Alberta

Part 6.21 of the Act defines a deepfake as a depiction in a video, audio, photographic, digital or other medium of a leader of a political party, leadership contestant, Minister, member of the Legislative Assembly, candidate, nomination contestant, the Chief Electoral Officer, the Election Commissioner, an election officer or a person who is or was employed or engaged by either office that is so realistic that a reasonable person would believe it depicts speech or conduct of the depicted person when the depicted person did not engage in the speech or conduct.

The depiction must also be created in a manner that substantially depends on technological means rather than the ability of another person to physically or verbally impersonate the depicted person. A person or entity must not create a deepfake that, if distributed or published by the creator, is likely to mislead electors about speech by or the conduct of the depicted person.

A person or entity must not distribute or publish a deepfake that is likely to mislead electors about speech by or the conduct of the depicted person if the person or entity distributing or publishing it has the intent to mislead electors. The prohibition does not apply if the depicted person consented to the creation, distribution or publication of the deepfake.

If a deepfake is created, distributed or published in contravention of the section, the Chief Electoral Officer may cause it to be removed or discontinued. If the Election Commissioner has reason to believe that a person or entity has contravened the prohibition, the Election Commissioner may issue a written direction to stop creating, distributing or publishing a deepfake and, if applicable, to destroy it.

A person or entity who fails to comply with a direction is guilty of an offence and is liable to a fine not exceeding $10,000 for each day on which the offence occurs or continues, if the offence is committed by a person, and $100,000 for each day, if it is committed by an entity other than a person.

The Election Commissioner may also serve a notice of administrative penalty for a contravention of section 44.9499995, which may not exceed $10,000 if the contravention is committed by a person and $100,000 if it is committed by an entity other than a person.

The Election Commissioner may also serve a notice of administrative penalty for a failure to comply with such a direction, which may not exceed $10,000 for each day on which the contravention occurs or continues if it is committed by a person and $100,000 for each day if it is committed by an entity other than a person. Section 49(1) of the Act makes a contravention of the Act by a corporation, trade union or similar body an offence punishable by a fine of not more than $10,000.

Section 50 makes a contravention by a person, political party or similar body of a provision for which no other fine is provided an offence with the same maximum. A person or entity that pays an administrative penalty for a contravention may not be charged with an offence for the same contravention. Bill 23, the Justice Statutes Amendment Act, 2026, received Royal Assent on April 16, 2026, and the Legislative Assembly's bill record states that it came into force on that day, with exceptions.

The Act applies to all personal information collected, used or disclosed by a public body. A public body must collect personal information directly from the individual the information is about unless the Act lists an exception.

A public body that collects personal information that is required to be collected directly from the individual must give notice to the individual, at the time of collection, of the purpose of the collection, the specific legal authority for it, contact information for questions, and the public body's intention, if any, at that time to input the information into an automated system to generate content or make decisions, recommendations or predictions.

The notice duty does not apply if, in the opinion of the head of the public body, it could reasonably be expected that the information collected would be inaccurate. It also does not apply where the public body previously gave the notice and continues to collect personal information from that individual for the same purpose and under the same specific legal authority.

If an individual's personal information will be used by a public body to make a decision that directly affects the individual, including a decision made using an automated system, the public body must make every reasonable effort to ensure that the information is accurate and complete.

It must also retain the information for at least one year after using it so the individual has a reasonable opportunity to obtain access to it, or for any shorter period agreed in writing by the individual, the public body and, if different, the body that approves the records retention and disposition schedule. The Act came into force on June 11, 2025, on the coming into force of the Access to Information Act.

A person who knowingly collects, uses or discloses personal information in contravention of Part 1 is guilty of an offence. That offence is punishable by a fine of not more than $125,000 for an individual and not more than $750,000 for any other person.

A custodian must, as soon as practicable, give notice of any loss of individually identifying health information or any unauthorized access to or disclosure of individually identifying health information in its custody or under its control if there is a risk of harm to an individual as a result. The notice must be given to the Commissioner, the Minister and the individual who is the subject of the individually identifying health information.

A custodian must consider all relevant factors, including the factors prescribed by the regulations, in assessing whether there is a risk of harm to an individual. If a custodian considers that giving notice to the individual could reasonably be expected to result in a risk of harm to the individual's mental or physical health, the custodian may decide not to give notice to the individual, and it must then immediately give notice to the Commissioner of the decision and the reasons.

An affiliate of a custodian must, as soon as practicable, notify the custodian of any loss of individually identifying health information or any unauthorized access to or disclosure of it in the custody or under the control of the custodian. A custodian that fails to comply with section 60.1(2), (3), (4) or (5), and an affiliate that fails to comply with section 60.1(1), commits an offence under section 107. The Act's breach reporting and notification amendments came into force on August 31, 2018.

An organization having personal information under its control must, without unreasonable delay, provide notice to the Commissioner of any incident involving the loss of or unauthorized access to or disclosure of the personal information where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result.

The Commissioner may require the organization to notify the individuals to whom there is a real risk of significant harm, in the form and manner prescribed by the regulations and within a time period determined by the Commissioner.

The Personal Information Protection Act Regulation requires the notice to the Commissioner to be in writing and to include a description of the circumstances, the date or period, a description of the personal information involved, an assessment of the risk of harm, an estimate of the number of individuals to whom there is a real risk of significant harm, the steps taken to reduce the risk and to notify individuals, and a contact person.

A notification to an individual under section 37.1 must be given directly to the individual, unless the Commissioner determines that direct notification would be unreasonable in the circumstances. A person commits an offence by failing to provide notice to the Commissioner under section 34.1. A person who commits an offence under the Act is liable to a fine of not more than $10,000 if an individual and not more than $100,000 if a person other than an individual.

The Commissioner announced on April 29, 2010 that breach reporting and notification requirements would become law on May 1.

The Act applies to every organization and in respect of all personal information, subject to the exceptions it states. It defines an organization to include a corporation, an unincorporated association, a trade union, a partnership and an individual acting in a commercial capacity, and it excludes an individual acting in a personal or domestic capacity. It does not apply to a public body or to any personal information that is in the custody of or under the control of a public body.

It does not apply to personal information in the custody of an organization if the Protection of Privacy Act applies to that information. A non-profit organization is outside the Act except for personal information that it collects, uses or discloses in connection with a commercial activity. The Act does not apply to health information, as defined in the Health Information Act, to which that Act applies.

An organization may not collect, use or disclose personal information about an individual without the individual's consent, except where the Act provides otherwise. An organization may not, as a condition of supplying a product or service, require an individual to consent to the collection, use or disclosure of personal information beyond what is necessary to provide the product or service.

An individual is deemed to consent where the individual voluntarily provides the information to the organization for a particular purpose and it is reasonable that a person would voluntarily provide it.

An organization may also collect, use or disclose personal information for particular purposes after giving the individual notice and a reasonable opportunity to decline, where the individual does not respond and the collection, use or disclosure is reasonable having regard to the sensitivity of the information. Consent obtained through false or misleading information, or through deceptive or misleading practices, is negated.

An individual may withdraw or vary consent at any time on giving reasonable notice. An organization may collect personal information only for purposes that are reasonable, and only to the extent reasonable for meeting those purposes. The same limits apply to the use and the disclosure of personal information.

Before or at the time of collecting personal information from the individual, an organization must notify the individual in writing or orally of the purposes of the collection and of the name or position name or title of a person who can answer questions about it.

Sections 14, 17 and 20 list the circumstances in which an organization may collect, use or disclose personal information without consent, including where a statute or regulation of Alberta or Canada authorizes or requires it and where it is reasonable for an investigation or a legal proceeding. Collection, use and disclosure without consent is also permitted where the information is publicly available as prescribed or otherwise determined by the regulations.

The Personal Information Protection Act Regulation provides that personal information is publicly available only in the circumstances it lists, which include a telephone directory, a professional or business directory, a government or non-governmental registry, a record of a quasi-judicial body and a publication available to the public.

Section 22 of the Act permits parties to a business transaction to collect, use and disclose personal information without consent under an agreement that restricts its use to the transaction, and it does not apply where the primary purpose, objective or result of the transaction is the purchase, sale, lease, transfer, disposal or disclosure of personal information.

An organization is responsible for personal information in its custody or under its control and must designate one or more individuals to be responsible for ensuring that it complies with the Act. An organization must develop and follow policies and practices that are reasonable for it to meet its obligations under the Act. On a written request, an organization must provide an applicant with access to the applicant's personal information that is in its custody or under its control.

An organization must also tell the applicant, on request, the purposes for which the personal information has been and is being used and the names of the persons to whom and circumstances in which it has been and is being disclosed. An organization must respond to a request not later than 45 days from the day that it receives the written request, unless the period is extended under section 31.

An organization must correct an error or omission in personal information as soon as reasonably possible when an individual asks, and must annotate the information with the correction that was requested but not made. An organization may not charge a fee for a request to correct personal information. An organization must make a reasonable effort to ensure that personal information it collects, uses or discloses is accurate and complete to the extent that is reasonable for its purposes.

An organization must protect personal information in its custody or under its control by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction. An organization may retain personal information only for as long as it reasonably requires the information for legal or business purposes.

Within a reasonable period after that, the organization must destroy the records containing the personal information or render the information non-identifying. The Commissioner may order an organization to stop collecting, using or disclosing personal information in contravention of the Act and to destroy personal information collected in contravention of the Act. An organization must comply with a Commissioner's order not later than 50 days from the day that it is given a copy of the order.

A person who collects, uses or discloses personal information in contravention of Part 2 commits an offence. A person who commits an offence under the Act is liable to a fine of not more than $10,000 if an individual and not more than $100,000 if a person other than an individual.

Neither an organization nor an individual is guilty of an offence under the Act if it is established to the satisfaction of the court that the organization or individual acted reasonably in the circumstances that gave rise to the offence. An individual affected by a Commissioner's order that has become final has a cause of action against the organization for damages for loss or injury suffered as a result of its breach of the Act or the regulations.

If an organization uses a service provider outside Canada to collect, use, disclose or store personal information for or on behalf of the organization, its policies and practices must include information about the countries outside Canada in which the collection, use, disclosure or storage is occurring or may occur and the purposes for which the service provider outside Canada has been authorized to collect, use or disclose personal information.

An organization that uses a service provider outside Canada to collect personal information about an individual with the individual's consent must notify the individual before or at the time of collecting the information. An organization that transfers to a service provider outside Canada personal information that was collected with the individual's consent must likewise notify the individual before or at the time of the transfer.

The notice must tell the individual how to obtain access to written information about the organization's policies and practices with respect to service providers outside Canada. It must also give the name or position name or title of a person who can answer the individual's questions about the collection, use, disclosure or storage of personal information by service providers outside Canada. The notice under section 13.1 is in addition to any notice required under section 13.

The regulations may exempt organizations from all or part of section 13.1. The Commissioner announced on April 29, 2010 that organizations would be required to notify people when transferring personal information to a service provider outside of Canada.

The Act defines an automated system as any technology that assists or replaces the judgment of human decision makers using a rules-based system, regression analysis, predictive analytics, machine learning, deep learning, a neural network or another technique.

A custodian that collects individually identifying health information directly from the individual must take reasonable steps to inform the individual of the custodian's intention, if any, at that time to input the information into an automated system. A custodian that inputs individually identifying health information into or uses it in an automated system must do so in accordance with the regulations, if any.

A custodian that inputs health information into or uses health information in an automated system for a purpose authorized by section 27 must record the custodian's name or number, the name of the individual, the date and purpose of the input or use, and a description of the health information.

The recording requirement does not apply if an electronic system, including the automated system, automatically keeps an electronic log of the custodian's name or number, the individual's name, the date and time of the input or use, and a description of the health information. The information recorded or logged must be retained by the custodian for at least one year following the date of input or use of the automated system.

An individual may ask the custodian for access to and a copy of the information recorded or logged about the individual, and Part 2 of the Act applies to the request. The Lieutenant Governor in Council may make regulations respecting the input and use of individually identifying health information in an automated system, automated systems and their safeguards, and the building and training of automated systems.

Amendments made by the Health Statutes Amendment Act, 2025 (No. 2) came into force on June 22, 2026, with further amendments in force on July 2, 2026. Section 27.1 was added by section 7(10) of the Health Statutes Amendment Act, 2025 (No. 2).

The Act binds a custodian, which it defines to include a licensed pharmacy, an ambulance operator, a provincial health agency and a health services provider designated in the regulations as a custodian or as within a class of custodians. No custodian may collect health information except in accordance with the Act.

A custodian may collect individually identifying health information only if the collection is expressly authorized by an enactment of Alberta or Canada, or if the information relates directly to and is necessary to enable the custodian to carry out a purpose authorized under section 27.

A custodian may use individually identifying health information only for the purposes section 27 lists, including providing health services, determining or verifying the eligibility of an individual to receive a health service, research that meets the Act's requirements, and internal management purposes. No custodian may disclose health information except in accordance with the Act.

A custodian may disclose individually identifying health information to a person other than the individual with the individual's consent, which is valid only if the custodian provides the information that section 34 lists and the individual authorizes the disclosure and acknowledges the risks and benefits.

A custodian that collects health information from an individual using a device that may not be visible to the individual must, before collecting it, obtain the individual's written consent to use the device.

A custodian must take reasonable steps, in accordance with the regulations, to maintain administrative, technical and physical safeguards that protect the confidentiality of health information, including health information that is to be stored or used in a jurisdiction outside Alberta or disclosed to a person in a jurisdiction outside Alberta. Before using or disclosing health information, a custodian must make a reasonable effort to ensure that it is accurate and complete.

A custodian must establish a privacy management program, and each affiliate of a custodian must comply with the Act and the program. A custodian must prepare a privacy impact assessment and submit it to the Commissioner for review and comment before introducing a new administrative practice or information system relating to the collection, use and disclosure of individually identifying health information, or before changing an existing one.

An individual has a right of access to any record containing health information about the individual that is in the custody or under the control of a custodian, subject to the Act's exceptions. A custodian must make every reasonable effort to respond to a request for access within 30 days after receiving the request or within any extended period.

An individual who believes there is an error or omission in the individual's health information may request in writing that the custodian correct or amend it, and the custodian must decide within 30 days or any extended period. No person may knowingly use individually identifying health information to market any service for a commercial purpose or to solicit money unless the individual has specifically consented to its use for that purpose.

A person who contravenes section 107 is guilty of an offence and is liable to a fine of not more than $200,000 if an individual and not more than $1,000,000 if any other person.

Unless the parties otherwise agree, an offer, the acceptance of an offer or any other matter that is material to the formation or operation of a contract may be expressed by means of information or a record in electronic form, or by an act that is intended to result in electronic communication, such as touching or clicking on an appropriate icon or other place on a computer screen, or speaking.

A contract may be formed by the interaction of an electronic agent and a person or by the interaction of electronic agents. An electronic agent is a computer program or any other electronic means used to initiate an act or to respond to electronic information, records or acts, in whole or in part, without review by an individual at the time of the initiation or response.

An electronic transaction between a person and another person's electronic agent has no legal effect if the person makes a material error, the agent gives no opportunity to prevent or correct it, the person promptly notifies the other person on becoming aware of the error, and, where consideration is received as a result of the error, the person returns or destroys it in accordance with the other person's instructions or otherwise deals with it in a reasonable manner and does not benefit materially from it.

The Act does not limit the operation of an enactment or other law that expressly authorizes, requires, prohibits or regulates the use of information or records in electronic form. The Act was proclaimed in force on April 1, 2003.

An electricity market participant must comply with the ISO rules that are in effect and the reliability standards. An electricity market participant includes any person that supplies, generates, transmits, distributes, stores, discharges, trades, exchanges, purchases or sells electricity, electric energy, electricity services or ancillary services. The Act defines reliability standards as the reliability standards made under section 142(1)(l.1).

That provision authorizes regulations respecting reliability standards for or in relation to transmission facilities, electric distribution systems, generating units, energy storage resources or the owners or users of those facilities, systems, units or resources. The Alberta Electric System Operator lists the cyber security standards CIP-002 to CIP-013 and the physical security standard CIP-014 as current Alberta reliability standards.

Except as otherwise provided by the regulations, if the Independent System Operator suspects that an electricity market participant has contravened a reliability standard, it must refer the matter to the Market Surveillance Administrator. A person who fails to comply with the Act or the regulations is guilty of an offence and is liable to a fine of not more than $3,000,000 for each day or part of a day on which the offence occurs or continues.

A critical facility is a coal processing plant, an in situ operation, a mine, a mining operation, a pipeline, a processing plant or a well that is named in the critical infrastructure list as a critical facility, and includes any related facility. The Alberta Energy Regulator must establish and maintain a critical infrastructure list of critical facilities. The Regulator must notify the licensee or approval holder of a critical facility that the facility is on the list.

Security management is a process that addresses security in respect of terrorist activity or the threat of terrorist activity against a critical facility. A licensee or approval holder of a critical facility must establish and implement a security management program for the facility in accordance with CSA Z246.1.

If the Regulator is of the opinion that a licensee or approval holder has failed to do so, it may order the program to be established and implemented, or order the facility shut down or shut in. The Regulation came into force on May 31, 2025. It expires on May 31, 2030.

The standard applies to the operator and the legal owner of a generating unit and of an aggregated generating facility. It also applies to the legal owner of a transmission facility and to the ISO. Each Responsible Entity shall document one or more cyber security incident response plans.

A plan must include one or more processes to determine whether an identified cyber security incident is a reportable cyber security incident and to notify the Electricity Sector Information Sharing and Analysis Center, unless prohibited by law. The initial notification, which may be only a preliminary notice, shall not exceed one hour from the determination of a reportable cyber security incident. Each plan must be tested at least once every 15 months.

No later than 90 days after a test or an actual reportable incident response, the entity must document any lessons learned or the absence of any. The standard was released on October 1, 2017. The Alberta Electric System Operator lists it as a current Alberta reliability standard.