Canadian Privacy: The Price of Personal Data

In the span of three years—between 2023 and 2026—a Canadian coffee chain's digital mobile app was found to have continuously tracked the physical movements of its customers; a Quebec-based financial co-operative disclosed that a rogue employee had exfiltrated the personal information of roughly 9.7 million members; an Ontario municipal utility notified its customers that account and service data had been exposed in a security incident; a home improvement retail chain disclosed personal information to a social media company without customer consent; a California-based genetic testing company holding the DNA of millions of customers filed for bankruptcy and sold its database to a new entity; a federal privacy bill intended to modernize the country's private-sector privacy law "died on the order paper" (or expired) when Parliament was prorogued; and a new privacy bill was introduced promising more aggressive reform measures. These events did not occur in isolation. Each of them tested a different part of the Canadian framework governing personal information, and each of them produced consequences that the businesses continued managing.