Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by levelWhat for?
by topicWho?
by sectorAll sectors
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2024 | 1 | – |
| 2025 | 3 | – |
| 2026 | 5 | – |
9 cases
7 May 2026 Canada Revenue Agency (CRA)Privacy Commissioner: Canada's tax authority CRA must strengthen protection against account takeovers Other
Since 2020, the Canada Revenue Agency (CRA) has experienced more than 42,000 individual breaches in which unauthorised persons accessed tax accounts or changed data in order to redirect benefits. In a special report to Parliament, the Privacy Commissioner of Canada criticised, among other things, the delayed introduction of mandatory MFA and incomplete incident recording, and made nine recommendations, eight of which were accepted in full and one in part.
Online accounts with payment functions need mandatory strong authentication and complete recording of incidents.
- Authority / court
- Office of the Privacy Commissioner of Canada (OPC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Privacy Act (Kanada)
- Action
- Other
- Status of proceedings
- unknown
- Sector
- Public sector
- Employees
- 10,000 or more
- Published
- 7 May 2026
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
18 Mar 2026 Nova Scotia PowerNova Scotia Power: commitments to the Privacy Commissioner after ransomware attack Other
Following a cyber attack in spring 2025 in which data of about 375,000 current and 540,000 former customers was exfiltrated, including bank account, driver's licence and social insurance numbers, Nova Scotia Power signed a compliance letter to the Privacy Commissioner of Canada. The company commits to delete customers' social insurance numbers and, by 31 October 2026, to submit an independent security assessment – including employee training and notification processes – and to report on implementing its recommendations; only then will the investigation be discontinued. According to the letter, the starting point was an employee clicking a link in a pop-up on a compromised website, which installed malware.
A single click on a fake pop-up can expose hundreds of thousands of customer records – training, limited admin rights and prompt notification belong together.
Fake update pop-ups and malware
Missing or inadequate training played a role in the decision.
- Authority / court
- Office of the Privacy Commissioner of Canada (OPC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Personal Information Protection and Electronic Documents Act (PIPEDA); Einstellung nach Paragraph 12.2(1)(c) bei Erfüllung der Zusagen
- Action
- Other
- Status of proceedings
- unknown
- Sector
- Energy and utilities
- Published
- 25 Mar 2026
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
10 Mar 2026 World Anti-Doping Agency (WADA)WADA: compliance agreement with Canada's Privacy Commissioner on athletes' data Other
The Montreal-based World Anti-Doping Agency (WADA), a foundation under Swiss private law, entered into a compliance agreement under PIPEDA with the Privacy Commissioner of Canada, under which an investigation opened in November 2024 following a complaint is held in abeyance and will be discontinued once the agreement is fulfilled. WADA must ensure that anti-doping organisations use athletes' personal information in the ADAMS system only for anti-doping purposes from 1 January 2027, amend the World Anti-Doping Code and the ADAMS agreements accordingly, document a control mechanism and report quarterly. WADA disputes any contravention and the Commissioner's jurisdiction; if it fails to comply, the Commissioner may apply to the Federal Court for an order.
Operators of data platforms used by partners must enforce, contractually and technically, that partners use the data only for the intended purpose.
Purpose limitation on shared data platforms
- Authority / court
- Office of the Privacy Commissioner of Canada (OPC)
- Area of law
- Data protection
- Legal basis
- Personal Information Protection and Electronic Documents Act (PIPEDA), Sections 17.1 und 17.2 (Compliance Agreement)
- Action
- Other
- Status of proceedings
- unknown
- Sector
- Other
- Published
- 17 Mar 2026
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
5 Mar 2026 Loblaw Companies LimitedOPC: Loblaw must change retention of PC Optimum data after account deletion Other
During a wave of boycotts in 2024, Loblaw did not process deletion requests in time and retained purchase and usage data from the loyalty programme (more than 17 million members) even after accounts were closed, without demonstrating effective anonymisation. Loblaw undertook to the Office of the Privacy Commissioner of Canada (OPC) to have the anonymisation independently reviewed and to carry out annual deletions.
Companies that continue to use data as anonymous after account deletion must be able to demonstrate the re-identification risk – IP addresses are often enough to link data to a person.
- Authority / court
- Office of the Privacy Commissioner of Canada (OPC)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- PIPEDA
- Action
- Other
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Employees
- 10,000 or more
- Published
- 5 Mar 2026
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
18 Feb 2026 Fraser Health Authority, Provincial Health Services Authority, Vancouver Coastal HealthBritish Columbia: 36 hospital staff accessed records of Lapu-Lapu Day victims without authorisation Other
Following the tragedy at the Lapu-Lapu Day festival in 2025, 36 employees of three health authorities accessed patient data of 16 admitted persons without authorisation in 71 instances. Those affected were not informed without undue delay; the Information and Privacy Commissioner for British Columbia (OIPC BC) made nine recommendations, including automated access monitoring and deterrent disciplinary measures.
Curiosity is no reason for access: monitor access to the records of high-profile cases in real time and sanction breaches noticeably.
Unauthorised viewing of patient records (snooping)
- Authority / court
- Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Freedom of Information and Protection of Privacy Act (FIPPA) BC, s. 25.1
- Action
- Other
- Status of proceedings
- unknown
- Sector
- Healthcare
- Culpability
- intentional
- Mitigating circumstances
- Appropriate safeguards were in place; the authorities responded quickly and accepted all recommendations.
- Published
- 18 Feb 2026
- Investigation reveals 71 snooping incidents by 36 healthcare workers following Lapu Lapu Day tragedy Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
23 Sep 2025 TikTok Pte. Ltd.Canadian regulators: TikTok inadequately protected children's data Other
The joint investigation by the Office of the Privacy Commissioner of Canada and the supervisory authorities of Québec, British Columbia and Alberta found that every year hundreds of thousands of children used the platform despite the minimum age of 13, and that TikTok processed data without valid consent, including for profiling and advertising. TikTok undertook to improve age verification and make privacy notices easier to understand, and already during the investigation largely stopped targeted advertising to under-18s (except by broad categories such as language and approximate location).
Age limits in the terms of use are not enough – platforms need effective age verification and child-appropriate transparency.
- Authority / court
- Office of the Privacy Commissioner of Canada gemeinsam mit den Aufsichten von Québec, British Columbia und Alberta
- Area of law
- Data protection · Marketing and consent
- Legal basis
- PIPEDA und Datenschutzgesetze für den Privatsektor von Québec, British Columbia und Alberta
- Action
- Other
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Published
- 23 Sep 2025
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
20 May 2025 13859380 Canada Inc. (Crane Supply)Crane Supply: CAI limits AI-enabled driver cameras in delivery vehicles Order
In 2023 the wholesale distributor of pipes and valves installed a camera system in all its delivery vehicles that also films the driver's cab from engine start until 20 minutes after the engine is switched off and uses artificial intelligence to detect events such as phone use, not wearing a seatbelt or smoking. The Commission d'accès à l'information (CAI, Quebec's access to information and privacy commission) found the necessity of the collection not established because the intrusion into drivers' privacy had not been sufficiently minimised, and ordered the company to limit in-cab recording to a few seconds before and after an incident or to stop it, to stop recording once the engine is off and to destroy any recordings going beyond that.
Cameras in company vehicles should only record around specific events; continuous recording of drivers is hard to justify.
Video surveillance of employees in company vehicles
- Authority / court
- Commission d'accès à l'information du Québec (CAI), section de surveillance
- Area of law
- Data protection · Employee data
- Legal basis
- Loi sur la protection des renseignements personnels dans le secteur privé (RLRQ c. P-39.1), Art. 5 (Notwendigkeit der Erhebung) und Art. 83
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- CAI, section de surveillance: Décision 1031833-S, 13859380 Canada Inc. (Crane Supply), 20.05.2025 Decision of an authority
- CAI: Répertoire des décisions rendues par la section de surveillance Enforcement database of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
18 Feb 2025 Metro Inc.Metro: CAI bans facial recognition database against shoplifting Order
In 2024 Metro notified the Commission d'accès à l'information (CAI, Quebec's access to information and privacy commission) of a pilot project in which people entering stores of the Metro, Super C and Jean Coutu banners would be matched by facial recognition, using the cameras at entrances and exits, against a biometric database; the database was to hold people involved in shoplifting or fraud incidents that led to police intervention. The CAI treated this as identity verification by means of biometric characteristics, which under s. 44 of the LCCJTI (Quebec Act to establish a legal framework for information technology) requires the express consent of the persons concerned, and prohibited putting the database into service. The decision is being challenged before the Court of Québec. The decision is not final.
In Quebec, biometric facial recognition in retail requires the express consent of the persons concerned, including in pilot projects.
Biometrics and facial recognition for theft prevention in retail
- Authority / court
- Commission d'accès à l'information du Québec (CAI), section de surveillance
- Area of law
- Data protection · Video surveillance
- Legal basis
- Loi concernant le cadre juridique des technologies de l'information (RLRQ c. C-1.1), Art. 44 und 45; Loi sur la protection des renseignements personnels dans le secteur privé (RLRQ c. P-39.1), Art. 83
- Action
- Order
- Status of proceedings
- under appeal
- Sector
- Retail and e-commerce
- Employees
- 10,000 or more
- CAI, section de surveillance: Décision 1037199-S, Metro Inc., 18.02.2025 Decision of an authority
- CAI, section de surveillance: Décision 1037199-S, Metro Inc., 01.04.2026 (Folgeentscheidung, Rn. 5–6: Anfechtung der Entscheidung vom 18.02.2025 vor der Cour du Québec) Decision of an authority
- CAI: Répertoire des décisions rendues par la section de surveillance Enforcement database of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
4 Sep 2024 a Canadian printing companyPrinting company: CAI orders end to facial recognition in access control Order
During the pandemic in 2020 the printing company introduced an access control system with facial recognition and temperature checks for its employees, and kept using facial recognition after the temperature function was discontinued in October 2022. The Commission d'accès à l'information (CAI, Quebec's access to information and privacy commission) found that the company had not shown that collecting the biometric data was necessary for access control and ordered it, within 90 days, to stop collecting and using facial recognition and to destroy the biometric templates created.
Biometric access control for employees requires documented evidence that its benefits outweigh the intrusion into privacy.
Biometric access control in the workplace
- Authority / court
- Commission d'accès à l'information du Québec (CAI), section de surveillance
- Area of law
- Data protection · Employee data
- Legal basis
- Loi sur la protection des renseignements personnels dans le secteur privé (RLRQ c. P-39.1), Art. 4 (Notwendigkeit der Erhebung) und Art. 83
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Manufacturing and mechanical engineering
- CAI, Entscheidungen der Überwachungssektion (Übersicht) (Entscheidung 2024) Enforcement database of an authority
Checked against the official source on 3 Oct 2026 · Company name anonymised since 4 Sep 2026 · Direct link