Canada: PIPEDA, the federal private-sector privacy law

2001

PIPEDA in force

S.C. 2000, c. 5

0

Fines the federal Commissioner can impose today

OPC, Clearview findings 2021

CAD 25M

Proposed maximum penalty under Bill C-36 (not yet law)

Bill C-36, tabled 15 June 2026

What does PIPEDA cover?

PIPEDA applies to organisations that collect, use or disclose personal information in the course of commercial activity, across Canada except where a province has a law declared substantially similar (Alberta, British Columbia and Quebec for the private sector). It is built on ten fair-information principles, of which consent and appropriate purposes do the work in face search cases. Consent must be meaningful: the person must understand what is collected and why, and some purposes are so inappropriate that no consent can make them lawful.

The Act does not use the word biometric. The Commissioner's position, set out in the Clearview findings and in guidance on facial recognition, is that a facial image is personal information, that a template computed from it is sensitive personal information requiring express consent, and that scraping public photos does not make them "publicly available" in the narrow sense the regulations allow.

Who enforces it?

The Office of the Privacy Commissioner of Canada (OPC) investigates complaints and publishes findings, but can only recommend; to compel, it must apply to the Federal Court. The provincial commissioners in Alberta, British Columbia and Quebec have order-making power under their own acts, which is why the Clearview matter produced binding orders only at the provincial level.

1. 2020-02

   Joint investigation opened

   The OPC and the Quebec, British Columbia and Alberta commissioners open a joint inquiry into Clearview AI after press reports on its scraped index.

2. 2021-02-03

   Joint findings

   Clearview's collection of images of Canadians without consent is found to breach PIPEDA and the three provincial laws. The OPC recommends; the provinces order deletion and a stop to collection.

3. 2021-12

   Provincial orders

   Alberta Order P2021-12 (7 December 2021) and matching Quebec and British Columbia orders require Clearview to stop collecting and to delete Canadians' data.

4. 2025-01-06

   Bill C-27 dies

   The Consumer Privacy Protection Act, PIPEDA's intended replacement, lapses when Parliament is prorogued.

5. 2025

   Alberta court decision

   Clearview AI Inc. v. Alberta (Information and Privacy Commissioner), 2025 ABKB 287, considers the consent and publicly-available-information questions under Alberta's PIPA.

6. 2026-02-18

   British Columbia Court of Appeal

   2026 BCCA 67 upholds the BC Commissioner's findings and remedial order against Clearview.

7. 2026-06-15

   Bill C-36 tabled

   The Protecting Privacy and Consumer Data Act would replace PIPEDA's privacy part, create a new regulator and add penalties. Not passed as of 6 November 2026.

What does it mean for face search?

The Clearview findings are the Canadian rule for every face search engine: building a face index from photos of Canadians scraped from the public web, without their express consent, breaches PIPEDA and the provincial acts, and the "publicly available" exception does not cover social media or the open web. Clearview stopped serving Canada in 2020 but was still ordered to delete the data, and the orders have survived appeal in British Columbia. Consumer engines such as PimEyes, FaceCheck.ID and FaceSearch face the same analysis if they index Canadians' faces, though none has been the subject of a published Canadian finding as of November 2026. See OPC v Clearview AI for the decision itself.

What are the penalties?

Today, almost none. PIPEDA's only offences concern obstructing the Commissioner, retaliating against whistleblowers and failing to report or record breaches, each punishable by a fine up to CAD 100,000. The Federal Court can award damages after a Commissioner's report, and the provincial acts carry their own offence provisions, including Quebec's administrative and penal penalties under Law 25. Bill C-36 proposes administrative penalties up to the greater of CAD 25 million or 5 percent of global revenue; until it passes, the practical sanction in Canada is an order to stop and delete, plus reputational cost.

What is pending?

Bill C-36 is before the House of Commons as of 6 November 2026. If enacted it would move private-sector privacy regulation to a new commissioner with order and penalty powers, which would change the enforcement picture for face search engines substantially. The Clearview litigation continues in Alberta.