Privacy & Cybersecurity in Canada, the US, and the EU
This is a monthly bulletin published by the Privacy and Cybersecurity Group at Fasken with noteworthy news and updates. If you have any questions about the items in this bulletin, please contact any member of the Privacy and Cybersecurity Group, and we will be pleased to assist.
Canada
BC Office of Information and Privacy Commissioner Publishes Updated OIPC Process Guidance
On June 1, 2026, the Office of the Information and Privacy Commissioner for BC published updated guides on their processes, including how they handle complaints, requests for review, inquiries, and applications to disregard requests for records. The guide relating to private organizations and Personal Information and Protection Act (PIPA) can be found here, and the guide for public bodies can be found here. Organizations should familiarize themselves with these guides if they receive any personal information or access requests.
BC OIPC Calls for Public Bodies to Report Freedom of Information Metrics
On June 24, 2026, the BC OIPC called for changes to FIPPA that would add a requirement for all BC provincial bodies to track and report Freedom of Information metrics to their office. This is not a mandatory requirement at this time, but to encourage public bodies to collect and retain FOI metrics, the Privacy Commissioner published a metric reporting checklist that can be used by public bodies at any time.
Alberta Privacy Commissioner Publishes Guidance on Using Updated Driver’s Licences and ID Cards
On July 2, 2026, the Alberta Office of the Information and Privacy Commissioner (AB OIPC) published guidance for private organizations, public bodies, and the public to assist entities that will collect information on the new driver’s licences and identification (ID) cards being issued in Alberta. As announced earlier in the year, the new ID cards and driver’s licences will now incorporate personal health numbers (PHNs) and Canadian citizenship markers, where applicable. Guidance documents can be located on the AB OIPC’s website, for the public, public bodies and private organizations.
Privacy Commissioner of Canada Publishes Guidance for Financial Reporting Entities
On July 9, 2026, the Privacy Commissioner of Canada published guidance on submitting codes of practice for sharing personal information for financial reporting entities, as part of their efforts to detect or deter money-laundering, terrorist activity financing, and sanctions evasion. Following legislative changes in March 2025, reporting entities under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act can share personal information among one another without an individual’s knowledge or consent in certain circumstances, subject to the entity establishing a code of practice to govern this information sharing. In addition, the code must be approved by the Privacy Commissioner of Canada, in line with this new guidance.
Privacy Commissioner of Canada Publishes Findings on Grok and Deepfakes
On June 11, 2026, the Privacy Commissioner of Canada published its findings on its investigation into X Corporation’s compliance with Personal Information Protection and Electronic Documents Act (PIPEDA) after receiving reports that the chatbot Grok had generated, and publicly disclosed, millions of sexually explicit deepfakes of real and identifiable individuals. The Privacy Commissioner of Canada (OPC) found that X had not obtained valid consent to collect, use, and disclose individuals’ personal information for the purpose of generating sexualized deepfakes, and that a reasonable person would consider this practice to be inappropriate in the given circumstances. The OPC made suggestions to X for improving its compliance with PIPEDA and ensuring the protection of individual privacy.
United States
Connecticut Passes New Privacy and Artificial Intelligence Law
On May 27, 2026, Senate Bill 5 was signed into law by Gov. Ned Lamont, establishing a sweeping online safety and AI regulatory regime. The law includes provisions targeting the use of AI in hiring and employment decisions and requiring operators of chatbots and companion models to implement protocols to detect suicidal ideation or indicators of self-harm expressed by children and adults. The bill also requires social media companies to take action to protect children from social media addiction, including restricting their access to addictive personalized feeds. The dates for compliance with this new law range from 2026 until January 2028, and all organizations doing business in Connecticut should become familiar with the Act.
Louisiana Passes New Privacy Legislation
On May 29, 2026, the Louisiana Data Privacy Act (SB 386) was signed into law, making Louisiana the 22nd state to pass a broad consumer data privacy law. This law is similar to Texas’ data privacy law, with some minor differences. All organizations doing business within Louisiana should review this new law and its potential impacts on their operations.
European Union
EDPB and AMLA to Develop Joint Guidance on Information-Sharing Partnerships
On July 1, 2026, the European Data Protection Board (EDPB) and the EU Anti-Money Laundering Authority (AMLA) announced plans to develop joint guidelines addressing information-sharing partnerships in the anti-money laundering context. The initiative is intended to clarify how data protection obligations interact with Anti-Money Laundering information-sharing requirements.
New Guidelines on Anonymization, Web Scraping for Generative AI and Final Version of Guidelines on Blockchain
During its latest plenary on July 8, 2026, the EDPB has adopted guidelines on anonymisation and guidelines on web scraping in the context of generative AI. In addition, the EDPB has adopted the final version of its guidelines on the processing of personal data through blockchain technologies.
Regarding anonymization, the new EDPB guidelines bring clarity to the notion of anonymous data, also taking into account the ruling of the Court of Justice of the EU in the case of C-413/23 P EDPS v SRB of September 4, 2025. Data is anonymous if it does not relate to an identified or identifiable natural person. Whether this is the case may vary from one entity to another, in particular regarding a service provider. The framework uses 3 criteria to test if data is anonymous: 1) no record isolation, 2) no linkage, and 3) no inference. If all 3 criteria are met, the data can be safely considered anonymous. If any of these criteria are not satisfied, further analysis should be done to determine if the data may be considered anonymous.
The EDPB’s draft guidelines on web scraping explain how companies can use web scraping to collect data for AI training while complying with the General Data Protection Regulations (GDPR). They stress the importance of transparency, data quality, and collecting only the data that is necessary. The guidelines also clarify that sensitive personal data require additional legal justification and safeguards. The draft guidelines are open for public consultation until October 30, 2026.
Finally, the EDPB has adopted its final guidelines on blockchain technologies, providing practical guidance to help organizations ensure GDPR compliance when using blockchain solutions. The guidelines outline how blockchain systems work and analyze the data protection implications of different blockchain architectures.
In Case You Missed It!
The Fasken Privacy and Cybersecurity group recently published the following article, which might be of interest.
About Fasken’s Privacy and Cybersecurity Group
As one of the longest-standing and leading practices in privacy and cybersecurity, our dedicated national privacy team of over 30 lawyers offers a wide range of services. From managing complex privacy issues and data breaches to advising on the EU General Data Protection Regulation and emerging legal regimes, we provide comprehensive legal advisory services and are trusted by clients from all sectors. Our group is recognized as a leader in the field, earning accolades such as the PICCASO ‘Privacy Team of the Year’ award and recognition from Chambers Canada and Best Lawyers in Canada. For more information, please visit our website.
