Nova Scotia

A fake intimate image is a visual recording that, in a reasonably convincing manner, falsely depicts an identifiable person as nude, exposing the person's genital organs, anal region or breasts, or engaged in explicit sexual activity, that is created through any means including software, machine learning or artificial intelligence, and in respect of which it is reasonable to suspect that the person depicted would not consent to its recording or distribution.

An intimate image is a fake intimate image or a personal intimate image. A person depicted in an intimate image that is distributed without consent, or the parent or guardian of a minor so depicted, may apply to the Court for an order. In an application for an order respecting the distribution of an intimate image without consent, or a threatened distribution, it is presumed that the person depicted did not consent.

The Court may order a person who has distributed an intimate image without consent, or threatened to, not to distribute it or threaten to distribute it, and to take down or disable access to an intimate image.

The Court may order any person to provide information in the person's possession that may help identify a person who used an Internet Protocol address, website, electronic username or account, electronic mail address or other unique identifier to distribute an intimate image without consent, and to take down or disable access to the image. The Court may order the person to pay general, special, aggravated or punitive damages to the person depicted and to account for profits.

A person who revokes consent to the distribution of an intimate image depicting the person and tells the distributor that consent is revoked can require the distributor to make every reasonable effort to make the image unavailable to others.

A person who contravenes an order made under the Act, other than an order for payment of damages or accounting of profits, is guilty of an offence and liable on summary conviction to a fine of not more than $5,000 or to imprisonment for not more than six months, or both. A person who fails to comply with a notice to pay an administrative penalty is guilty of an offence and liable on summary conviction to a fine of not more than $15,000 or to imprisonment for not more than six months, or both.

The Act is consolidated as amended by sections 14 to 24 of chapter 15 of the Acts of 2026. The Act came into force on proclamation on July 5, 2018. The Legislature's consolidated statutes do not include amendments that are not in force.

A custodian that has custody or control of personal health information about an individual must notify the individual at the first reasonable opportunity if it believes on a reasonable basis that the information is stolen, lost or subject to unauthorized access, use, disclosure, copying or modification and that there is potential for harm or embarrassment to the individual as a result.

A custodian that decides not to notify the individual because it is unlikely that a breach has occurred, or because there is no potential for harm or embarrassment, must notify the Review Officer as soon as possible. An agent of a custodian must notify the custodian at the first reasonable opportunity if personal health information it handles on the custodian's behalf is stolen, lost or accessed by unauthorized persons.

A custodian may disclose personal health information collected in the Province to a person outside the Province if the individual consents, the Act or the regulations permit it, the disclosure is to a regulated health professional to meet the functions of another jurisdiction's prescription monitoring program, the disclosure is for health system planning and management, relates to health care provided in the Province to a resident of another province and is made to that province's government, or it is reasonably necessary for the provision of health care and the individual has not expressly instructed the custodian not to make it.

A foreign demand for disclosure is a subpoena, warrant, order, demand or request from a foreign court, an agency of a foreign state or another authority outside Canada for the unauthorized disclosure of personal information to which the Act applies.

A public body, an employee of a public body, or an employee or associate of a service provider that receives a foreign demand for disclosure, or has reason to suspect that an unauthorized disclosure has occurred in response to one, must immediately notify the Minister. The notice must include, as known or suspected, the nature of the foreign demand, who made it, when it was received and what information was sought or disclosed.

An employer that is a service provider or an associate of a service provider must not dismiss, suspend, demote, discipline, harass or otherwise disadvantage an employee, or deny the employee a benefit, because the employee in good faith and on a reasonable belief notified the Minister under section 6. The Act came into force on November 15, 2006.

A public body must ensure that personal information in its custody or under its control is stored only in Canada and accessed only in Canada, and a service provider or an associate of a service provider must ensure the same of the personal information in its custody or under its control, unless the individual consented in the prescribed manner, the storage or access is for a disclosure the Act allows, or the head of the public body has allowed storage or access outside Canada.

A service provider is a person retained under a contract to perform services for a public body who, in the course of performing them, uses, discloses, manages, stores or accesses personal information in the custody or under the control of the public body. The head of a public body may allow storage or access outside Canada, subject to any restrictions or conditions the head considers advisable, if the head considers it necessary to meet the requirements of the public body's operation.

In providing storage, access or disclosure of personal information outside Canada, a service provider must collect and use only the personal information necessary to fulfil its obligation as a service provider and must at all times make reasonable security arrangements to protect the personal information it collects or uses for a public body.

A public body, service provider or associate of a service provider must ensure that personal information in its custody or under its control is disclosed outside Canada only as the Act permits. The Act came into force on November 15, 2006.

An individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a custodian. A custodian may refuse access to a record on the grounds the Act lists, which include that the record is subject to a legal privilege that restricts disclosure to the individual.

A custodian that receives a request for access to or correction of a record must, no later than thirty days after receiving it, grant it, refuse it or extend the deadline by not more than thirty days or, with the Review Officer's permission, longer. A custodian must grant a request for correction if the individual demonstrates to the custodian's satisfaction that the record is not complete, accurate or up-to-date and gives the custodian the information necessary to correct it.

The Review Officer may monitor how the privacy provisions are administered, conduct reviews of complaints, initiate an investigation of compliance where there are reasonable grounds to believe a custodian has contravened or is about to contravene them, and mediate and make recommendations on complaints. The Review Officer's report on a review sets out recommendations, and the custodian must within thirty days decide whether to follow them and give written notice of the decision.

A person is guilty of an offence if the person wilfully collects, uses or discloses health information in contravention of the Act or the regulations. It is also an offence to fail to protect personal health information in a secure manner as the Act requires. It is also an offence to use individually identifying health information to market a service for a commercial purpose or to solicit money unless the individual has expressly consented to that use.

An individual guilty of an offence is liable on summary conviction to a fine of not more than ten thousand dollars or imprisonment for six months, or both, and a corporation to a fine of not more than fifty thousand dollars. An officer, member, employee or other agent of a corporation who authorized the offence, or who had the authority to prevent it and knowingly refrained from doing so, is a party to and guilty of the offence.

A service provider, or an employee or associate of a service provider, who stores or allows access to personal information contrary to the limit in section 5(1), collects or uses personal information beyond what section 5(4) allows or fails to make reasonable security arrangements, or contravenes section 6, 7, 8 or 9, is guilty of an offence.

A person guilty of that offence is liable on summary conviction to a fine of not more than two thousand dollars for an individual who is not a service provider, twenty-five thousand dollars for an individual who is a service provider and five hundred thousand dollars for a corporation. It is a defence for the person charged to prove that the person exercised due diligence to avoid the commission of the offence.

A director, officer or employee of a public body who maliciously discloses personal information in contravention of the Act or the regulations is guilty of an offence and liable on summary conviction to a fine of not more than two thousand dollars or to imprisonment for six months, or both. The Act came into force on November 15, 2006.

No person may conduct or act as a consumer reporting agency unless the person holds a valid permit under the Act. A consumer reporting agency may furnish information from its files only in a consumer report given in response to a court order, on the consumer's written instructions or to a person it has reason to believe intends to use the information for a listed purpose such as credit, a tenancy, employment or insurance underwriting.

A consumer reporting agency must not report information that is not extracted from information appearing in files stored or collected in a repository located in Canada. No person may procure a consumer report about a consumer without the consumer's express written consent, or unless the person notifies the consumer in writing that a report has been or will be requested and gives the name and address of the agency within ten days after requesting it.

A consumer reporting agency must, at the written request of a consumer, disclose to the consumer without charge the nature and substance of all information in its files, its sources and the recipients of reports in the preceding twelve months.

A person who contravenes the Act or the regulations is liable on summary conviction to a fine of not more than two thousand dollars or to imprisonment for not more than one year, or both, and a corporation convicted of an offence is liable to a maximum penalty of twenty-five thousand dollars.

A custodian must not collect, use or disclose personal health information about an individual unless the custodian has the individual's consent under the Act and the collection, use or disclosure is reasonably necessary for a lawful purpose, or the Act permits or requires it. The collection, use and disclosure of personal health information must be limited to the minimum amount necessary to achieve the purpose for which it is collected, used and disclosed.

A custodian must implement, maintain and comply with information practices that are reasonable in the circumstances and that protect the information against theft or loss and against unauthorized access, use, disclosure, copying or modification. A custodian must create and maintain a record of user activity for any electronic information system it uses to maintain personal health information. A custodian must designate one or more individuals as a contact person.

A custodian must make available to the public a written statement that provides a general description of its information practices. The Act does not apply to an employer, an insurance company or another individual or organization that collects, uses or discloses personal health information for purposes other than health care and the planning and management of the health system.

A person who is not a custodian, or authorized by the regulations to do so, must not collect or use an individual's health card number. The Act applies to the collection, use or disclosure of a health-card number by any person.

Unless the parties agree otherwise, an offer or the acceptance of an offer, or any other matter that is material to the formation or operation of a contract, may be expressed by means of an electronic document or by an action in electronic form, including touching or clicking on an appropriately designated icon or place on a computer screen or otherwise communicating electronically in a manner intended to express it.

A contract must not be denied legal effect or enforceability solely by reason that an electronic document was used in its formation. A contract may be formed by the interaction of an electronic agent and a natural person or by the interaction of electronic agents. An electronic agent is a computer program or any electronic means used to initiate an action or to respond to electronic documents or actions in whole or in part without review by a natural person at the time of the response or action.

An electronic document made by a natural person with the electronic agent of another person has no legal effect and is not enforceable if the person made a material error in it and the electronic agent did not provide an opportunity to prevent or correct the error, together with the other conditions in section 23. The Act does not limit the operation of any law of the Province that expressly authorizes, prohibits or regulates the use of electronic documents.

The Legislative Counsel's consolidated text of the Act shows sections 20 to 23 with only their original enactment as history, and no amendment. The Act came into force on November 30, 2000.