Introduction: worrying provincial disparities
Some Canadian provinces lead on privacy protection. Others lag worryingly behind, and their residents face a higher risk of data breaches and excessive surveillance. These provinces tend to share the same traits: aging laws that do not fit today's digital reality, privacy commissioners that are chronically underfunded and lack real powers, no private-sector rules beyond the federal minimum, and surveillance technology rolled out without proper impact assessments.
Unlike European jurisdictions, or even some Canadian provinces such as Quebec, these provinces have not modernized their legal frameworks to deal with big data, artificial intelligence, facial recognition and the Internet of Things. This inaction is not just a technical or bureaucratic matter. It has real consequences for citizens' fundamental rights, as their personal data is collected, used and sometimes disclosed without adequate controls.
In this article, we look at the Canadian provinces with the weakest privacy protections: the gaps in their laws, the weakness of their oversight, and the worrying practices seen in the public and private sectors.
Manitoba and Saskatchewan: outdated laws and powerless commissioners
Manitoba and Saskatchewan rank among the provinces with the weakest privacy protections, mainly because of outdated laws and commissioners with limited powers.
In Manitoba, the Freedom of Information and Protection of Privacy Act (FIPPA) and the Personal Health Information Act (PHIA) date from the 1990s and have not been substantially modernized for the digital age. The Manitoba ombudsman's powers are limited: the office can investigate and make recommendations, but it cannot issue binding orders to public bodies that resist. This structural weakness leads to high non-compliance with the commissioner's recommendations, with no real consequences for the offending bodies.
Saskatchewan has similar gaps with its Freedom of Information and Protection of Privacy Act (FOIP) and its Health Information Protection Act (HIPA). HIPA is fairly detailed, but enforcement remains a problem because the commissioner is chronically underfunded and there are no deterrent penalties.
Neither province has passed private-sector privacy legislation beyond the federal PIPEDA, unlike Quebec, Alberta or British Columbia. Companies operating in Manitoba and Saskatchewan therefore face minimal requirements and can avoid stricter obligations imposed elsewhere in Canada. Residents of these provinces get much weaker protection than their fellow citizens in Quebec or British Columbia.
A privacy commissioner without binding order-making powers is a paper tiger, unable to protect citizens' rights effectively against resistant public bodies. — Canadian Civil Liberties Association
New Brunswick and Prince Edward Island: too few resources and a technology lag
New Brunswick and Prince Edward Island show how a lack of resources and political will can undermine privacy protection, even where laws exist on paper.
New Brunswick applies the Right to Information and Protection of Privacy Act (RTIPPA), but its commissioner has one of the smallest budgets and staffs in the country, which sharply limits investigation and oversight. The office can handle only a limited number of complaints each year, so processing often takes more than two years, during which privacy violations continue with no remedy.
Prince Edward Island is in a similar situation under its Freedom of Information and Protection of Privacy Act (FOIPP). Its commissioner works with even fewer resources and is often forced to choose between public education and handling individual complaints.
Both provinces also lag significantly in regulating emerging technologies. Neither has adopted clear guidance on public bodies' use of facial recognition, artificial intelligence or geolocation, which leaves a worrying legal gap. New Brunswick has been criticized for deploying surveillance systems without adequate public consultation or privacy impact assessments. Prince Edward Island has had several privacy incidents in its health system without meaningful corrective measures being imposed. Neither province keeps a public register of privacy incidents, which limits transparency and prevents citizens from knowing how far their data has been breached.
Newfoundland and Labrador: broad surveillance and limited transparency
Newfoundland and Labrador stands out for a permissive approach to government surveillance and a chronic lack of transparency about its data collection practices.
The province has applied the Access to Information and Protection of Privacy Act (ATIPPA) since 2015, but the law has several structural weaknesses that favour government interests over citizens' rights. In particular, the exceptions that let public bodies refuse access to information are read broadly, and the commissioner has limited power to challenge those decisions.
The province has been criticized for greatly expanding its video surveillance in public spaces without proper consultation or clear guidelines on how long images are kept and how they are used. Cameras have been installed in many government buildings, schools and public facilities without privacy impact assessments, raising concerns about profiling and the indefinite storage of biometric data.
Newfoundland and Labrador has also not adopted private-sector regulation, leaving local businesses subject only to the minimal federal requirements. It has had several privacy incidents involving health data, with no substantial prevention or penalty measures put in place. The commissioner's lack of resources limits the office's ability to investigate these systemic breaches and to impose organizational change.
This mix of broad surveillance, limited transparency and ineffective protection mechanisms puts Newfoundland and Labrador among the Canadian provinces that respect their citizens' privacy the least.
The territories: embryonic legal frameworks
The three Canadian territories (Yukon, the Northwest Territories and Nunavut) have particularly embryonic privacy frameworks, reflecting both their small size and their recent institutional development.
Yukon applies the Access to Information and Protection of Privacy Act (ATIPP) but has no dedicated privacy commissioner. The information and privacy commissioner's duties focus mainly on access to records rather than on protecting personal data. The Northwest Territories have a similar Access to Information and Protection of Privacy Act (ATIPP), with comparable limits on resources and specialization. Nunavut, Canada's youngest territory, has even more rudimentary privacy legislation.
None of the three territories has developed specific rules for surveillance technology, biometric data or artificial intelligence. Because the territories have small populations and limited budgets, commissioners often work alone or with minimal staff, which makes effective oversight of every public body impossible. The territories also rely entirely on the federal PIPEDA to regulate the private sector, with no supporting territorial legislation.
This is especially worrying given the specific challenges territorial communities face, including Indigenous populations, who can be particularly vulnerable to misuse of personal data. Without robust legal frameworks and effective protection mechanisms, territorial residents are more exposed to potential privacy violations.
Consequences for citizens and businesses
The lag of some Canadian provinces on privacy has tangible consequences for their citizens and creates complications for businesses.
For citizens, living in a low-protection province means greater exposure to personal data breaches with no effective remedy. When a public body or a private company mishandles their data, residents of these provinces face powerless commissioners, endless processing times and no deterrent penalties against offenders. It also creates a geographic injustice: two Canadians with identical privacy problems will receive radically different protection depending on their province.
For businesses, this regulatory patchwork creates operational complexity, but also a temptation to locate operations in lightly regulated provinces to avoid stricter obligations. This race to the bottom ultimately hurts all of Canada, because it weakens the culture of data protection and can discourage investment from foreign companies that care about privacy. Low-protection provinces also become attractive places for unscrupulous actors to store sensitive data, creating blind spots in Canadian digital governance.
The situation calls for a gradual harmonization of standards across the country, ideally towards the highest levels set by Quebec, British Columbia and Alberta, rather than towards the lowest common denominator of federal law.
Privacy protection should not depend on your postal code: all Canadians deserve robust protection of their personal data, whatever province they live in. — Office of the Privacy Commissioner of Canada
Conclusion: an urgent need to modernize
The Canadian provinces with the weakest privacy protections share common failings: outdated laws that have not kept pace with technology, commissioners that are underfunded and lack binding powers, no private-sector regulation beyond the federal minimum, and surveillance technology deployed without proper safeguards.
Manitoba, Saskatchewan, New Brunswick, Prince Edward Island, Newfoundland and Labrador and the three territories are in a worrying position: their residents have much weaker protection than people in Quebec, British Columbia or Alberta. This disparity is not inevitable. It results from political and budget choices that can be reversed.
These provinces need to recognize that privacy is not a luxury or a secondary concern, but a fundamental right essential to human dignity and to democracy. They should urgently adopt modernized legislation inspired by Quebec's Law 25, give commissioners real powers and adequate budgets, and set up regulatory frameworks for emerging technologies.
In the digital age, when our whole lives leave exploitable data traces, strong privacy protection is no longer optional but essential. The lagging provinces must act quickly to close the gap with Canada's leaders and protect their citizens' rights effectively.