Both fixed-line and mobile internet penetration rates have remained relatively steady in Canada. Mobile service providers continued to deploy a number of newer technologies to provide mobile broadband service, including Evolved High Speed Packet Access (HSPA+) and LTE, yet penetration rates for new technologies are steady, as Canada is close to its saturation point. However, small increases in LTE access have occurred in remote regions.

Broadband service of at least 5 Mbps is available to more than 99 percent of households through a variety of technologies including fixed and wireless, according to the the Canadian Radio-television and Telecommunications Commission (CRTC).1 Canada fell short of reaching its lofty goal of 100 percent of households with internet connectivity and broadband speeds of at least 5 Mbps by the end of 2016.2 By 2018, a more realistic goal was set, which aimed to maintain average download speeds of 50 Gbps for ultra-high-speed connections (7.9 percent above the Organization of Economic Co-operation and Development [OECD] average) and ensure that 100 percent of households have access to LTE wireless by 2026.3

In a landmark policy decision released in 2016,4 the CRTC recognized the importance of ultra-high-speed (50 Gbps download speeds and above) internet access for the future of the economy. In the policy, the CRTC set a universal access goal for all residential and business fixed-line customers to have access to download speeds of at least 50 Gbps with unlimited data. Furthermore, it declared that high-speed internet access is a “basic telecommunications service” and established a C$750 million (US$565 million) fund to reach its targets.5 More than two years later, in September 2018, the CRTC finally announced criteria for spending the fund’s money,6 but the plans have been criticized for the arbitrary inclusion of some rural communities and the exclusion of others.7 The CRTC is also allowing for targeted download speeds of 25 Gbps, rather than the stated goal of 50 Gbps.8

Internet access is not prohibitively expensive or beyond the reach of most segments of the population, although a digital divide in terms of geography persists, and poorer people struggle to afford access.

Mobile broadband data remains expensive compared to fixed-line access. High-speed, fixed-line internet access remains affordable due to robust competition; prices became even more competitive in 2016 when the CRTC, an independent public regulator, reduced the price of wholesale high-speed internet access.9

Perhaps the most important obstacle to availability and ease of access is geography. Canada is overwhelmingly urban, with 81 percent of the population living in urban areas.10 Furthermore, approximately 75 percent of the population lives within 160 kilometers of the border with the United States.11 While providing “reliable and affordable telecommunications services of high quality” to rural areas is enshrined in the law,12 affordable high-speed internet service is less available in more isolated areas, especially in the vast northern territories.

High-speed internet access is also more expensive in rural areas than in cities, according to the CRTC’s 2018 figures. The major internet service providers (ISPs) generally offer services that have caps on bandwidth, which results in increased fees for users who exceed the limit. Such limits are much more restrictive for wireless connectivity than for wired connectivity, which further exacerbates the urban-rural divide in terms of cost.

According to the CRTC’s 2018 Communications Monitoring Report, household broadband service with speeds between 5 Mbps and 9.99 Mbps was available in 100 percent of urban areas, compared to 98 percent in rural areas (a small increase from 97 percent penetration in rural areas the previous year). However, the 98 percent figure includes 10 percent of households where availability was only via wireless services (HSPA+ and LTE), which are generally more expensive, especially as data usage rates increase. Faster speeds between 30 Mbps and 49.99 Mbps were only available in 41 percent of rural households, compared to 100 percent of urban households. In the most remote territory, Nunavut, speeds above 10 Mbps are unavailable.13

The government has taken a patchwork approach to improving connectivity in remote communities, indicating a lack of a strong overall strategy. The 2018 government budget identified new technologies, specifically low-Earth orbit (LEO satellites), to enhance rural connectivity.14 While the plan was short on specifics, it pledged C$100 million (US$75 million) over five years for research and development. Few other proposals for new connectivity have been advanced. In the 2017 budget,15 the government included more proactive proposals to enhance connectivity. However, this budget was also vague, referring only to the investments for rural connectivity announced in the 2016 budget, a C$500 million (US$377 million) pledge over five years for a new program to “extend and enhance broadband service in rural and remote communities.”16

There is also a considerable gap in access in terms of income: the penetration rate for the highest income bracket is nearly 95 percent, while the penetration rate for the lowest income bracket is 63 percent.17 Internet connections are widely available in public spaces such as cafés, shopping malls, and libraries, generally free of charge. There is a wide range of content available in both official languages (English and French) as well as many other languages.

The government does not exercise technical or legal control over the internet infrastructure for censorship. Authorities do not restrict access to any social media platforms or communications apps.

The government has not centralized the telecommunications infrastructure. However, given the vertical integration of the marketplace, the infrastructure is controlled by a small number of companies, which in theory could facilitate greater control of content and the implementation of surveillance technologies. In October 2018, the CRTC rejected a proposal to limit access to websites on the basis of copyright infringement (see B1), which would have been easily implemented considering the small number of ISPs in Canada.

There are some legal and economic obstacles that restrict the diversity of service providers, although the market remains relatively open. Specifically, the legal requirements for Canadian ownership of service providers, combined with the high costs of entry and infrastructure, has led to market concentration, especially for mobile service.

To operate as a Canadian telecommunications provider, a company must meet the requirements in Section 16 of the Telecommunications Act. In 2017 (the most recent available data), Canadian retail telecommunications revenues (comprised of wireline, wireless, internet, and data and private lines) totaled C$50.3 billion (US$37.9 billion), a 3.2 percent increase from the previous year. The five largest companies (Bell, Québecor, Rogers, Shaw, and TELUS) accounted for 87 percent of total revenues, an increase of 2 percent from the previous year, largely due to Bell’s acquisition of a small company, MTS. The market share of the five companies has remained relatively steady in recent years.18

The growth in the market for internet service outpaces that of the ICT market generally. According to the CRTC’s 2018 Communications Monitoring Report, the revenues for the retail internet services sector were C$11 billion (US$8.2 billion) in 2017, an increase of almost 8 percent over 2016, while mobile revenues (voice and data) rose 5.3 percent from the previous year.

Canadians have a choice of wireless internet providers, all of which are privately owned. There are at least three providers to choose from in all markets, although providers vary region to region, and some providers are restricted to urban areas. Restrictions on foreign investment impose some limits, though a few foreign companies have entered the marketplace in recent years. The provision of access services is subject to regulation, with rules on tower sharing, domestic roaming agreements, and a consumer regulator to address consumer concerns.

For wireless service, three companies dominate the market: Bell, Telus, and Rogers have 92 percent of wireless subscribers.19 These companies are also leaders in the provision of wired internet service (via phone lines or cable), along with Shaw, Cogeco, and Vidéotron (owned by Québecor). While Canadians generally enjoy a choice of wired internet providers, the available choices vary from region to region, and often there is only one choice per technology type, leading to a public perception that options are limited and prices are kept artificially high. This perception is not without merit as it pertains to wireless data, as a 2018 report determined that Canada’s wireless data prices were among the highest in the world.20

The CRTC, the regulatory body that oversees the communications industry, operates largely independent from the government. The government appoints the CRTC chairperson and commissioners without public consultation, but they are not subject to political pressure. In some cases, the government has provided guidance on policy expectations regarding telecommunications regulations, but its input is nonbinding. Moreover, CRTC decisions can be appealed to the courts, or a government review can be requested. The government has rarely overturned CRTC decisions.

The CRTC’s regulatory powers extend to internet access, but not to internet content, a principle known as the new media exemption. The CRTC’s position to not regulate internet content dates to 1999 and has been reinforced on numerous occasions since then,21 including by the SCC.22 This contrasts with other industries, specifically television, where the CRTC exerts some control over content, most notably by requiring broadcasters to air a minimum amount of Canadian content.

The government does not generally block or filter online content or require service providers to do so. Project Cleanfeed Canada allows ISPs to block child sexual abuse imagery hosted outside of Canada, restrictions that are permissible under international human rights standards (see B3).

In January 2018, a group of more than 25 ISPs, media companies, creative companies, and other interested parties—including major players such as Bell, Rogers, and the Canadian Broadcasting Corporation (CBC)—banded together as “FairPlay Canada”23 to petition the CRTC to establish an independent body that would recommend blocking access to “websites and services that are blatantly, overwhelmingly, or structurally engaged in piracy.”24 Some commentators criticized the plan for possibly violating Canada’s net neutrality regime and for the potential that sites not engaged in piracy would be affected.25 Other commentators insisted it was a necessary tool to fight online piracy and protect copyright.26 Ultimately, the CRTC rejected the proposal in October 2018 after determining that it lacked jurisdiction to implement the plan. However, the commission invited Parliament to examine the issue.27

Nonstate actors, specifically large media companies, have used legal means to force digital platforms to delete content, generally for copyright infringements. However, a significant development during the coverage period should reduce the misuse of the notice-and-notice regime under the Copyright Act.

The previous notice-and-notice program required ISPs to forward notices from copyright holders claiming infringement to the alleged copyright violator (see B3). Several US-based antipiracy firms, including Rightscorp and CEG-TEK, used the system to send notifications to subscribers that misstated Canadian copyright law, citing US awards for damages and threatening the termination of internet access. The notifications sowed fear among Canadians, and many paid the settlement fees proposed in the notices.28 In December 2018, Parliament passed amendments to the program to restrict the information that can be included in the notices, no longer allowing misstatements of Canadian law. Further, ISPs are no longer required to forward notices to subscribers if they contain an offer to settle the infringement claim, a request or demand for payment or personal information, or a link to such offers or demands.29 The author of this report, a lawyer specializing in internet law, had been receiving a significant volume of these notices from panicked Canadians prior to the change; since the change, he has not received any.

Media companies have continued to use the courts to shut down and penalize operators of websites and other online services that redistribute their content in violation of copyright laws, or that offer services facilitating such activities. In 2017, the Federal Court of Appeal upheld a lower court decision granting an injunction to shut down websites selling copyright-infringing set-top boxes.30

In 2017, the SCC upheld the decision by the British Columbia Court of Appeals in Google Inc. v. Equustek Solutions Inc.,31 ordering Google to remove links from its global index to websites that infringed on the plaintiffs’ trademark (see B3).

Defamation claims may also result in content removals, as content hosts fear potential liability as publishers of the defamatory content. Defamation claims may also prevent the posting of content, as the British Columbia Court of Appeal demonstrated in March 2018 when it ordered a defendant to not post anything about the plaintiff, as well as awarding damages.32 In June 2018, the SCC ruled that a case involving the publication of defamatory content on an Israeli website against a Canadian resident should be heard in Israel rather than Canada, despite the fact that damages were incurred in Canada.33

In Quebec, Canada’s French-speaking province, websites that are commercial in nature are legally required to be in French,34 although they can also be in other languages. Violators may receive a warning from a government agency, and are then subject to fines, if they do not comply. Some website operators may choose to take down their websites rather than pay for translation or face fines. National or international operators of websites that do business in Quebec (and would therefore be subject to the law) sometimes block Quebec residents’ access to their websites rather than comply.35

Restrictions on the internet are generally fair and proportionate.

Canada’s largest ISPs participate in Project Cleanfeed Canada, an initiative that allows ISPs to block access to child sexual abuse images that are hosted outside the country (as opposed to content hosted within Canada, which is subject to removal).36 Accessing child pornography is illegal in Canada under section 163.1(4.1) of the Criminal Code,37 as well as under international human rights standards. The initiative targets international sites that the Canadian government does not have the jurisdiction to shut down.

Bill 74, Quebec’s controversial law requiring ISPs to block access to gambling sites, came into effect in 2016,38 but remains inoperative. In July 2018, a Quebec court declared the law unconstitutional, ruling online gambling a federal rather than provincial matter.39

In 2004, the SCC ruled that ISPs are not liable for copyright infringement violations committed by their subscribers,40 a principle now enshrined in law.41 Copyright law includes a notice-and-notice provision in effect since 2015, which was amended during the coverage period (see B2). Unlike a notice-and-takedown system, the program does not make intermediaries legally liable for removing content upon notification by the copyright owner. Rather, copyright owners are permitted to send notifications alleging infringement to ISPs. The ISPs are then required to forward the notifications to the implicated subscriber. Any further legal action is the responsibility of the copyright owner, and it is incumbent upon the person who uploaded the infringing content to remove it following a legal decision. No content is removed from the internet without a court order, and ISPs do not disclose subscriber information without court approval, although approvals are more common in recent years.42

In the SCC’s ruling in Google Inc. v. Equustek Solutions Inc., the court’s reasoning was strictly focused on the law of intellectual property and interlocutory injunctions, so it is unclear if such worldwide orders may be granted in other areas of law in the future. It is also unclear whether such worldwide orders can have effect in foreign jurisdictions. For example, a US court has questioned whether Canadian courts have jurisdiction to make such an order and has already granted a preliminary injunction against the implementation of the Equustek decision in the US based on the long-standing principle of Google as an intermediary.43 In April 2018, Google took the US judgment back to the British Columbia court that made the original ruling and asked for the injunction to be suspended, but the court denied Google’s application.44

Although platforms are legally protected from liability for copyright infringement by their users, they may face liability for alleged defamation once alerted to the publication. A court may also order the removal of the content. The SCC has held that merely linking to defamatory content on the internet is not defamation in and of itself; it would only be defamation if a site actually repeats the defamatory content. Therefore, the links would not be removed.45

Online self-censorship is not widespread. However, certain individuals may self-censor for fear of potential government surveillance under Bill C-51 (see C5).

Online sources of information are not widely controlled or manipulated by the government or other powerful actors. While some sites are partisan in nature, a wide array of political viewpoints are available online.

The government advanced legislation to combat disinformation and foreign interference in advance of the October 2019 federal election. The Election Modernization Act, which went into effect in June 2019, provides for a number of reforms such as regulations on third-party online advertising and restrictions on how much campaigns can spend before the campaign season officially commences.46

There are no economic or regulatory constraints on users’ ability to publish content online, although the increasing willingness of provincial governments to tax internet services may have some effect in the future.

Canada has strengthened its commitment to net neutrality as a matter of national policy, ensuring that ISPs present web content neutrally. In 2017, the CRTC enacted a pair of telecommunications policies that effectively prohibited differential pricing for some data services offered by ISPs and the zero-rating of certain media services, barring ISPs from offering such preferred media free of charge.47 With these policies, the CRTC substantively completed (in conjunction with several other policies) a national framework that ensures the continuation of net neutrality. In a May 2018 report, a parliamentary committee encouraged the government to strengthen net neutrality even further by enshrining the principle in the Telecommunications Act.48 Canadians have expressed concerns, however, that the repeal of net neutrality in the United States will have a negative effect on Canadians’ internet activities.49

In the 2017 budget, the government promised to review telecommunications legislation to ensure that “Canadians continue to benefit from an open and innovative internet” in the context of net neutrality and other digital policy considerations. However, it is unclear whether these reforms will have a positive or negative impact on online content,50 particularly Canadian content. The government’s statement reflected a report from the Department of Canadian Heritage outlining the future of Canadian content in the digital age, following extensive public consultations on the subject.51 The Department of Canadian Heritage, in the wake of the report, announced a deal with Netflix in which the streaming service pledged to spend a minimum of C$500 million (US$377 million) on Canadian productions over the next five years.52 Shortly thereafter, the government stated that Netflix would not be subject to the national Goods and Services Tax.53 However, both Quebec and Saskatchewan now levy provincial sales tax on out-of-province digital platforms, including Netflix, Google, Amazon, and, in Quebec’s case, Spotify.54

The online environment in Canada is relatively diverse, and internet users have access to a wide range of news and opinions on a variety of topics. All major media organizations operate websites that feature articles and audio and video content. The public broadcaster maintains a comprehensive website that includes news articles and streamed video programming. Paywalls are increasingly used by newspapers publishing online, but many quality, independent news and commentary sites remain accessible for free.

Digital mobilization tools, including social media platforms and communication apps, are available and used to build support for political and social movements. Online activism played a significant role in the Liberal government’s promise to repeal the problematic aspects of the Anti-Terrorism Act and influenced the government to introduce a new bill, Bill C-59, to reform it (see C5). Much online activism that targets the ICT sector is spearheaded by a popular nonpartisan, nonprofit organization called Open Media, which advocates for three pillars of internet rights—free expression, access, and privacy.55

Canadians have been especially active in the online #MeToo movement,56 which prompted the justice minister to consider updating laws to ensure victims of sexual violence are treated more compassionately in courtrooms.57 This online activism also influenced the government to introduce Bill C-65,58 which became law in October 2018 and dramatically updated the harassment legal framework as it applies to the federal government and federally regulated workplaces.59 Online activism likely played a role in the decision to legalize cannabis countrywide,60 which went into effect during the reporting period.

The constitution includes strong protections for freedom of speech and freedom of the press. Freedom of speech is protected as a “fundamental freedom” by Section 2 of the Canadian Charter of Rights and Freedoms. Under the charter, one’s freedom of expression is “subject only to such reasonable limits prescribed by law as can be demonstrably justified in a free and democratic society.”61 These protections apply to all forms of speech, whether online or offline. There are a few restrictions that apply to online speech (see C2).

Users can face significant criminal penalties for some forms of online expression, as well as civil liability for defamation emanating from common law principles. Some provincial defamation laws and the general civil liability regime in Quebec also limit freedom of expression online.

Hate speech, along with advocating genocide and uttering threats and defamatory libel, are also regulated under the Criminal Code.62 Punishment for defamatory libel, advocating genocide, and uttering threats may include imprisonment for up to five years. Hate speech is punishable by up to two years in prison. Human rights complaints regarding potentially defamatory statements can be decided through the mechanisms provided by provincial human rights laws and the Canadian Human Rights Act (CHRA).63 However, the controversial provision of the CHRA prohibiting online hate speech (s. 13), which was criticized for being overly broad, was repealed in 2013.64 The current government has considered reviving the provision in some form.65

Antispam legislation enacted in 2014 requires opt-in consent to send commercial electronic messages. Critics of the legislation have argued that it is overly broad and overregulates commercial speech.

Individuals were not arrested or prosecuted for online activities that are protected under international human rights standards during the coverage period. Generally, writers, commentators, and bloggers are not subject to legal sanction for content that they post on the internet. Internet users are free to discuss any political or social issues without risk of prosecution, unless the discourse violates the hate speech provisions in the Criminal Code.

The government does not impose any restrictions on anonymous communication or encryption. Canadians are free to use encryption services and communicate anonymously online, without any fear of civil or criminal sanction.

State surveillance of internet users under limited circumstances may infringe on privacy rights. In 2015, the government passed Bill C-51, the Anti-Terrorism Act. Bill C-51 permits information sharing across government agencies for a wide range of purposes, many of which are unrelated to terrorism. Several efforts to reform Canada’s antiterrorism laws have finally began to materialize, most recently with Bill C-59.

The Liberal government has taken steps to fulfill its 2015 campaign promise to “repeal the problematic elements of Bill C-51.”66 The Liberals introduced Bill C-22 in 2016 to establish a new multiparty national security oversight committee, which became law in 2017 as the National Security and Intelligence Committee of Parliamentarians Act.67 The government subsequently introduced Bill C-59, an Act Respecting National Security Matters,68 which goes further in addressing some of the more problematic provisions in the Anti-Terrorism Act.69 In June 2019, after the coverage period, Parliament passed Bill C-59.70

Under Bill C-59, a number of broad criminal speech provisions from Bill C-51 were limited, although some remain. The bill enhances parliamentary accountability and oversight through the creation of the National Security and Intelligence Review Agency and the Office of the Intelligence Commissioner.71 The bill has also given the Communications Security Establishment the authority to implement active cyber operations, although these powers are more limited compared to those provided by Bill C-51.72 Despite a number of improvements, some civil liberties groups have raised significant concerns that Bill C-59 does not effectively fix the broad surveillance issues posed by Bill C-51,73 and that it still grants Communications Security Establishment too many powers, including the mass collection of data.74

The Office of the Privacy Commissioner (OPC) provides an important oversight function concerning the privacy of users’ data. The privacy commissioner, Daniel Therrien, is an officer of Parliament who reports directly to the House of Commons and the Senate. The commissioner’s mandate includes overseeing compliance with the Privacy Act,75 which covers the practices of federal government departments and agencies related to the handling of personal information.

Both ISPs and mobile service providers may be legally required to aid the government in monitoring communications of their users.

The OPC and Canada’s Privacy Commissioner oversee compliance with the private sector privacy law,76 the Personal Information Protection and Electronic Documents Act (PIPEDA).77 PIPEDA was modified by the Digital Privacy Act78 passed in 2015. The Digital Privacy Act expanded the scope for companies to make voluntary warrantless disclosures of personal information under certain circumstances, by allowing for such disclosures to any organization, not just law enforcement. The act also established new mandatory security breach disclosure requirements, which came into force in November 2018.79 PIPEDA, however, remains relatively toothless.

A Standing Committee on Access to Information, Privacy, and Ethics (ETHI) report released in February 2018 called for significant changes to strengthen PIPEDA and better align it with the EU General Data Protection Regulation (GDPR).80 However, no legislation had been advanced as of August 2019.

The OPC has also called for changes to the Privacy Act, which has not been significantly amended since 1983. The commission argues that the act is outdated and does not reflect the privacy concerns of the digital age. The OPC also asserts that it allows the government too much latitude to collect personal information.81

The OPC shocked the legal community in January 2018 when it released a draft position paper concluding that PIPEDA contained a European-style “right to be forgotten” provision.82 Commentators questioned the OPC’s conclusions and reasoning.83 In October 2018, the OPC submitted a reference question to the Federal Court to clarify whether indexing web pages and presenting results about a person’s name in Google’s search function fall under PIPEDA. If the Federal Court replies that these actions are subject to PIPEDA, it would support the right to be forgotten position.84 It is unclear when the Federal Court will issue its decision. The ETHI report called for the right to be forgotten to be included in future PIPEDA amendments.

The OPC conducts investigations into major data breaches to determine whether private companies comply with PIPEDA. In its investigation into the 2017 Equifax breach, the OPC found major PIPEDA violations. In response, Equifax took numerous corrective measures and signed a compliance agreement.85 In the OPC’s investigation into the Cambridge Analytica scandal, Facebook refused to take significant corrective measures or implement the OPC’s recommendations.86 As a result, the OPC announced it will take Facebook to court in an effort to force its compliance.87 In May 2019, Facebook’s CEO Mark Zuckerberg and COO Sheryl Sandberg ignored a subpoena from a parliamentary committee to testify on the scandal.88

Numerous court decisions have made it easier for Canadians to seek legal redress against foreign internet companies for privacy violations. In a landmark 2017 decision, the SCC ruled that residents of British Columbia could bring a class action suit against Facebook for violating certain privacy rights in a British Columbia court, despite Facebook’s choice of forum clause specifying California.89 Other courts followed up on this decision, with a Quebec court deciding that Yahoo’s choice of forum clause was inoperative, as its terms and conditions were deemed to be a consumer contract that granted jurisdiction to Quebec.90 While the choice of forum clause in the case chose another Canadian province (Ontario), it is clear that the same reasoning could apply internationally. In another dramatic development, in 2017 the Federal Court found that PIPEDA has extraterritorial application, and ordered a Romanian website to remove court decisions that contained easily searchable personal information of Canadian citizens. The site was ordered to never post such information again.91 The court also ordered the website to pay damages to the plaintiff.

The SCC continues to expand privacy rights. Most recently, in December 2018, the court ruled that privacy rights are still protected when a computer is shared with others.92 In 2017, the court extended the right to privacy to text messages in a pair of companion cases. First, the court held that there could be a reasonable expectation of privacy in received text messages, whereas previously, privacy protections only applied to sent messages.93 In the second case, the court held that the sender of text messages has a reasonable expectation of privacy, even when they are stored on the telecommunications provider’s computers.94

There were no documented cases of violence or physical harassment in retaliation for online activities during the reporting period. However, cyberbullying, cyberstalking, and general online harassment, particularly affecting young people, is on the rise.95 A 2016 study found that a quarter of Canadians have been subjected to some form of online harassment,96 while a February 2018 report indicated that 37 percent of schoolchildren in one Canadian province had been subjected to cyberbullying.97 The government has recognized the seriousness of the issue, and announced in 2017 that it would develop a coordinated strategy,98 though there has been little progress.

The legal precedence of a noteworthy “revenge porn” case has taken on new significance. In a highly praised 2016 landmark civil court decision, a man who published revenge porn featuring his ex-girlfriend was ordered to pay C$100,000 (US$75,000) to the victim, who suffered severe emotional distress.99 Later that year, however, the default judgment was set aside,100 and an appeal of this decision was denied.101 As a result, the new privacy tort of “public disclosure of private facts” established in the original decision was in a state of flux. Notwithstanding the procedural issues with the original case, the new tort was applied in a November 2018 case, in which an individual was found liable for posting a sexually explicit video of a person without their consent on a pornographic website, and ordered to pay C$100,000 (US$75,000) in damages.102 Furthermore, the 2016 case continues to be cited by other plaintiffs, authors, and courts.103

Additionally, many provinces, including Manitoba104 and Alberta,105 have passed laws that create civil torts for unauthorized distribution of intimate images and videos. Individuals are still prosecuted under Section 162.1 of the Criminal Code, which makes it a crime to publish, distribute, transmit, or sell intimate images without the consent of the person depicted.106

Cyberattacks and data breaches are becoming a serious issue in Canada. With a new requirement that private companies report data breaches to the OPC, the number of reports of such breaches has increased four-fold.107 It is unclear whether the number of breaches is increasing or the mandatory reporting requirement has led to more reports. During the coverage period, major Canadian companies were subject to numerous cyberattacks and data breaches, including the Bank of Montreal, the Canadian Imperial Bank of Commerce,108 Canada Post,109 and Air Canada.110 In 2017 alone, more than one in five Canadian companies reported experiencing some form of cyberattack.111 During the same year, the government reported more than 200 serious data breaches of its systems.112

The government continues to warn residents about the threat of cyberattacks in a number of areas. In April 2019, the Communications Security Establishment reported that foreign interference in the upcoming federal election was “very likely.”113 Additionally, the governor of the Bank of Canada has stated that cyberattacks are the most pressing concern for the financial system,114 and the deputy privacy commissioner has expressed similar concerns.115