Data & Privacy

Generally, no — a company cannot collect your personal information without your consent in Canada, but there are limited exceptions under federal law.

Yes, in Canada an IP address can be considered personal information under privacy law — especially when it can be linked to an identifiable individual, as confirmed by the Supreme Court in R. v. Bykovets (2024).

Personal information under Canadian privacy law includes any information about an identifiable individual, such as name, address, IP address, or online identifiers — especially when it can be linked to a person.

PIPEDA generally does not apply to your personal doctor’s medical practice or most local businesses unless they engage in commercial activities that involve collecting, using, or disclosing personal information across provincial or national borders — or if provincial health privacy law doesn’t apply.

No, your internet service provider generally cannot give your subscriber information to police without a warrant — the Supreme Court ruled in R. v. Spencer that such disclosure requires judicial authorization unless a narrow exception applies.

Yes, the government can refuse your access to information request if it contains another person's personal information, as required by section 19 of the Access to Information Act.

Yes, as an individual in Canada, you have the right to request access to personal information the federal government holds about you under the Privacy Act.

Yes, the Canadian government can collect personal information about you from sources other than directly from you — but only if it relates directly to an operating program or activity.

Yes, the Canadian government can refuse to release information you request if it contains trade secrets or confidential commercial information belonging to a third party.

Yes, your employer can generally search your work computer, but your reasonable expectation of privacy in personal files may still be protected under the Charter — especially if you used the device for private purposes and had no clear policy limiting privacy.

Yes, police in Canada may search your cell phone incident to arrest, but only under strict limits set by the Supreme Court in R. v. Fearon — they generally need reasonable grounds to believe the phone contains evidence of the offence and must make detailed notes of the search.

Yes, police generally need separate judicial authorization to search your computer—even if they already have a warrant to search your home. The Supreme Court of Canada ruled in R. v. Vu that computers require special protection due to the vast quantity and sensitive nature of digital data.

No — in Canada, your roommate or partner cannot legally consent to a police search of your private data on a shared computer, even if they have physical access to the device.

No, police generally cannot use thermal imaging to look inside your home without a warrant in Canada. The Supreme Court ruled in R. v. Tessling that while FLIR scanning of a home’s exterior is not a 'search' under section 8 of the Charter, it still engages privacy interests — but warrantless use was upheld on the facts because no intimate details were revealed.

Yes, but only with judicial authorization — the Supreme Court of Canada ruled that prolonged electricity monitoring without a warrant violates your Charter right to privacy.

No — police generally cannot read your stored text messages from your phone company without a wiretap (Part VI) authorization, because the Supreme Court ruled you have a reasonable expectation of privacy in those messages.

No, a company generally cannot refuse your request to see your personal information — under PIPEDA, you have a legal right to access it.

If a company in Canada suffers a data breach exposing your personal information, it must report the breach to the Office of the Privacy Commissioner of Canada and notify you if there's a real risk of significant harm.

Yes, under Canada’s federal privacy law, you can request that a company delete your personal information if it is no longer needed for the purpose for which it was collected.

Police cannot force you to provide DNA for a national database unless you are convicted of a designated offence and a judge orders it under the DNA Identification Act.

Yes, under Canadian federal privacy law, you have the right to request that an organization correct inaccurate or incomplete personal information it holds about you.

No, a company cannot share your personal information with third parties without your valid, informed consent under Canadian federal privacy law.

No, a Canadian government institution cannot use your personal information for a different purpose than why it was collected, unless you give consent or another legal exception applies.

No, a company in Canada cannot keep your personal information indefinitely after you stop being a customer — it must destroy or anonymize the information when no longer needed for the identified purpose.

Yes, a company can deny you service if you refuse to give personal information — but only if that information is necessary for the identified purpose. If it’s unnecessary, they cannot require it or deny service.