Privacy & Cybersecurity in Canada, the US, and the EU
This is a monthly bulletin published by the Privacy and Cybersecurity group at Fasken with noteworthy news and updates. If you have any questions about the items in this bulletin, please contact any member of the Privacy and Cybersecurity group, and we will be pleased to assist.
Canada
Canada Launches Children's Privacy Code
On October 20, 2026, the Office of the Privacy Commissioner of Canada (OPC) released Canada's first Children's Privacy Code. The Code provides guidance on the collection, use, and disclosure of children's personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and establishes expectations for age-appropriate privacy practices, including stronger consent requirements, privacy-protective default settings, and limitations on profiling and behavioural advertising. While not legally binding, the Code signals the OPC's enforcement priorities and reflects the increasing regulatory focus on children's privacy in digital environments.
Alberta Court Recognizes Tort of Intrusion upon Seclusion
In B.D. v Germain, 2026 ABKB 590, the Alberta Court of King’s Bench recognized the tort of intrusion upon seclusion in Alberta for the first time, adopting substantially the same framework established by the Ontario Court of Appeal in Jones v Tsige, 2012 ONCA 32. The defendant had secretly recorded the plaintiff while she used a workplace washroom and had previously pleaded guilty to voyeurism in connection with the conduct in the criminal proceedings. The plaintiff subsequently sought a civil remedy for the invasion of her privacy.
The Court concluded that existing statutory and common law remedies did not adequately address serious invasions of privacy of this nature and that recognizing this tort was necessary. To establish liability, a plaintiff must show that: (1) the defendant’s conduct was intentional or reckless; (2) the defendant invaded, without lawful justification, the plaintiff’s private affairs or concerns; and (3) a reasonable person in the position of the plaintiff would regard the invasion as highly offensive, causing distress, humiliation and anguish. The third element differs slightly from the Jones test by adding the qualifier “the plaintiff’s position”, rather than relying on the reasonableness standard.
The decision is significant because it establishes a private-law remedy in Alberta for serious invasions of privacy even where the information obtained through the intrusion is not subsequently disclosed. More broadly, it may provide a new avenue for civil claims where other causes of action do not provide an adequate remedy.
Federal Privacy Commissioner Publishes Guidance on the Handling of Customer Call Recordings
The OPC has updated its guidance on recording customer calls to better reflect evolving expectations around biometric privacy. The revised guidance emphasizes that voiceprints, which can uniquely identify individuals, are considered sensitive biometric information and may require meaningful consent depending on the circumstances. The OPC also reminds organizations subject to PIPEDA that privacy obligations apply whenever customer calls are recorded, regardless of who initiated the call, and that businesses remain responsible for ensuring third-party service providers, such as call centres and telemarketers, handle recorded voice data in compliance with applicable privacy requirements.
United States
California Expands Regulation of Workplace AI
California has enacted a new law that significantly expands oversight of artificial intelligence in the workplace. Beginning in 2027, the “No Robo Bosses Act” (SB 947) will prohibit employers from relying solely on automated decision systems when making disciplinary or termination decisions and will require human review, employee notifications, and greater transparency regarding the data used by such systems. California has also amended its legislation to require additional disclosures when AI or automation substantially contributes to mass layoffs or workforce reductions and to restrict the use of AI-powered workplace surveillance tools that infer employees’ emotional states or collect neural data. Together, these measures reinforce California’s position as a leading regulator of workplace AI and highlight the growing compliance challenges facing employers operating across multiple jurisdictions as AI-specific employment laws continue to proliferate.
California Overhauls Insurance Privacy Regulation
California has enacted SB 354, a sweeping reform of its insurance privacy laws that significantly expands obligations for insurers and their service providers beginning July 1, 2028. Moving beyond the traditional notice-and-consent framework, the legislation introduces modern privacy concepts such as data minimization, purpose limitation, retention governance, enhanced consumer rights, and stricter oversight of third-party vendors. The law broadens the scope of protected personal information, imposes new consent requirements for certain data uses, prohibits the sale of consumer personal information, and requires insurers to implement detailed retention, deletion, and vendor-management programs. The reforms mirror many concepts found in broader privacy laws, such as the California Consumer Privacy Act (CCPA), and may signal the direction of future insurance privacy regulation across the United States as regulators and lawmakers continue to modernize the sector’s privacy framework.
California Introduces New Rules for AI in Health Care
California has enacted a series of AI-focused health care laws that will take effect on January 1, 2027, establishing new requirements for clinical decision support systems, health care chatbots, and AI-powered customer service tools. The legislation requires developers and health care providers to assess and mitigate potential bias in AI-driven clinical decision support systems, while ensuring that licensed professionals retain independent clinical judgment and do not delegate regulated clinical functions to AI or unlicensed personnel. The new framework also extends California's medical confidentiality requirements to certain health care chatbots and restricts how related medical information can be used and disclosed. In addition, large businesses will be required to provide access to human customer service representatives upon request, subject to limited exceptions.
European Union
EU KIDS Act
The proposed EU KIDS Act aims to better protect children and teenagers from the risks and addictive features of online platforms. It would introduce a phased approach to social media access: no access under 13, parent-managed accounts with limited features between ages 13 and 15, and independent accounts from age 15 onward. Online services used by minors would be required to implement stronger default protections, including private profiles and restrictions on harmful design features. The proposal also mandates privacy-preserving age-verification measures. Finally, it places greater responsibility on large online platforms to demonstrate that their services are safe and designed with children’s wellbeing in mind.
Guidelines 3/2025 on the Interplay between the DSA and the GDPR Adopted after Public Consultation
The
European Data Protection Board's (EDPB) Guidelines 3/2025 explain how the Digital Services Act (DSA) and the General Data Protection Regulation (GDPR) should be interpreted and applied together when online platforms process personal data. The guidelines clarify that the DSA does not replace the GDPR, and that both frameworks must be applied consistently to ensure a high level of data protection. They address key topics such as content moderation, notice-and-action mechanisms, dark patterns, targeted advertising, recommender systems, and the protection of minors. The EDPB emphasizes that DSA obligations involving personal data must comply with the GDPR principles, including lawfulness, necessity, transparency, and data minimization. Finally, the guidelines call for strong cooperation between data protection authorities and DSA regulators to ensure coherent enforcement across the EU.
Guidelines 04/2026 on the Application of the Power to Impose Administrative Fines in Relation to Other Corrective Powers under the GDPR
The EDPB Guidelines establish a harmonized methodology for supervisory authorities to determine whether an administrative fine should be imposed under the GDPR, alongside or instead of other corrective measures. The assessment follows a five-step approach that includes verifying infringement is finable, identifying the liable party, and determining whether the infringement was intentional or negligent. Authorities must then assess the aggravating and mitigating factors listed in Article 83(2) GDPR to determine whether the infringement is minor. Minor infringements will generally result in a reprimand rather than a fine, whereas non-minor infringements create a strong presumption in favour of a fine. Finally, any fine imposed must be effective, proportionate and dissuasive, in accordance with Article 83(1) GDPR.
Cybersecurity Awareness Month
October is Cybersecurity Awareness Month, a reminder that cybersecurity remains a business-critical priority. From emerging cyber threats to evolving privacy and AI regulations, organizations face an increasingly complex risk environment. Staying informed, fostering security awareness, and maintaining strong governance practices are essential steps toward building organizational resilience. Fasken's Privacy and Cybersecurity team continues to monitor these developments and is available to help organizations navigate the evolving legal and regulatory landscape.
In Case You Missed It!
Webinar
The Fasken Privacy and Cybersecurity group invites you to attend our upcoming annual privacy webinar, which will cover the latest developments in privacy and cybersecurity.
- Privacy and Cybersecurity in 2026: Navigating an Evolving Landscape – November 16, 2026
About Fasken’s Privacy and Cybersecurity Group
As one of the longest-standing and leading practices in privacy and cybersecurity, our dedicated national privacy team of over 30 lawyers offers a wide range of services. From managing complex privacy issues and data breaches to advising on the EU General Data Protection Regulation and emerging legal regimes, we provide comprehensive legal advisory services and are trusted by clients from all sectors. Our group is recognized as a leader in the field, earning accolades such as the PICCASO ‘Privacy Team of the Year’ award and recognition from Chambers Canada, Canadian Legal Lexpert Directory, and Best Lawyers in Canada. For more information, please visit our website.
