Privacy & Cybersecurity in Canada, the US, and the EU
This is a monthly bulletin published by the Privacy and Cybersecurity Group at Fasken with noteworthy news and updates. If you have any questions about the items in this bulletin, please contact any member of the Privacy and Cybersecurity Group, and we will be pleased to assist.
Canada
Ontario IPC Releases Updated Privacy Impact Assessment Guidance
On August 13, 2026, the Information and Privacy Commissioner of Ontario released Planning for Success: Privacy Impact Assessment Guide for Ontario's Public Institutions. The guide is intended to assist institutions subject to Ontario's public sector privacy legislation in conducting privacy impact assessments and identifying privacy risks associated with new programs, initiatives, or technologies. The guidance reflects recent legislative developments and provides practical recommendations regarding privacy risk assessment and mitigation. Public sector organizations subject to Ontario's access and privacy laws should consider reviewing the updated guidance when planning initiatives involving personal information.
Privacy Commissioner of Canada Submits Recommendations on Privacy Act Modernization
On August 6, 2026, the Office of the Privacy Commissioner of Canada published its submission to the Treasury Board Secretariat's consultation on modernizing the federal Privacy Act. In its submission, the Commissioner expressed support for a number of proposed reforms, including recognizing privacy as a fundamental right and incorporating modern privacy principles into the federal public sector privacy framework. The submission forms part of the federal government's broader effort to update the Privacy Act, which has not undergone substantial reform since coming into force in 1983. Organizations interacting with federal institutions may wish to monitor further developments as the consultation process advances.
Federal Government Launches Consultation on AI Transparency
On July 23, 2026, the Government of Canada launched a public consultation seeking feedback on measures to strengthen transparency surrounding artificial intelligence systems and AI-generated content. The consultation focuses on several key issues, including identifying AI-generated content, informing individuals when they are interacting with AI systems, improving the availability of information regarding AI capabilities and limitations, and facilitating the reporting of serious AI-related incidents. The consultation is open until September 23, 2026, and feedback received is expected to inform the government's next steps on AI governance and transparency measures in Canada.
United States
EU-US Data Privacy Framework Faces Renewed Uncertainty
A recent US Supreme Court decision, Trump v. Slaughter, has raised new uncertainty around the EU-US Data Privacy Framework (the “Framework”) by questioning the independence of the US Federal Trade Commission, which the European Commission has relied on as a key privacy enforcement authority for EU-US data transfers. Privacy advocacy groups in the EU have called on the European Commission to withdraw the US adequacy decision, arguing that the Framework’s legal basis has been undermined. For now, the Framework remains in force unless repealed by the Commission or annulled by the Court of Justice of the European Union, but organizations relying on the Framework, standard contractual clauses, or binding corporate rules should monitor developments closely and revisit transfer risk assessments where appropriate.
In addition, the European Data Protection Board (EDPB) notes in its subsequent letter dated July 31, 2026, to the European Commission on US Supreme Court judgment in Trump v. Slaughter, that the independence of supervisory authorities is a key criterion for assessing whether a third country provides an adequate level of data protection under the General Data Protection Regulation. Because the EU-US Data Privacy Framework adequacy decision explicitly relied on the FTC’s independence, the ruling may have implications for the framework.
The EDPB has asked the European Commission to assess the impact of the judgment on the EU-US Data Privacy Framework and to keep the Board informed of any developments.
California Privacy Protection Agency Reaches Settlement with Data Broker
The California Privacy Protection Agency announced a settlement with a data broker for allegedly failing to register and for requiring consumers to provide unnecessary information when exercising opt-out rights. This is notable because it signals increasing enforcement attention on data brokers and consumer rights mechanisms under California privacy laws and represents the first decision under the California Consumer Privacy Act (CCPA).
European Union
Commission Publishes New Guidance to Support Timely Cyber Resilience Act Implementation
The EU Cyber Resilience Act, in force since December 2024, introduces mandatory cybersecurity requirements throughout the lifecycle of digital products to better protect consumers and businesses. To support implementation, the European Commission has issued practical guidance that helps companies, especially SMEs, understand and comply with the new rules. The guidance clarifies key issues such as the scope of the Act, including remote data processing solutions and open-source software, as well as what constitutes a “substantial modification.” It also explains support period requirements, reporting obligations, and risk assessment expectations.
In Case You Missed It!
The Fasken Privacy and Cybersecurity group recently published the following article, which might be of interest.
Where You Will Find Us
Members of our Privacy and Cybersecurity group will be speaking at or attending the following event in the coming months. Keep an eye out for our team and stop by to say hi!
- ALL IN Montreal – September 16-17, 2026
About Fasken’s Privacy and Cybersecurity Group
As one of the longest-standing and leading practices in privacy and cybersecurity, our dedicated national privacy team of over 30 lawyers offers a wide range of services. From managing complex privacy issues and data breaches to advising on the EU General Data Protection Regulation and emerging legal regimes, we provide comprehensive legal advisory services and are trusted by clients from all sectors. Our group is recognized as a leader in the field, earning accolades such as the PICCASO ‘Privacy Team of the Year’ award and recognition from Chambers Canada and Best Lawyers in Canada. For more information, please visit our website.
