Privacy Commissioner Tables 2025-2026 Annual Report

On June 4, 2026, the Office of the Privacy Commissioner of Canada (OPC) tabled its 2025-2026 Annual Report to Parliament on the federal Privacy Act and the Personal Information Protection and Electronic Documents Act (PIPEDA), titled “Championing Privacy in the Age of AI” (the Annual Report). The Annual Report highlights the OPC’s efforts to promote children’s privacy and provide leadership in a time when technologies are developing rapidly.

The Annual Report describes several top trends in privacy, including:

• Privacy and Innovation. Digital technologies, such as AI tools, are evolving rapidly. While these changes create new opportunities, they also raise privacy concerns. For example, survey results show that use of AI by Canadian businesses has more than doubled over the past two years, and 85% of Canadians believe that AI should be regulated by governments to ensure ethical and safe use.
• Privacy for Children and Youth. As children and youth are growing up in a digital environment that is more connected, personalized, and immersive than ever, privacy questions are being raised earlier, and in settings where younger users may have a more limited understanding or control over how their information is used. In Canada and abroad, regulators are signaling support for stronger default protections for children.

The Annual Report notes a dramatic increase in complaints received by the OPC.  During 2025-2026, the OPC received 6,190 complaints under the Privacy Act and PIPEDA, an 82% increase over the previous year. While the reason for the increase has not been ascertained, the Annual Report states that it is likely attributable to several factors, including increased awareness and ease of access following AI-enhanced search engine functionality.

The Annual Report also provides an overview of certain OPC investigations, breach engagement initiatives, and litigation matters in 2025-2026. Examples include investigations into the Canada Border Services Agency’s contracting practices during the development of the ArriveCAN app; Google’s search engine service and individuals’ right to have certain information de-listed; and major data breaches involving organizations such as 23andMe (previously covered in the E-TIPS® Newsletters here, here, and here, respectively).

Summary By: Claire Bettio