E-TIPS

On September 23, 2025, the Privacy Commissioner of Canada and its provincial counterparts in Quebec, British Columbia, and Alberta (collectively, the Commissioners) released the findings of their joint investigation into TikTok, a popular video-sharing app. The investigation concluded that TikTok had inadequate measures in place to stop children from accessing the platform; and prevent the collection and use of their sensitive personal information for profiling and targeting purposes.

On September 11, 2025, the Office of the Superintendent of Financial Institutions (OSFI) released its amendments to Guideline E-23 on Model Risk Management (the New Guideline). The New Guideline sets out OSFI’s expectations concerning model risk management (MRM) by federally regulated financial institutions (FRFIs) which, after an eighteen-month transition period, will be effective as of May 1, 2027.

On September 16, 2025, the Ontario Superior Court of Justice Divisional Court (the Court) issued its decision in Hospital for Sick Children v. Ontario (Information and Privacy Commissioner), 2025 ONSC 5208, upholding decisions of the Information and Privacy Commissioner of Ontario (IPC) which found that encryption-only cyber incidents give rise to notification obligations under Ontario’s Personal Health Information Protection Act (PHIPA) and Child, Youth and Family Services Act, 2017 (CYFSA).

On September 9, 2025, the Federal Court of Appeal (FCA) issued its decision in Centric Brands Holding LLC v Stikeman Elliott LLP, 2025 FCA 161, overturning a Federal Court (FC) decision to expunge Centric Brands Holding LLC’s (Centric) AVIREX trademark registration (the Mark).

On September 11, 2025, the Privacy Commissioner of Canada and the Information and Privacy Commissioner of Ontario (collectively, the “Commissioners”) signed an updated Memorandum of Understanding Between the Information and Privacy Commissioner of Ontario and the Privacy Commissioner of Canada on Mutual Assistance and Information Sharing in the Administration and Enforcement of Laws Protecting Personal Information (the “Memorandum”) to facilitate information-sharing between their Offices on issues of common interest.

On August 14, 2025, the Superior Court of Justice issued its decision in Toronto Star Newspapers Limited v OpenAI Inc., 2025 ONSC 4685, granting OpenAI and its related entities’ (collectively, the Defendants) request for a Partial Sealing Order (the Order) in its motion to challenge the court’s jurisdiction over certain claims. In the underlying action, the Defendants are being sued by several Canadian newspaper and media outlets (collectively, the Plaintiffs) for copyright infringement, breach of their “Terms of Use”, and circumvention of technological protection measures.

On September 9, 2025, the decision in City of Port Moody v Aldo Difelice, 25374-CDRP, was released under the Canadian Internet Registration Authority Domain Name Dispute Resolution Policy (CDRP), where the CDRP panel (Panel) denied the City of Port Moody’s (the Complainant’s) request to transfer the domain name cityofthearts.ca (the Domain Name) due to it being registered in bad faith. Among other things, the Complainant relied on its rights in the official mark CITY OF THE ARTS as registered under Canada’s Trademarks Act.

On August 27, 2025, the Office of the Information and Privacy Commissioner of Ontario (IPC) released PHIPA Decision 298 (the Decision), in which the IPC issued an administrative monetary penalty (AMP) against a doctor and private clinic under the Personal Health Information Protection Act (PHIPA). This is the first AMP issued by a privacy commissioner in Canada.

On August 27, 2025, the Federal Court of Canada (the Court) issued its decision in G6 Hospitality IP LLC v. Sandals Resorts International 2000 Inc., 2025 FC 1430, dismissing G6 Hospitality IP LLC’s (G6) appeal from a decision of the Trademark Opposition Board (TMOB), which rejected all grounds of its opposition against Sandals Resorts International 2000 Inc’s (Sandals’) trademark application (the Application) for THE WORLD’S ONLY SIX STAR LUXURY INCLUDED VACATION & Design (the Mark) in association with travel- and hotel-related goods and services.

On August 27, 2025, the Office of the Privacy Commissioner of Canada (OPC) released its findings from the investigation of a complaint regarding Google’s search engine service. The OPC found that Google violated its obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA) by including certain media articles in the results of searches of the complainant’s name, which contained highly sensitive personal information and led to direct harm.

On August 11, 2025, the Office of the Privacy Commissioner of Canada (OPC) published guidance for both the public and private sectors on protecting privacy in biometric initiatives. The OPC’s guidance addresses key considerations for organizations when planning and implementing initiatives involving biometric technology, such as appropriate purposes for collecting, using, and disclosing biometric data, the proportionality of potential privacy impacts, and consent requirements.

On July 18, 2025, the Federal Court issued an update to its “Case and Trial Management Guidelines for Complex Proceedings, Proceedings under the Patented Medicines (Notice of Compliance) Regulations (PM(NOC) Regulations), and Appeals under subsection 56(1) of the Trademarks Act” (the Guidelines), effective immediately. The updates particularly relate to appeals of the Registrar of Trademarks under subsection 56(1) of the Trademarks Act (the Act).

On July 3, 2025, Quebec’s Autorité des marchés financiers (AMF) released new draft guidelines (the Guidelines) on the use of artificial intelligence (AI) in the financial sector (available in French and English). The Guidelines set out expectations for the risk-based classification of artificial intelligence systems (AIS), the lifecycle of AISs, organizational governance, risk management, and the fair treatment of clients.

On June 30, 2025, the Patented Medicine Prices Review Board (PMPRB) released new non-binding guidelines (the Guidelines) which come into effect on January 1, 2026. The Guidelines are a further step in the long and highly controversial process following from attempts to change some of the criterion for price controls, in particular the list of comparator countries (as reported by the E-TIPS® newsletter here).

On August 1, 2025, the Federal Court (the Court) in Power Herbs Wellness Trading Corporation v Svenskt Kosttillskott AB, 2025 FC 1348, dismissed Power Herbs Wellness Trading Corporation’s (Power Herbs) appeal of the Registrar of Trademarks’ (the Registrar) decision to expunge its Healthvell & Design trademark (the Mark).

On July 30, 2025, the Government of Canada announced that it is partnering with the United Kingdom to aid in the UK’s AI Security Institute’s Alignment Project (the “Project”), an initiative to advance research on artificial intelligence (“AI”) alignment. The Project will support efforts to ensure the safety of advanced AI systems by maintaining their transparency, predictability, and responsiveness to human oversight.

On July 22, 2025, the Office of the Privacy Commissioner of Canada (OPC) announced that PowerSchool Holdings, Inc. (PowerSchool) has agreed to fulfill certain commitments, at the OPC’s request, to strengthen its security measures following a cyberattack which affected the personal information of millions of individuals in Canada.

On July 16, 2025, the Federal Court of Appeal (the FCA) issued its decision in Voltage Pictures, LLC v. Salna, 2025 FCA 131, dismissing an appeal by Voltage Pictures, LLC et al. (collectively, Voltage) to certify a reverse class action proceeding in connection with claims for file-sharing copyright infringement. The FCA’s decision is part of a longstanding series of appeals and cross-appeals involving Voltage’s pursuit of a reverse class action.

On July 23, 2025, the Canadian Centre for Cyber Security (the Cyber Centre) published guidance outlining security and privacy protection measures that organizations may implement when developing and maintaining their website (the Guidance).

On July 1, 2025, notable amendments to the Freedom of Information and Protection of Privacy Act (the “Act”) came into force. The amendments, introduced under Schedule 2 of Bill 194, Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, aim to enhance personal information protections by modernizing Ontario’s digital privacy rules and aligning the province’s privacy framework with best practices from other jurisdictions.