Manitoba

The Public Sector Artificial Intelligence and Cybersecurity Governance Act received Royal Assent on June 1, 2026. It comes into force on a day to be fixed by proclamation. An artificial intelligence system is a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments, or a prescribed system.

The Act applies to prescribed public sector entities, which are drawn from the government, government agencies, other reporting organizations under The Financial Administration Act, municipalities, incorporated communities and local government districts. It applies to an artificial intelligence system used by such an entity that is publicly available, developed or procured by the entity, or developed by a third party on behalf of the entity.

If required by and in accordance with the regulations, a prescribed entity that uses an artificial intelligence system must provide information to the public about its use, develop and implement an accountability framework and take steps to manage risks. The entity must use the system in accordance with the regulations. The entity must not use it for any use or purpose that the regulations prohibit.

In prescribed circumstances the entity must ensure that an individual exercises oversight of the use of the system and provides additional information about it, in accordance with the regulations. A prescribed entity that uses an artificial intelligence system must comply with the prescribed technical standards for that use. The regulations may prohibit the use of an artificial intelligence system, including for purposes such as the production of artistic or creative material.

A fake intimate image is a visual recording that, in a reasonably convincing manner, falsely depicts an identifiable person as engaging in explicit sexual activity, nude or nearly nude, or exposing their genital organs, anal region or breasts, that is created through the use of software, machine learning, artificial intelligence or other means, and that the person depicted would reasonably be suspected not to consent to.

A person who distributes an intimate image of another person knowing that the person who is or is depicted in the image did not consent, or being reckless as to consent, commits a tort against that person, and an intimate image is either a personal intimate image or a fake intimate image. A person who threatens to distribute an intimate image of another person commits a tort against that person. An action may be brought without proof of damage.

In an action for distribution the distribution is presumed to have occurred without consent, and the defendant must establish that they had reasonable grounds to believe they had consent to distribute the image.

The court may award general, special, aggravated and punitive damages, order the defendant to account for profits, order the defendant to make every reasonable effort to make the image unavailable to others, and order an Internet intermediary or other person to make every reasonable effort to remove and de-index the image within a time period the order specifies.

An Internet intermediary, which is a person or organization that hosts or indexes third-party content through an online platform, is not liable in an action under the Act if it has taken reasonable steps to address unlawful distribution of intimate images in the use of its services. Chapter 17 of the Statutes of Manitoba, 2024, which added the fake intimate image provisions, received Royal Assent on June 4, 2024. That chapter came into force on the day it received Royal Assent.

Chapter 2 of the Statutes of Manitoba, 2026 added the tort of threatening to distribute an intimate image, the court orders concerning Internet intermediaries and the limit on an intermediary's liability. It received Royal Assent on June 1, 2026. It took effect on that day under its own coming-into-force section.

The Business Practices Act applies to a supplier, which for certainty includes an online retailer and an online distributor. Personalized algorithmic pricing is pricing based on the use of an algorithm or automated processing to set, recommend or vary a price offered to a specific consumer as a result of data about the consumer.

For an online retailer or online distributor, the use of personalized algorithmic pricing to increase the price of the goods demanded from the consumer is a deemed unfair business practice. Where the price of a part of a consumer transaction is displayed by an electronic shelf labelling system, demanding a higher price at the point of sale due to personalized algorithmic pricing in respect of that consumer is a deemed unfair business practice.

The use of personalized algorithmic pricing as part of a consumer transaction is deemed to be a material fact. For an online retailer or online distributor, a consumer is deemed to give express consent to a higher price only if the supplier prominently discloses the reason for the higher price in clear and understandable language and the consumer takes clear overt action to consent.

It is also a deemed unfair business practice for such a supplier to take advantage of a consumer by demanding a price higher than the price offered to other consumers because of personalized algorithmic pricing in respect of that consumer. An unfair business practice may occur through the use of algorithms, data analytics, machine learning or artificial intelligence by the supplier or a third party.

The Director of Business Practices may order a supplier committing an unfair business practice to cease it. A consumer may commence a court action against a supplier for relief from an unfair business practice. A person who contravenes the Act is guilty of an offense and liable on summary conviction to a fine of up to $100,000 or 12 months in prison, or both, for an individual's first offense, and to a fine of up to $300,000 for a corporation's first offense. The personalized algorithmic pricing amendments came into force on July 1, 2026.

A privacy breach, in relation to personal health information, is theft or loss, or access, use, disclosure, destruction or alteration in contravention of the Act. A trustee that maintains personal health information about an individual must notify the individual about a privacy breach if, after considering the relevant factors prescribed in the regulations, the breach could reasonably be expected to create a real risk of significant harm to the individual.

The notice must be given as soon as practicable after the privacy breach becomes known to the trustee. A trustee that is required to notify an individual must also notify the Ombudsman at the time and in the form and manner that the Ombudsman requires. The regulation requires the notice to the individual to be in writing and to describe the circumstances of the breach, the information involved and the steps taken and the steps the individual can take.

The factors the regulation lists include the sensitivity of the personal health information involved and the probability that it could be used to cause significant harm to the individual. The factors also include whether the information was adequately encrypted, anonymized or otherwise not easily accessible. A person who fails to comply with the notification duty is guilty of an offense. The notification duty came into force on January 1, 2022.

An individual has a right, on request, to examine and receive a copy of their personal health information maintained by a trustee.

A trustee must respond as promptly as required in the circumstances and not later than 24 hours after receiving the request if the trustee is a hospital and the information is about health care currently being provided to an in-patient, 72 hours if the trustee is currently providing health care to a person who is not a hospital in-patient, and 30 days in any other case. A trustee's failure to respond within that time is treated as a decision to refuse the request.

In responding, a trustee must make the information available for examination and provide a copy if requested, inform the individual in writing if the information does not exist or cannot be found, or inform the individual in writing that the request is refused for a reason described in section 11. A trustee must take reasonable steps to inform individuals of their right to examine and receive a copy of their personal health information and how to exercise it.

An individual may request a trustee to correct personal health information for purposes of accuracy or completeness. A trustee must respond to a correction request within 30 days by making the correction, by informing the individual that the information no longer exists or is not maintained by the trustee, or by informing the individual in writing of the refusal and the right to add a statement of disagreement.

The Ombudsman may conduct investigations and audits and make recommendations to monitor and ensure compliance with the Act. An individual may make a complaint to the Ombudsman alleging that a trustee has collected, used or disclosed the individual's personal health information contrary to the Act or has failed to protect it in a secure manner as the Act requires.

On a review of a complaint about privacy, the adjudicator may order a trustee to cease or modify a practice of collecting, using, disclosing, retaining or destroying personal health information contrary to the Act, to destroy information collected in contravention of the Act, or to perform a duty the Act imposes.

A person who obtains another person's personal health information by falsely representing an entitlement to it, or who knowingly falsifies another person's personal health information, is guilty of an offense.

An employee, officer or agent of a trustee, information manager or health research organization who, without authorization, wilfully discloses personal health information in circumstances where the trustee would not be permitted to, or uses or gains access to another person's personal health information, is guilty of an offense. A person guilty of an offense under section 63 is liable on summary conviction to a fine of not more than $50,000.

A director or officer of a corporation that is guilty of an offense who authorized, permitted or acquiesced in the offense is also guilty of an offense and liable to a fine of not more than $50,000.

A person who substantially, unreasonably, and without claim of right, violates the privacy of another person commits a tort against that other person. An action for violation of privacy may be brought without proof of damage. Privacy may be violated by auditory or visual surveillance of a person, their home or other place of residence, or any vehicle, by any means including eavesdropping, watching, spying, besetting or following.

Privacy may be violated by listening to or recording a conversation in which the person participates, or messages to or from the person, passing along, over or through any telephone lines, otherwise than as a lawful party or under lawful authority.

Privacy may be violated by the unauthorized use of a person's name, likeness or voice for advertising or promoting the sale of any property or services, or for any other purpose of gain, if the person is identified or identifiable and the user intended to exploit it. Privacy may also be violated by using a person's letters, diaries and other personal documents without the person's consent.

In an action the court may award damages, grant an injunction if it appears just and reasonable, order the defendant to account for profits, and order delivery up of articles or documents. It is a defense that the person expressly or by implication consented, or that the defendant acted reasonably and neither knew nor should reasonably have known the conduct would violate anyone's privacy. The Act as re-enacted in the Revised Statutes of Manitoba, 1987 came into force on February 1, 1988.

An information manager is a person or body that processes, stores or destroys personal health information for a trustee, or provides information management or information technology services to a trustee. A trustee may provide personal health information to an information manager for the purpose of processing, storing or destroying it or providing the trustee with information management or information technology services.

An information manager may use the information only for those purposes and activities, which must be purposes and activities that the trustee itself may undertake. A trustee must enter into a written agreement with the information manager that provides for the protection of the information against such risks as unauthorized access, use, disclosure, destruction or alteration, in accordance with the regulations.

An information manager must comply with the same requirements concerning the protection, retention and destruction of personal health information that the trustee must comply with under the Act, and with the duties the agreement imposes. Information provided to an information manager under such an agreement is deemed to be maintained by the trustee.

The PHIN is the personal health identification number assigned to an individual by the Minister to uniquely identify the individual for health care purposes. No person other than a trustee may require the production of another person's PHIN or collect or use another person's PHIN.

A person may nonetheless collect or use another person's PHIN for purposes related to the provision of publicly funded health care to the other person, for a health research project approved under the Act, or in circumstances the regulations permit. A person who requires production of, or collects or uses, another person's PHIN contrary to section 26 is guilty of an offense.

A trustee must protect personal health information by adopting reasonable administrative, technical and physical safeguards that ensure its confidentiality, security, accuracy and integrity. In determining whether its safeguards are reasonable, a trustee must take into account the degree of sensitivity of the personal health information to be protected.

A trustee must establish and comply with a written policy and procedures that provide for the security of personal health information during its collection, use, disclosure, storage and destruction, for recording security breaches and for corrective procedures. For any electronic information system it uses to maintain personal health information, a trustee must create and maintain a record of user activity in accordance with the Minister's guidelines.

A trustee must keep a record of user activity for at least three years. A trustee must audit records of user activity to detect security breaches. A trustee must conduct an audit of its security safeguards at least every two years. If an audit identifies deficiencies in its security safeguards, the trustee must take steps to correct them as soon as practicable. A trustee must provide orientation and ongoing training to its employees and agents about its security policy and procedures. A trustee must ensure that each employee and agent signs a pledge of confidentiality.

The Personal Health Information Act binds a trustee, which is a health professional, health care facility, public body or health services agency that collects or maintains personal health information. A trustee may collect personal health information about an individual only for a lawful purpose connected with a function or activity of the trustee, and only if the collection is necessary for that purpose.

A trustee must collect only as much personal health information about an individual as is reasonably necessary to accomplish the purpose for which it is collected. Whenever possible, a trustee must collect personal health information directly from the individual the information is about. A trustee that collects the information directly from the individual must take reasonable steps to inform the individual of the purpose for which it is being collected.

A trustee must establish a written policy on the retention and destruction of personal health information and must comply with it. A trustee may use personal health information only for the purpose for which it was collected or received, unless an exception in the Act applies. Every use and disclosure by a trustee must be limited to the minimum amount of information necessary to accomplish the purpose for which it is used or disclosed.

A trustee may disclose personal health information only to the individual or the individual's representative or with the individual's consent, except where the Act permits disclosure without consent. No trustee may sell or otherwise dispose of or disclose for consideration personal health information unless the sale is essential to facilitate the sale of a practice or business as a going concern and is to another trustee.

The restriction to a sale to another trustee does not apply to a change in ownership of a pharmacy in compliance with The Pharmaceutical Act. The Act does not apply to statistical health information, or to health information that does not allow an individual to be readily identified. The Act came into force by proclamation on December 11, 1997.

A personal investigation is an inquiry by any person to obtain factual or investigative information from any source other than the subject with a view to entering into or amending an agreement with the subject for credit, insurance, employment or tenancy. No person may conduct, or cause to be conducted, a personal investigation without the consent of the subject, given in accordance with the regulations.

A personal report may not contain a reference to race, religion, ethnic origin or political affiliation unless the subject voluntarily supplied it, and may not contain any investigative information about the subject unless reasonable efforts have been made to corroborate it. No personal reporter, user or personal reporting agency may knowingly divulge the contents of a personal report or file except to the persons the Act lists.

A user who denies a subject a benefit after a personal investigation must advise the subject in writing within 10 days of the denial of the right to be informed of the information obtained. A personal reporting agency must disclose to the subject, within 24 hours of a demand, the source and detail of the factual information and the nature of the investigative information in the report.

Any person may ask a personal reporting agency whether it maintains a personal file on the person and, on payment of the prescribed fee, is entitled to the disclosure. When a subject protests information, the user, personal reporter or agency must attempt to verify it and expunge it if it cannot be verified, or record the protest if it is sustained. A personal reporting agency must include a security alert in a subject's personal file as soon as practicable after receiving the subject's request.

If a security alert is in place, the personal reporting agency must give it to every person to whom the contents of the subject's personal file or personal report are divulged. A person who contravenes the Act or the regulations is guilty of an offense and liable on summary conviction to a fine of not more than $10,000 for an individual's first offense and $50,000 for each later one, and not more than $25,000 for a corporation's first offense and $100,000 for each later one. The Act as re-enacted in the Revised Statutes of Manitoba, 1987 came into force on February 1, 1988.

Unless the parties agree otherwise, an offer, the acceptance of an offer, or any other matter that is material to the formation or operation of a contract may be expressed by means of an electronic document, or by an act such as touching a computer screen, clicking on a computer screen or speaking that is intended to electronically communicate it. A contract is not denied legal effect or enforceability merely because an electronic document was used in its formation.

An electronic agent is a computer program or any other electronic means used to initiate an act, or to respond to an electronic document or act, without review by an individual at the time of the act or response. A contract may be formed by the interaction of an electronic agent and an individual or by the interaction of electronic agents.

A contract formed by the interaction of an individual with the electronic agent of another person has no legal effect if the individual made a material error in the electronic document and the electronic agent did not provide an opportunity to prevent or correct the error, the individual promptly notifies the other person of the error, and the individual returns or destroys any consideration and does not benefit materially from it.

Nothing in the Act affects the operation of any law that authorizes, requires or regulates the use of electronic means to record, retain or communicate information or documents. Part 3 of the Act, on electronic contracts and communications, came into force on October 23, 2000.

The Public Sector Artificial Intelligence and Cybersecurity Governance Act received Royal Assent on June 1, 2026. It comes into force on a day to be fixed by proclamation. Its purpose includes setting cybersecurity standards. It applies to prescribed public sector entities, which are drawn from the government, government agencies, other reporting organizations under The Financial Administration Act, municipalities, incorporated communities and local government districts.

A prescribed public sector entity must comply with the prescribed requirements for cybersecurity. A prescribed public sector entity must comply with the prescribed technical standards for cybersecurity. The minister may, with the approval of the Lieutenant Governor in Council, issue a directive to a prescribed public sector entity respecting the cybersecurity requirements and technical standards. The entity to which a directive is issued must comply with it.

The minister must make the directive publicly available in any manner the minister considers appropriate. The Lieutenant Governor in Council may by regulation prescribe the public sector entities that are required to develop and implement programs for ensuring cybersecurity. The Lieutenant Governor in Council may by regulation require public sector entities to submit reports to the minister or a specified individual in respect of incidents relating to cybersecurity.