kind the EU's Digital Single Market Directive or Japan's Copyright Act provide, so training an AI model on copyrighted text collected by crawling falls outside the enumerated fair-dealing categories and outside any text and data mining (TDM)-specific carve-out; a 2023-2024 government consultation on copyright and generative AI had not produced legislation as of mid-2026.

The current text, adding education, parody or satire to the enumerated purposes, was substituted for the whole section by the Copyright Modernization Act, S.C. 2012, c. 20, s. 21, in force since 7 November 2012.

Applies to personal information an organization collects, uses or discloses in the course of commercial activity, without a general exemption for information that happens to be publicly accessible on the web.

A narrow regulatory carve-out lets an organization collect, use or disclose personal information without consent where it is both publicly available and specified by regulation, but that carve-out is defined by regulation rather than by the fact of public accessibility alone, so scraping a public page does not, by itself, take the resulting personal information outside PIPEDA's other obligations, including purpose limitation and accountability for onward transfer.

The full obligations this instrument imposes are set out in the PIPEDA entry in the privacy topic for this jurisdiction; this entry covers only the personal-data dimension of scraping. This is the same underlying statute as that PIPEDA instrument.

Section 8 of the Critical Cyber Systems Protection Act requires a designated operator that owns, controls or operates a critical cyber system to comply with the requirements of the Act and the regulations with respect to that critical cyber system. Section 9(1) of the Act requires a designated operator that belongs to a class of operators set out in Schedule 2 to establish a cyber security program in respect of its critical cyber systems within 90 days after it becomes a member of that class.

Section 12 of the Act requires the designated operator to implement the cyber security program by taking the steps that are included in it and to maintain the program. Section 15 of the Act requires the designated operator to mitigate any cyber security risk associated with its supply chain or its use of third-party products and services as soon as the risk has been identified. Section 7 of the Act allows the Governor in Council to amend Schedule 2 by order.

Schedule 1 to the Act names telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems within the legislative authority of Parliament, banking systems, and clearing and settlement systems as vital services and vital systems. The Act was enacted by section 11 of chapter 9 of the Statutes of Canada, 2026 and is not in force.

Section 16 of the amending Act brings the provisions of Part 2 into force on a day or days to be fixed by order of the Governor in Council. Section 137 of the Act makes it an offence to contravene subsection 9(1) or section 12 or 15.

The objects of the Office of the Superintendent of Financial Institutions, in respect of financial institutions, include supervising them to determine whether they are in sound financial condition and are complying with their governing statute law and supervisory requirements under that law.

Those objects also include supervising financial institutions to determine whether they have adequate policies and procedures to protect themselves against threats to their integrity or security, including foreign interference.

The Office is also to promptly advise the management and board of directors of a financial institution that is not in sound financial condition or is not complying with its governing statute law or supervisory requirements under that law, and to take, or require the management or board to take, the necessary corrective measures to deal with the situation without delay.

They further include promoting the adoption by management and boards of directors of financial institutions of policies and procedures designed to control and manage risk. Part I of the Act, which is the Office of the Superintendent of Financial Institutions Act, came into force on July 2, 1987.

Under section 645 of the Bank Act, the Superintendent may direct a bank that is committing, or is about to commit, an unsafe or unsound practice in conducting its business or affairs to cease or refrain from the act or course of conduct and to perform the acts the Superintendent considers necessary to remedy the situation.

A direction may also require a bank to take any measures the Superintendent considers necessary to remedy the situation where the bank does not have adequate policies and procedures to protect itself against threats to its integrity or security or does not adhere to them. No direction under subsection 645(1) or (1.1) may be issued unless the bank is provided with a reasonable opportunity to make representations in respect of the matter.

Where the time needed for representations might be prejudicial to the public interest, the Superintendent may make a temporary direction having effect for a period of not more than 15 days. Where a bank has failed to comply with a direction made under section 645, the Superintendent may apply to a court for an order requiring the bank to comply with the direction. OSFI describes its guidelines as outlining expectations for financial institutions. OSFI says it uses its guidance as a basis for its supervision.

Section 17(1) of the Retail Payment Activities Act requires a payment service provider that performs retail payment activities to establish, implement and maintain a risk management and incident response framework that meets prescribed requirements, for the purposes of identifying and mitigating operational risks and responding to incidents.

Section 2 of the Act defines an operational risk as a risk that a deficiency in the payment service provider's information system or internal process, a human error, a management failure or a disruption caused by an external event will result in the reduction, deterioration or breakdown of retail payment activities. Section 17(2) of the Act allows the Bank of Canada or a person it designates to assess the framework and to provide the payment service provider with a list of corrective measures.

Section 2 of the Act defines a payment service provider as an individual or entity that performs payment functions as a service or business activity that is not incidental to another service or business activity. Sections 17 to 22 of the Act came into force on September 8, 2025. Section 76(1) of the Act makes a contravention designated by regulation a violation that carries a penalty established in accordance with the regulations.

Section 15.1(1) of the Telecommunications Act allows the Governor in Council, by order, to prohibit a telecommunications service provider from using all products and services provided by a specified person in its telecommunications network or facilities or to direct it to remove all products provided by a specified person.

Section 15.2(1) of the Act allows the Minister, by order, to prohibit a telecommunications service provider from providing any service to a specified person and to direct it to suspend providing a service to a specified person for a specified period. Section 15.2(2) of the Act allows the Minister, by order, to prohibit a telecommunications service provider from using any specified product or service in its network or facilities and to direct it to remove any specified product.

Section 72.131 of the Act makes every contravention of a provision of an order made under section 15.1 or 15.2 a violation carrying an administrative monetary penalty of up to $10,000,000, or $15,000,000 for a subsequent contravention, for a person other than an individual. Section 73(3.1) of the Act makes it an offence punishable on summary conviction to contravene an order made under section 15.1 or 15.2. The consolidation of the Act is current to 30 September 2026 and was last amended on 15 June 2026.

Section 17 of the Critical Cyber Systems Protection Act requires a designated operator to report a cyber security incident in respect of any of its critical cyber systems to the Communications Security Establishment within a period the regulations prescribe, not to exceed 72 hours. Section 18 of the Act requires the designated operator, immediately after reporting a cyber security incident, to notify the appropriate regulator that the report was made and to give it a copy of the report.

Section 2 of the Act defines a cyber security incident in respect of a critical cyber system as an incident that interferes or may interfere with the continuity or security of a vital service or vital system or with the confidentiality, integrity or availability of the critical cyber system. Section 136(1) of the Act makes it an offence punishable on summary conviction to contravene section 17 or 18. The Act was enacted by section 11 of chapter 9 of the Statutes of Canada, 2026 and is not in force.

Section 18(1) of the Retail Payment Activities Act requires a payment service provider that performs retail payment activities, if it becomes aware of an incident that has a material impact on an end user, another payment service provider or a clearing house of a designated clearing and settlement system, to notify that individual or entity and the Bank of Canada of the incident without delay.

Section 2 of the Act defines an incident as an event or series of related events that is unplanned by a payment service provider and that results in or could reasonably be expected to result in the reduction, deterioration or breakdown of any retail payment activity that it performs. Section 18(2) of the Act requires the notice to be given in the prescribed form and manner and to contain the prescribed information.

Section 19(1) of the Act allows the Bank of Canada to direct, by order, a payment service provider that has given a notice to provide any follow-up notice that the Bank considers relevant. Sections 17 to 22 of the Act came into force on September 8, 2025. Section 76(1) of the Act makes a contravention designated by regulation a violation that carries a penalty established in accordance with the regulations.

Section 6 prohibits sending, or causing or permitting to be sent, a commercial electronic message to an electronic address unless the recipient has consented, expressly or impliedly, and the message identifies who sent it (and on whose behalf, if different), gives the recipient a way to readily contact that person, and carries an unsubscribe mechanism valid for at least 60 days.

Section 11 requires that mechanism to work through the same electronic means the message was sent by where practicable and requires effect to be given to an unsubscribe request without delay and no later than 10 business days after it is sent.

Consent is implied under section 10 only where the sender has an existing business relationship (a purchase, lease, barter or written contract within the last two years, or an inquiry within the last six months) or an existing non-business relationship such as a donation, volunteer work or membership with a registered charity, political party or candidate within the last two years, or where the recipient conspicuously published their address without stating they did not want unsolicited messages and the message concerns their business, role or duties.

Section 9 separately prohibits aiding, inducing or procuring the sending of a message contrary to these rules on someone else's behalf.

A message that solely gives a quote the recipient requested, completes or confirms a transaction the recipient already agreed to, gives warranty, recall or safety information about a product the recipient uses, provides factual account or subscription status information, relates to an existing employment relationship, or delivers something the recipient is already entitled to receive is exempt from the consent requirement but not from the identification and unsubscribe requirements, and section 6 does not apply at all to a message between individuals with a personal or family relationship or to a message to a business that consists solely of an inquiry or application about its commercial activity.

Every contravention of sections 6 to 9 is a violation carrying an administrative monetary penalty, and the private right of action Parliament enacted alongside this section, sections 47 to 51, was repealed before it was ever brought into force.

Section 8 prohibits installing, or causing to be installed, a computer program on another person's computer system in the course of a commercial activity, and prohibits causing an electronic message to be sent from a system on which a program was installed this way, unless the owner or an authorized user of the system has given express consent or a court has ordered it; the prohibition applies only where the computer system is in Canada, or where the person installing the program, or the person directing them, is in Canada.

Section 10(8) deems a person to have expressly consented to a cookie, HTML code, JavaScript, an operating system, or another program that runs only through a program they already consented to, where their conduct makes it reasonable to believe they consent to it running.

Where a program performs a function the owner or user would not reasonably expect, such as collecting personal information stored on the system, interfering with the owner's or user's control of it, changing settings or data without their knowledge, or letting a third party activate it without their knowledge, section 10(4) requires that function's material elements and their impact to be described clearly and prominently, separately from the licence agreement, with a written acknowledgement obtained from the person consenting; section 11(5) then requires a one-year window in which that person can ask to have the program removed or disabled if the description they were given was inaccurate.

An update or upgrade to a program already consented to under these rules does not need fresh consent under section 10(7). The same administrative monetary penalty scheme that backs sections 6 to 9 backs this section, and CASL's private right of action, sections 47 to 51, was repealed before it was ever brought into force.

Section 184(1) makes it an offence, punishable by up to five years' imprisonment on indictable conviction or by summary conviction, to knowingly intercept a private communication by means of an electro-magnetic, acoustic, mechanical or other device.

Section 184(2)(a) exempts a person who has the consent, express or implied, of the originator of the communication or of the person the originator intended to receive it, which makes Canada a one-party-consent jurisdiction; that exemption is not limited to a person who is themselves a party to the call, so a third party such as a recording or transcription vendor engaged by a business can rely on the same consent the business itself holds as a party to the call.

A further exemption in section 184(2)(c) covers a telecommunications service provider that intercepts a communication where necessary to provide the service, for service-quality monitoring, or to protect its own rights or property related to providing the service.

Section 193(1) separately makes it an offence, punishable by up to two years' imprisonment on indictable conviction or by summary conviction, to knowingly use, disclose, or disclose the existence of, a private communication that was intercepted without the consent of the originator or intended recipient.

Section 194 lets a court that has convicted an accused of an offence under section 184, 184.5, 193 or 193.1 order, on the application of the person aggrieved and at the time sentence is imposed, punitive damages of up to $5,000, unless that person has already commenced an action under Part II of the Crown Liability Act over the same conduct; the award, once made, can be registered and enforced as a civil judgment. The provisions this entry describes came into force on different days.

Section 41 lets the Commission, by order, prohibit or regulate the use of a Canadian carrier's telecommunications facilities for unsolicited telecommunications, to the extent it considers necessary to prevent undue inconvenience or nuisance, but this power expressly does not reach a commercial electronic message that section 6 of Canada's Anti-Spam Legislation already governs.

Sections 41.1 to 41.7, added in 2005, create the legislative framework for a National Do Not Call List, letting the Commission administer the list and investigate contraventions, and exempting a telecommunication made by or for a registered charity, made to a person with an existing business relationship who has not asked not to be called, made by or for a registered political party or a candidate or nomination or leadership contestant's campaign, made solely to survey the public, or made solely to solicit a newspaper subscription.

A caller relying on one of these exemptions (other than the survey exemption) must identify at the outset the purpose of the call and the person or organization on whose behalf it is made, and must maintain its own do-not-call list honouring anyone who has asked not to be contacted on that basis.

A contravention of a Commission order or requirement under section 41 is a violation carrying an administrative monetary penalty of up to $1,500 for an individual or $15,000 for a corporation, with each day a violation continues capable of being a separate violation, or, exclusively of the administrative-penalty route, a summary-conviction offence.

Anyone who has sustained loss or damage from an act or omission contrary to the Act or a Commission decision, including a section 41 order, may sue for their actual loss within two years under the Act's general civil-liability provision. The sections this entry groups came into force on different days.

Section 7 of the Act applies it to any person, partnership or unincorporated organization that operates a work or carries on an undertaking or business within the legislative authority of Parliament, other than a work, undertaking or business of a local or private nature in Yukon, the Northwest Territories or Nunavut, and to any entity or person that acts in the name of, or for the benefit of, such a person in operating it.

Section 5 lists information and communication technologies among the areas in which barriers are to be identified and removed. Section 69 requires a regulated entity that is not a broadcasting, telecommunications or transportation entity to prepare and publish an accessibility plan on its policies, programs, practices and services in relation to the identification and removal of barriers in the areas listed in section 5.

Section 42 imposes the plan duty on a regulated entity that carries on a broadcasting undertaking. Section 51 imposes the plan duty on a regulated entity that is a Canadian carrier or a telecommunications service provider. Section 60 imposes the plan duty on a regulated entity that is required to comply with the regulations made under subsection 170(1) of the Canada Transportation Act.

Section 47 requires a regulated entity that carries on a broadcasting undertaking to prepare and publish a further accessibility plan under the regulations made under subsection 117(1), for the areas that section lists, and sections 56 and 65 do the same for telecommunications and transportation entities. Section 69 also requires an updated version of the plan no later than the third anniversary of the day on which the plan was last published.

The regulated entity must consult persons with disabilities in the preparation of its accessibility plan and every updated version of it. Section 70 requires a regulated entity to establish a process for receiving feedback about the implementation of its plan and about the barriers encountered by its employees and by other persons that deal with it. Section 71 requires a regulated entity to prepare and publish a progress report on its implementation of its accessibility plan.

Section 72 lets the Minister exempt a regulated entity or class of regulated entities from all or any part of sections 69 to 71. A regulated entity that contravenes the plan, feedback and progress-report duties of sections 47 to 49, 56 to 58, 65 to 67 and 69 to 71 commits a violation and is liable to a warning or to a penalty fixed in accordance with the regulations.

A violation that is committed or continued on more than one day is a separate violation in respect of each day on which it is committed or continued. The maximum penalty that may be fixed in respect of a violation is $250,000. A regulated entity that does not comply with a compliance agreement can be served with a notice of default making it liable to pay twice the amount of the penalty, without taking account of that maximum, or forfeiting the security it gave.

Section 127 provides that section 126 of the Criminal Code does not apply to a contravention of the Act or of the regulations made pursuant to subsection 117(1). The Accessibility Commissioner is the member of the Canadian Human Rights Commission appointed pursuant to subsection 26(1) of the Canadian Human Rights Act.

Section 94 lets an individual who has been adversely affected by a regulated entity's contravention of the regulations made pursuant to subsection 117(1) file a complaint with the Accessibility Commissioner.

Section 102 lets the Accessibility Commissioner, on a substantiated complaint, order the regulated entity to pay the complainant compensation of up to $20,000 for pain and suffering, and up to $20,000 more where the contravention results from a wilful or reckless practice, amounts the section adjusts by the Consumer Price Index for each later calendar year.

Section 19.5 of the Regulations, as replaced by the amending regulations, requires a covered regulated entity to make each web page that is not employee-facing and is created or updated after the section first applies to it conform, to the extent feasible, to the applicable requirements of the ICT Standard for as long as the page is available to the public.

The ICT Standard is the standard CAN/ASC - EN 301 549, Accessibility requirements for ICT products and services, published by Accessibility Standards Canada, as amended from time to time. Sections 19.5, 19.51 and 19.52 do not bind a broadcasting or telecommunications entity or a transportation service provider. Section 19.51 requires the same conformity for a mobile application that a covered entity launches after the section first applies to it and that is not employee-facing.

Section 19.52 requires the same conformity for a non-web document made available for download from its web pages or mobile applications. Section 19.6 requires a covered entity to publish an accessibility statement no later than the day on which the obligation first applies to it and then once every 12 months.

Section 19.8 requires a regulated entity described in paragraph 7(1)(e) of the Act that meets the employee threshold the section states, other than a transportation service provider to which Part 1 of the Accessible Transportation for Persons with Disabilities Regulations does not apply, to ensure that each employee involved in the development, maintenance or procurement of information and communication technologies has received training on accessibility fundamentals.

Section 19.61 requires a covered entity that starts a procurement of products or services for a web page or mobile application to obtain, as part of the procurement, a conformity assessment against the ICT Standard. The amending regulations come into force on the second anniversary of the day on which they are registered, except sections 7 to 14, 16 and 17, which come into force on the third anniversary. The amending regulations were registered on December 5, 2025.

Section 88 of the Act treats a violation that is committed or continued on more than one day as a separate violation in respect of each day on which it is committed or continued. Schedule 1 to the Accessible Canada Regulations classifies a violation of the new web page, mobile application, non-web document, accessibility statement, procurement and training provisions as a minor violation.

Section 3 exempts the regulated entities described in paragraph 7(1)(e) or (f) of the Act whose average number of employees does not reach the threshold it sets from the plan, feedback and progress-report duties of the Act. Section 4 fixes, by class of regulated entity, the day from which the year to publish an initial accessibility plan runs. Section 6 requires an accessibility plan to be published in a format that meets the requirements for Level AA conformance that are set out in the WCAG.

The Regulations define the WCAG as the most recent version that is available in both English and French of the Web Content Accessibility Guidelines. Section 7 requires the regulated entity to notify the Accessibility Commissioner of each publication of a plan within 48 hours. Section 9 requires a regulated entity to designate a person responsible for receiving feedback.

Section 18 requires a regulated entity with a public digital platform to keep each published plan and progress report on it for seven years. Section 88 of the Act treats a violation that is committed or continued on more than one day as a separate violation in respect of each day on which it is committed or continued.

Schedule 2, Part 2 sets the range for a minor violation by a small business at $500 to $5,000 for a first violation, $5,000 to $12,500 for a second, $12,500 to $25,000 for a third and $25,000 to $37,500 for a fourth or subsequent violation.

Schedule 2, Part 1 sets the range for a minor violation by a person other than a regulated entity at $250 to $2,500 for a first violation, $2,500 to $6,250 for a second, $6,250 to $12,500 for a third and $12,500 to $18,750 for a fourth or subsequent violation. Schedule 1 classifies a violation of subsections of sections 47 to 49, 56 to 58, 65 to 67 and 69 to 71 of the Act as a minor violation.

Schedule 1 also classifies a violation of the Regulations' feedback process and retention provisions as a minor violation. It classifies a violation of subsection 73(8) of the Act as a serious violation and a violation of sections 124 to 126 of the Act, the obstruction and false-statement prohibitions, as a very serious violation.

Schedule 2, Part 3 sets the range for a very serious violation by a regulated entity that is not a small business at $25,000 to $50,000 for a first violation, $50,000 to $100,000 for a second, $100,000 to $150,000 for a third and $150,000 to $250,000 for a fourth or subsequent violation. Only prior violations committed during the five years before the notice of violation is served are taken into account.

Section 26 fixes the amount within a range by a formula that applies a gravity value, and section 27 sets the lesser amount that may be paid in complete satisfaction at 90% of the penalty, payable within 15 days after the notice is served.

Section 3 fixes the day from which the year to publish an initial accessibility plan runs for each class of regulated transport entity. Class 4, the regulated entities described in paragraph 7(1)(e) or (f) of the Act with the smallest average number of employees in the current calendar year, has no fixed day. Section 5 requires a regulated transport entity to publish its plan in a format that meets the requirements of Level AA conformance that are set out in the WCAG.

The Regulations define the WCAG as the Web Content Accessibility Guidelines published by the World Wide Web Consortium, as amended from time to time. Section 6 requires the entity to notify the Canadian Transportation Agency of each publication of its plan within 48 hours. Section 9 requires the description of the feedback process to be published in a format that meets the requirements of Level AA conformance that are set out in the WCAG.

Section 14 requires a Class 2 or Class 3 regulated transport entity to publish a progress report by June 1 in each calendar year in which it is not required to publish an accessibility plan. Section 177 of the Canada Transportation Act makes a contravention of subsections 60(1) to (4) and (7), 61(1) to (3) and 62(1) to (3) and (6) of the Accessible Canada Act a violation with a maximum amount payable of $250,000 for each violation.

The Regulations came into force on the day on which they were registered. Section 179 of the Canada Transportation Act treats a violation that is committed or continued on more than one day as a separate violation for each day on which it is committed or continued.

Part 1 applies to every carrier to which Part 3 applies, every terminal operator to which Division 1 of Part 4 applies, CATSA and the CBSA.

Division 1 of Part 3 applies to every large air carrier that is a Canadian and provides a domestic service or international service for the transportation of passengers, a class section 63 defines by the number of passengers the carrier transported worldwide, and Division 1 of Part 4 applies to the owners, operators and lessees of the airports and of the rail, ferry and bus terminals that section 212 lists, other than a terminal that section 213 excludes by the average number of personnel who work there.

Section 11 requires a transportation service provider that owns, operates or controls the hardware or software components of an automated self-service kiosk available for public use in a terminal to ensure that those components meet the requirements of the National Standard of Canada CAN/CSA-B651.2-07 (R2017), Accessible design for self-service interactive devices.

A provider that owns, operates or controls the hardware components must ensure that the kiosk is visually and tactilely discernible by an International Symbol of Access affixed to its front. For a period of two years beginning on the day it came into force, section 12 required a kiosk that met section 11 to be marked with signage specifying that persons with disabilities have priority access.

Section 13 requires the provider to assist a person with a disability, on request and without delay, to use such a kiosk. Section 14 requires the provider to keep each such kiosk in good working order and, while one is out of order, to direct the person to the nearest working kiosk offering the same service or let the person advance to the front of the line at a counter. Section 243 brings sections 13 and 14 into force on the first anniversary of the day on which the Regulations were registered.

Section 243 brings section 11 into force on the third anniversary of the day on which the Regulations were registered. The Regulations were registered on June 25, 2019. Section 177 of the Canada Transportation Act makes a contravention of a provision of a regulation made under subsection 170(1) a violation with a maximum amount payable of $250,000 for each violation.

Section 179 of the Canada Transportation Act treats a violation that is committed or continued on more than one day as a separate violation for each day on which it is committed or continued.

Part 1 applies to every carrier to which Part 3 applies, every terminal operator to which Division 1 of Part 4 applies, CATSA and the CBSA.

Division 1 of Part 3 applies to every large air carrier that is a Canadian and provides a domestic service or international service for the transportation of passengers, a class section 63 defines by the number of passengers the carrier transported worldwide, and Division 1 of Part 4 applies to the owners, operators and lessees of the airports and of the rail, ferry and bus terminals that section 212 lists, other than a terminal that section 213 excludes by the average number of personnel who work there.

Section 9 requires a transportation service provider to ensure that every website, mobile website and application that it owns, operates or controls and that is made available to the public meets the requirements for a Level AA conformance that are set out in the Web Content Accessibility Guidelines.

The Regulations define the Web Content Accessibility Guidelines as the World Wide Web Consortium Recommendation dated December 2008, entitled Web Content Accessibility Guidelines (WCAG) 2.0, as amended from time to time. Section 8 requires a provider whose website can be used to access a client account, make a reservation or check in to offer persons with disabilities the option of doing those things by a communication system that does not require the use of a website.

Section 243 brings the Regulations into force on the first anniversary of the day on which they were registered, with later dates for the sections it lists. The Regulations were registered on June 25, 2019. Section 177 of the Canada Transportation Act makes a contravention of a provision of a regulation made under subsection 170(1) a violation with a maximum amount payable of $250,000 for each violation.

Section 179 of the Canada Transportation Act treats a violation that is committed or continued on more than one day as a separate violation for each day on which it is committed or continued.

In Broadcasting and Telecom Regulatory Policy CRTC 2009-430, the Canadian Radio-television and Telecommunications Commission, pursuant to section 24 of the Telecommunications Act, requires Canadian carriers, as a condition of providing service, to implement its customer service accessibility requirements and to include in their contracts with resellers a condition that resellers comply with them.

It requires the service providers to make the information on telecommunications services and products on their websites accessible to the point of providing a reasonable accommodation for persons with disabilities, with the service providers determining how to achieve this, by July 23, 2012.

Among the examples of reasonable accommodation the Commission gives are a website whose textual content meets the W3C Web Content Accessibility Guidelines and a text-only version of the website, easily accessed from the home page, that complies with them.

Where customer service functions on a website are inaccessible, persons with disabilities must not incur a charge or otherwise be disadvantaged if they use another channel of customer service, and the service providers must make accessible any customer service function available only on their websites by July 23, 2012.

The service providers must promote information on all of their disability-specific services and products in the accessible manners of their choice, and incorporate an easy-to-find home page link to the special needs or disability sections of their websites, if their websites include such sections, by July 21, 2010.

They must make their general call centers accessible by training customer service representatives in handling inquiries from persons with disabilities by July 21, 2010 and by making Interactive Voice Response systems accessible by July 21, 2011. For Class 1 and direct-to-home broadcasting distribution undertakings, the Commission said it would consider imposing these requirements as conditions of license at their license renewals.

Section 72.001 of the Telecommunications Act makes every contravention of a decision the Commission made pursuant to that Act a violation, with maximum penalties of $25,000 for an individual's first contravention and $50,000 for a subsequent one, and of $10,000,000 and $15,000,000 for any other person.

Section 3 fixes, by class of regulated broadcasting entity, the day from which the year to publish an initial accessibility plan runs. Section 19 does the same for each class of regulated telecommunications entity.

Class B2 and Class T2 take in every regulated entity described in paragraph 7(1)(e) or (f) of the Act that carries on a broadcasting undertaking or is a Canadian carrier or telecommunications service provider and is not a member of any other class, and Class B3 and Class T3 take in such an entity that has submitted an attestation to the Commission placing its number of employees in the band those classes cover.

No day is fixed for Class B4 or Class T4, the entities that have attested to the smallest number of employees, or for Class T5, a telecommunications service provider whose service is limited to a service offered without an explicit charge, a service offered on a temporary basis only to individuals on its premises, or a service that does not allow autonomous two-way voice telecommunications or Internet access.

Section 5 requires a regulated broadcasting entity to publish its plan on the main digital platform that it owns, operates or controls and in a format that meets the requirements of Level AA conformance that are set out in the WCAG. Section 21 imposes the same publication requirement on a regulated telecommunications entity. The Regulations define the WCAG as the Web Content Accessibility Guidelines published by the World Wide Web Consortium, as amended from time to time.

Section 7 requires a regulated broadcasting entity to notify the Commission of each publication of its plan within 48 hours. Section 9 requires a regulated broadcasting entity to allow feedback to be provided anonymously. The Regulations came into force on the day on which they were registered.

Section 72.001 of the Telecommunications Act makes a contravention of the plan, feedback and progress-report duties of sections 51 to 53 of the Accessible Canada Act a violation, with maximum penalties of $25,000 for an individual's first contravention and $50,000 for a subsequent one, and of $10,000,000 and $15,000,000 for any other person.

Section 34.4 of the Broadcasting Act makes a contravention of sections 42 to 44 of the Accessible Canada Act a violation, and a violation that is continued on more than one day is a separate violation for each day on which it is continued. Section 34.5 of the Broadcasting Act sets the same maximum penalties for an individual and for any other person.

The CRTC granted Google a five-year exemption from the Online News Act's mandatory bargaining requirements after Google agreed to contribute C$100 million annually to the Canadian Journalism Collective (CJC) for distribution to eligible Canadian news businesses. Key conditions include annual admission of new eligible news businesses to the CJC, a 2% cap on indemnity claims, and notification of any agreement changes or breaches. Payment to the CJC was required within 60 days of the decision.

Requires operators of designated digital news intermediaries (large search engines and social media platforms meeting the revenue and user thresholds set in regulations, to bargain with eligible Canadian news businesses and reach compensation agreements; failing agreement, mandatory mediation and final offer arbitration apply. Administered by the CRTC. Received Royal Assent June 22, 2023; came into force December 19, 2023 (180 days after assent).

Sets the thresholds triggering the Online News Act: global revenue exceeding C$1 billion and at least 20 million Canadian monthly unique visitors (search) or active users (social media). Requires the largest search engine by Canadian advertising market share to provide at least C$100 million per year (CPI-indexed via formula: C$100M × CPIx ÷ CPI2023) to news businesses as a condition of exemption eligibility. Published in the Canada Gazette, Part II, Vol. 158, No. 1 (January 3, 2024); in force December 19, 2023.

Establishes operational procedures for mandatory bargaining under the Online News Act: a 90-day bargaining period, followed by a 120-day mediation phase, and a 45-day final offer arbitration (FOA) period. Also governs undue-preference complaints filed by eligible news businesses against platforms, and mandates data collection from both platforms and news businesses to support annual auditor reports.

A separate code-of-conduct regulation was consulted on in late 2024 (CRTC 2024-236 Notice of Consultation) but had not been registered as of the date shown.

Permits fair dealing with any copyrighted work for the purpose of news reporting, provided the source is mentioned and, if given in the source, so is the name of the author, performer, maker or broadcaster, as the case may be.

This exception may shield news aggregators from copyright infringement claims when reproducing limited news excerpts or snippets, subject to the six-factor fairness analysis established by the Supreme Court of Canada in CCH Canadian Ltd. v. Law Society of Upper Canada (2004 SCC 13). Canada has no separate press-publisher neighbouring right analogous to the EU's Article 15 Directive.