Law 25 (an act modernizing legislative provisions on the protection of personal information) has come into force progressively since September 2022 in Quebec. It substantially modernizes privacy protection.

Your new rights include:

• Right to portability: receive your data in a reusable format
• Right to de-referencing: ask search engines to remove links about you in certain circumstances
• Mandatory notification: businesses must tell you when your data is compromised in a breach
• Stronger consent: explicit consent required to collect and use your sensitive data
• Stopping use: you can require a business to stop using your information for commercial purposes

Penalties: businesses that breach Law 25 face fines of up to $25 million or 4% of global turnover, whichever is higher.

How to exercise your rights: contact the business in writing. If it refuses or does not answer, file a complaint with the Commission d'accès à l'information (CAI).

All three laws protect privacy, but in different jurisdictions:

Law 25 (Quebec):

• Applies to Quebec's private sector
• Rights similar to the GDPR (portability, de-referencing)
• Severe penalties (up to $25M or 4% of global turnover)
• Phased in from 2022 to 2024

PIPEDA (Canadian federal):

• Applies to businesses under federal jurisdiction, and in provinces without substantially similar legislation
• Meaningful consent required
• Less prescriptive than Law 25 or the GDPR
• Less severe penalties (for now)

GDPR (European Union):

• Applies to EU residents and to businesses processing their data
• The de facto global standard for data protection
• Extensive rights (access, rectification, erasure, portability, objection)
• Very severe penalties (up to €20M or 4% of global turnover)

For you: if you are in Quebec, Law 25 generally applies. Canadian businesses dealing with Europe must also comply with the GDPR, which indirectly improves your protection.

Exercising your right of access tells you what data a business holds about you. Here is how:

Step 1: identify the business
Work out which organization holds your data (bank, social network, service provider, and so on).

Step 2: make the request in writing
Send a formal request by email or letter including:

• Your full name and contact details
• A clear description of what you are asking for ("access to all my personal data")
• Proof of identity (as much as they reasonably require)
• A reference to the applicable law (Law 25 in Quebec, PIPEDA federally)

Step 3: the response deadline
The business must answer within a reasonable time (generally 30 days in Quebec, 30 days under PIPEDA).

Step 4: if it refuses or stays silent
File a complaint with:

• In Quebec: the Commission d'accès à l'information (CAI)
• Federally: the Office of the Privacy Commissioner of Canada

Yes, but with limits. Under Law 25 and PIPEDA you have the right to ask for your personal data to be deleted, but businesses may refuse in certain situations:

Cases where deletion must be granted:

• The data is no longer needed for the purposes it was collected for
• You withdraw consent and there is no other legal basis
• The data was collected unlawfully
• Deletion is required to comply with a legal obligation

Cases where the business may refuse:

• A legal duty to keep it (for example, tax documents for 7 years)
• Necessary to exercise or defend legal claims
• Public interest (archives, scientific research under strict conditions)
• Protecting safety or preventing fraud

How to ask: the procedure is similar to the right of access — a clear written request, proof of identity, a reference to the applicable law. If refused, the business must explain why.

Worth knowing: deletion generally means the business can no longer use your data, but some backup copies may persist temporarily for technical reasons.

Yes, strongly recommended. Even in Canada, where privacy laws are relatively strong, a VPN offers important protections:

Reasons to use a VPN in Canada:

• Public Wi-Fi: public networks (cafés, airports, hotels) are vulnerable to interception. A VPN encrypts your traffic.
• Your internet provider: your ISP can legally collect and potentially sell your browsing data. A VPN hides your activity from them.
• Price discrimination: some sites adjust prices based on your location or history. A VPN masks your real IP.
• Geo-restrictions: reach content that is blocked by region.
• General privacy: websites do not see your real IP, which makes tracking harder.

VPNs recommended for Canada:

• Mullvad VPN: audited no-logs policy, accepts cash and crypto, based in Sweden
• ProtonVPN: based in Switzerland, free tier available, strong reputation
• IVPN: transparent, regularly audited, privacy-respecting

There is no "perfect" browser, but some offer better protections out of the box:

🦊 Firefox (recommended for most people)

• Open source, regularly audited
• Built-in Enhanced Tracking Protection
• An excellent balance of privacy, compatibility and features
• Extensions like uBlock Origin for advanced blocking
• Containers to separate activities

🦁 Brave

• Chromium-based with built-in blocking
• Blocks trackers and ads by default
• Good if you prefer a Chrome-style interface
• Tor integration for private browsing

🧅 Tor Browser (very sensitive situations)

• Maximum anonymity through the Tor network
• Resists fingerprinting
• Slower, and some sites block Tor
• Use it for ultra-sensitive searches and communications

❌ Avoid:

• Google Chrome: extensive data collection, tied to a Google account
• Microsoft Edge: heavy telemetry, shares data with Microsoft
• Opera: Chinese ownership (Kunlun), a troubling privacy record

Essential setup whatever the browser:

• Install uBlock Origin
• Disable third-party cookies
• Turn on tracking protection
• Clear cookies and cache regularly

Absolutely. It is one of the most important security measures you can take.

Why it matters:

• The average person has 100+ online accounts
• It is impossible to memorize strong, unique passwords for each one
• Re-using passwords means one breach compromises every account
• Credential-stuffing attacks exploit that re-use
• Managers generate random passwords that cannot be guessed

Recommended managers:

• Bitwarden (free): open source, an excellent free tier, endorsed by security experts, cloud sync
• 1Password (paid, about $5/month): intuitive interface, excellent family sharing, advanced features
• KeePassXC (free, local): fully offline, maximum security, manual sync required

"But what if my manager gets hacked?"

Reputable managers use end-to-end encryption — even if they are breached, your passwords are inaccessible without your master password. The risk of re-using weak passwords is statistically far higher.

Getting started:

1. Pick a manager (we suggest Bitwarden to start)
2. Create a strong master password (a passphrase of 30+ characters)
3. Install the browser extension and the mobile app
4. Add existing accounts gradually
5. Generate strong passwords (20+ characters) for new accounts
6. Enable two-factor authentication on the manager itself

Very limited protection. Private mode (Incognito on Chrome, Private Browsing on Firefox and Safari) is widely misunderstood.

What private mode DOES:

• Stops the browser saving history locally
• Deletes cookies when the session closes
• Does not save passwords or form data
• Useful if you share a computer and want to hide activity from other local users

What private mode does NOT do:

• ❌ Does not hide your activity from your ISP
• ❌ Does not hide your IP from websites
• ❌ Does not block trackers or cookies while you browse
• ❌ Does not prevent fingerprinting
• ❌ Does not protect you on an employer or school network
• ❌ Does not make you anonymous

Real protection: for genuine protection online, combine:

• A VPN (hides your IP and your activity from your ISP)
• Tracker blockers (uBlock Origin)
• A privacy-focused browser (Firefox, Brave)
• Third-party cookies disabled

This is the most widespread — and most dangerous — myth about privacy.

Why the argument fails:

1. Privacy ≠ secrets
Privacy is about dignity, autonomy and freedom, not about hiding illegal activity. You close the door of a public toilet — not because you are doing something wrong, but because some things are private by nature.

2. Targeted manipulation
Your data lets companies manipulate you. They know when you are vulnerable (stressed, tired, emotional) and can target advertising or content at those moments. That is a power asymmetry.

3. Discrimination and unfairness
Your data is used to judge you: insurers adjusting premiums, employers passing you over, prices differing by profile. Those automated decisions can be biased, wrong, and you often have no recourse.

4. The chilling effect
Knowing you are watched changes behaviour. Studies show people self-censor their searches, avoid sensitive topics, and hesitate to explore controversial ideas when they believe they are being watched. That limits intellectual freedom and innovation.

5. You do not know what will incriminate you tomorrow
What is legal and socially acceptable today can change. Data collected now can be used against you in a very different future context. History is full of registers repurposed for persecution — ethnic censuses, for one.

6. Collective security
Even if you are comfortable with surveillance, others (journalists, activists, minorities, victims of violence) need privacy for their physical safety. Normalizing surveillance puts those people at risk.

No. The basic measures are simple and quick.

Essential protections (2–3 hours of setup):

• Change browser (30 min): Firefox instead of Chrome, install uBlock Origin
• Password manager (1 h): Bitwarden, free, generates strong passwords
• Two-factor authentication (30 min): enable it on your important accounts
• Review social media settings (30 min): limit visibility, turn off tracking

Impact afterwards: minimal. The manager fills passwords automatically (faster than before), blockers make sites load quicker, and 2FA adds 5 seconds to signing in.

Monthly upkeep: 20–30 minutes to update software, review new apps, and check for data breaches.

Real trade-offs:

• Some sites load slightly slower with blockers (rare)
• Occasional captchas with a VPN
• The occasional need to disable a blocker for a specific site (under 1% of sites)

Benefits:

• A 70%+ reduction in advertising tracking
• Protection against identity theft and credential stuffing
• Peace of mind knowing your data is protected
• Sites often load faster without ads and trackers

Legally compliant: often yes. Compliant in spirit: rarely.

Common tactics:

1. Minimal compliance
They do the minimum the law requires, working the grey areas. For instance, they obtain "consent" through misleading interfaces where refusing is made deliberately hard.

2. Dark patterns
Interfaces designed to manipulate: a huge colourful "Accept all" button, a small grey "Refuse", and labyrinthine settings menus to discourage adjustments.

3. Elastic definitions
"We don't sell your data" — but they share it with "partners" (700+ in Facebook's case), which amounts to the same thing in practice.

4. Lobbying against regulation
They spend millions lobbying to weaken privacy laws before they pass.

5. Fines as a cost of doing business
Google has paid $9.3 billion in privacy and antitrust fines since 2010 — while generating $280+ billion a year. The fines are an acceptable price for continued surveillance.

Documented violations (examples):

• Meta (Facebook): €1.3 billion EU fine (2023) for unlawful data transfers
• Google: €90M French fine (2020) for cookies imposed without consent
• Amazon: €746M Luxembourg fine (2021) under the GDPR — the largest GDPR fine to date

What to do:

• Do not trust default settings — review and adjust them
• Actually read the options at the consent screen (or refuse)
• Use privacy-respecting alternatives when you can (DuckDuckGo instead of Google Search, Signal instead of WhatsApp)
• Exercise your rights regularly (access, deletion) to remind them they are being watched
• Support stronger legislation by contacting your representatives

Phones often collect more data than computers (location, contacts, photos with metadata, microphone, camera). Here is how to protect yourself:

On iPhone (iOS):

• Settings → Privacy & Security: review every app permission
• Location: turn it off for non-essential apps, and pick "While Using the App" rather than "Always"
• Ad tracking: Settings → Privacy → Tracking → turn off "Allow Apps to Request to Track"
• Privacy report: Safari → Privacy Report to see the trackers blocked
• iCloud: end-to-end encryption for sensitive data (requires iOS 16.2+)

On Android:

• Settings → Privacy: review the privacy dashboard
• Location: turn off Google location history, limit app permissions
• Advertising ID: reset or delete your advertising ID
• Permissions: review and revoke unnecessary permissions (Settings → Apps)
• Alternative ROMs (advanced): GrapheneOS, CalyxOS for maximum privacy

For everyone:

• Install apps only from official stores (App Store, Google Play)
• Read permissions before installing — refuse if they are excessive
• Uninstall unused apps regularly
• Use privacy-respecting apps (Signal instead of WhatsApp, Firefox Focus instead of mobile Chrome)
• Turn on full-device encryption and a strong lock code
• Disable biometric unlock for sensitive situations
• Use a VPN on public networks

Finding out your data has been compromised is unsettling, but acting quickly limits the damage.

Immediate steps:

1. Confirm the breach (5 min)

• Check the company's email or notification
• Visit HaveIBeenPwned.com to confirm which data was compromised
• Note what was exposed (passwords, credit cards, personal data, and so on)

2. Change passwords (30 min)

• Change the password of the compromised account immediately
• If you re-used that password elsewhere (stop doing that!), change it on every account where you used it
• Use strong, unique passwords (a password manager is recommended)

3. Turn on two-factor authentication (10 min)

• If you have not already, enable 2FA on the compromised account and on every important account
• Prefer an authenticator app or a security key over SMS

4. Watch your financial accounts (15 min, then continuously)

• Check bank and credit card statements for suspicious transactions
• Set up transaction alerts (most banks offer this free)
• Consider a credit freeze if your social insurance number (SIN) was compromised

5. Check your credit report (30 min)

• Get your free annual credit report from Equifax and TransUnion Canada
• Look for accounts or credit applications you did not authorize
• Consider a credit monitoring service if very sensitive data was compromised

6. File a complaint (30 min)

• In Quebec: the Commission d'accès à l'information (CAI)
• Federally: the Office of the Privacy Commissioner of Canada
• Document everything: emails, screenshots, dates, impacts

7. Ongoing vigilance (the following months)

• Be more suspicious of emails and calls (criminals will use the stolen data for targeted phishing)
• Monitor your financial accounts regularly for at least 6–12 months
• Check your credit reports quarterly