Managed Privacy Canada

11/01/2026

Complaints to Canada's federal Privacy Commissioner rose 82% in the last fiscal year.

The Commissioner disclosed the increase in an address published October 22, noting that AI-enhanced search appears to have made the complaint process more visible. It would be wrong to attribute the entire increase to more privacy breaches.

But the management lesson is unmistakable. More questions from the public mean greater pressure to demonstrate decisions: why information was collected, how suppliers were assessed, when retention exceptions were approved and who authorized corrective action.

Managed Privacy Canada's VirtualCPO™ support helps organizations assign ownership, maintain decision records, review PIAs and vendor evidence, and prepare for a standardized Verify™ privacy assessment. An independent review can then establish what the records and controls actually support.

A privacy leader's value becomes visible when the organization can reconstruct its decisions without guesswork.
https://www.virtualcpo.ca/

Validate virtual CPO leadership evidence or start Verify™ Privacy Advisory and Risk Assessment. Produce a scoped Statement of Trust™ for buyers, regulators and partners where supported.

10/31/2026

A New Mexico judge ordered Meta to pay US$25 billion following findings that Facebook users were misled about privacy. Meta says it will appeal.

The U.S. judgment is not Canadian privacy law, and the penalty is subject to appeal. The broader lesson, however, travels well: public statements about who can access information and what controls users possess can be tested against the system's actual behaviour.

Do consent choices work? Are sharing defaults accurately described? Can the organization demonstrate what third parties receive? Do engineers, legal counsel and privacy teams rely on the same evidence?

Managed Privacy Canada's certified privacy experts use Verify™ reviews to examine notices, consent records, third-party practices and control evidence. When findings support it, a Statement of Trust™ records the reviewed scope, issue date and limitations so customers can see what was independently established.

Credibility rests on the difference between what was promised and what was proved.
https://www.privacyexperts.ca/

This link will take you to a page that’s not on LinkedIn

10/30/2026

Canada's Privacy Commissioner has identified five AI transparency problems. One concerns agents that act on people's behalf.

In comments published October 23, the regulator endorsed examining transparency around AI-generated content, interactions, information about systems, incidents and AI agents. These are engineering questions as much as disclosure questions.

Can a user tell when an agent is acting? Can the organization reconstruct what it accessed and changed? Are important decisions explainable to the affected person? Does a disclosure correspond to the deployed system or merely to an earlier design?

Managed Privacy Canada's Verify™ Privacy Engineering Assessment reviews data-flow designs, access models, logs, minimization controls and change records. We test whether privacy claims are supported by architecture and operating evidence, then document findings and limitations for decision-makers.

A convincing AI disclosure starts with a system that can be examined.
https://www.privacyengineer.ca/

This link will take you to a page that’s not on LinkedIn

10/29/2026

Toronto Crime Stoppers stopped accepting anonymous tips after 176,859 Toronto reports were stolen from a technology supplier.

A CBC investigation also identified more than 1.5 million tips exposed across Canadian Crime Stoppers programs. The troubling detail: identifying information could remain in the original submissions even when it was removed before investigators received them.

That changes the due-diligence question. Does a service promising anonymity protect the original record, or only the edited version a customer sees? Who can retrieve the source text? How long is it retained? Can the supplier provide a reliable account of what was exposed?

Managed Privacy Canada's Verify™ privacy reviews examine supplier contracts, data flows, retention, access and breach-response evidence. Our privacy specialists help organizations establish what their assurances actually cover and what they still need to correct.

Privacy promises should survive a review of the systems behind them.
https://privacysupport.ca/

This link will take you to a page that’s not on LinkedIn

10/28/2026

Canada's Privacy Commissioner has identified five places where AI transparency needs serious attention. One is what an autonomous agent actually does.

The October 23 submission to Ottawa's AI transparency consultation addresses AI-generated content, interactions, information about systems, incidents and agents.

Those are not five boxes to add to a privacy policy. They are five things an organization must be able to explain with records.

Which tool produced a customer-facing answer? Was a human involved? What data did the agent use? Which action was authorized? Can the organization reconstruct an incident, correct a decision or tell affected people what happened?

Managed Privacy Canada's Verify™ Privacy Risk Assessments examine operating records, data flows, approvals, vendor arrangements, incident procedures and governance evidence. Our privacy operations work helps turn those records into repeatable accountability. A Trust Centre can present the current, appropriately disclosed evidence to partners without pretending every AI process has been approved.

The Commissioner has raised transparency questions; the consultation is not itself a new set of binding requirements.

See what verifiable privacy operations involve: https://www.privacyops.ca/

Managed Privacy Canada helps privacy operations teams validate privacy operations evidence or build it through Verify™ Privacy Risk Assessment, leading to Statement of Trust™ attestation where supported.

10/26/2026

California is notifying families after student information was copied from a testing contractor's file-transfer site.

The state's October 16 notice identifies Educational Testing Service (ETS) and says the information varied by person, potentially including names, birth dates, disability or program data and assessment records. The agency says it had not found evidence the information was publicly posted.

This is a vendor-governance lesson for Canadian schools, education ministries and EdTech buyers.

Before approving a testing platform, who checks what student records it retains? How are files transferred? When must the supplier delete them? Can it demonstrate tested access controls and incident-notification procedures?

Managed Privacy Canada's Verify™ EdTech Privacy Assessment reviews PIAs, data flows, vendor contracts, retention practices, consent records and safeguards. Where the findings warrant it, a Statement of Trust™ gives school boards a dated, limited and inspectable account of the verification performed.

Student privacy cannot rest on the fact that a supplier has a recognizable name.

Explore independent EdTech privacy reviews: https://www.edtechprivacy.ca/

10/25/2026

Bill C-22 would make privacy and cybersecurity impacts a factor in certain government access orders. Who will test whether the proposed safeguards actually work?

Canada's proposed Lawful Access Act reached second-reading debate in the Senate on October 8. It includes changes that the federal Privacy Commissioner welcomed, but he also identified unresolved concerns about systemic vulnerabilities and regulatory oversight.

The debate should not be reduced to a choice between effective investigations and privacy. Both objectives deserve evidence.

Before a technical access requirement is implemented, the relevant authority should be able to explain which capability is needed, what information it could expose, whether authentication or encryption would be weakened, how access is logged and who can independently review the results.

Managed Privacy Canada's Verify™ Privacy Impact Assessment approach evaluates purpose, data flows, legal and operational assumptions, vendor controls and residual privacy risks. The same disciplined questions help organizations challenge consequential technology decisions before they become permanent.

The right time to test an intrusive capability is before people must depend on it.

Explore independent privacy impact assessment: https://www.privacyimpactassessment.ca/

This link will take you to a page that’s not on LinkedIn

10/24/2026

University of Toronto researchers documented spyware delivered through targeted online ads. Victims did not have to click.

Citizen Lab's October 15 AdFection investigation describes a surveillance operation that used advertising infrastructure to track devices and deliver spyware to selected targets, including at Al Jazeera.

For an organization deploying a mobile app, the unanswered questions sit inside the advertising and analytics supply chain.

Which SDKs transmit device identifiers? Who receives the data used for ad targeting? Do consent screens describe the actual recipients and purposes? Can the app owner demonstrate what happens when a user withdraws consent?

Managed Privacy Canada's Verify™ Mobile Privacy Assessment examines SDK inventories, permissions, telemetry, notices, vendor contracts and safeguards. Independent testing can separate a reassuring privacy statement from what the app actually sends.

A Statement of Trust™, when supported by the assessment, records the scope, evidence and limits of that review. It should never imply that every future threat has been eliminated.

Mobile privacy has become a supply-chain question. The evidence deserves a proper inspection.

Review the approach: https://www.mobileprivacy.ca/

10/23/2026

Canada's Privacy Commissioner told Parliament that security screening should pass four tests: necessity, proportionality, effectiveness and minimal intrusiveness.

In his October 7 testimony, Philippe Dufresne specifically addressed open-source checks, polygraph testing and continuing clearance reviews in federal security screening.

A screening process can collect deeply personal material and still fail to deliver reliable information. More intrusive collection is not necessarily better risk management.

Before approving any sensitive screening programme, decision-makers should be able to show why each category of information is needed, what legal authority applies, how accuracy is checked, who may access the results and when the records are destroyed.

Managed Privacy Canada's Verify™ privacy assessments review these questions through purpose, data-flow, retention, access and vendor evidence. The principles apply broadly as an assessment discipline; the exact legal requirements depend on the organization and jurisdiction.

A screening programme should be judged by what it reliably establishes, not by how much information it gathers.

Review privacy assessment options: https://www.privacyassessment.ca/

This link will take you to a page that’s not on LinkedIn

09/23/2026

Canada’s Privacy Commissioner has put third-party privacy risk back in focus, and the lesson is a simple one: you can outsource the processing, but you cannot outsource the accountability.

Every supplier that handles customer, employee or identity data creates another point where privacy obligations can break down, often long after the contract is signed. Managed Privacy Canada’s Vendor Privacy Assessment, available through SupplyChainPrivacy.ca, helps organizations examine what data vendors receive, where it goes, who else can access it, how it is protected, and whether the evidence matches the promises.

A signed agreement is useful. Knowing what is actually happening to the data is considerably better.

Trust your suppliers, certainly. Verify them as well.

Learn more: SupplyChainPrivacy.ca

hashtag hashtag hashtag
Activate to view larger image,