Expanding Freedom and Democracy
Freedom on the Net 2023

Canada

Free
88
100
A Obstacles to Access 23 25
B Limits on Content 33 35
C Violations of User Rights 32 40
Last Year's Score & Status
87 100 Free
Scores are based on a scale of 0 (least free) to 100 (most free). See the research methodology and report acknowledgements.

header1 Overview

Canada remains one of the most open online environments in the world. Internet access is reliable and affordable for most of the population, although a notable digital divide persists for internet users in rural areas. Canadians enjoy strong protections for free expression and press freedom on the internet. While a recent law raised concerns that the government could seek to significantly expand its regulatory authority over online content, such concerns did not materialize during the coverage period.

Canada has a strong history of respect for political rights and civil liberties, though in recent years citizens have been concerned about laws relating to government surveillance and personal privacy. While Indigenous and other marginalized Canadians still face discrimination and economic, social, and political challenges, the federal government has acknowledged and made some moves to address these issues.

header2 Key Developments, June 1, 2022 - May 31, 2023

  • The government continued to expand on infrastructural investments to improve connectivity and reduce the digital divide, with the country’s Universal Broadband Fund growing to C$3.225 billion ($2.38 billion) in November 2022. Despite such investments, rural communities remain particularly underconnected (see A1 and A2).
  • In April 2023, the government enacted Bill C-11, the Online Streaming Act. The law empowers the Canadian Radio-television and Telecommunications Commission (CRTC) to regulate online streaming platforms, raising uncertainty about whether the CRTC could restrict user-generated content under the law—fears that the government has repeatedly attempted to allay. The full effects of the law had yet to be seen in practice during the coverage period (see A5 and B3).
  • Parliament neared passage of Bill C-18, the Online News Act, during the coverage period. The bill, which was enacted after the coverage period, in June 2023, requires tech companies to negotiate agreements with Canadian media companies that compensate them for providing news content on the tech companies’ platforms. In response, Google and Meta threatened to end the availability of news content on their platforms in Canada (see B6 and B7).
  • The government introduced Bill C-27, the Digital Charter Implementation Act, in June 2022, as part of ongoing attempts to improve privacy protections for users. That month, the national police force also disclosed its use of spyware to hack suspects’ devices in serious criminal and national security investigations, though allegedly always with judicial authorization (see C5).

A Obstacles to Access

A1 1.00-6.00 pts0-6 pts
Do infrastructural limitations restrict access to the internet or the speed and quality of internet connections? 6.006 6.006

Both fixed-line and mobile internet penetration rates have remained relatively steady in Canada. Mobile service providers continue to deploy several newer technologies to provide mobile broadband service, and fifth-generation (5G) technology network coverage reached 87.8 percent as of 2021, up almost 35 percentage points from its introduction in 2020.1 According to 2022 data from the International Telecommunication Union (ITU), Canada has a 43 percent fixed broadband penetration rate and a 86 percent mobile broadband penetration rate.2

Broadband service of at least 25 megabits per second (Mbps) reached 96.6 percent household availability in 2021, according to the CRTC, the regulatory body that oversees the communications industry.3 In 2019, the CRTC shifted its focus to “high-quality” internet service, defined as offering 50 Mbps download speeds, 10 Mbps upload speeds, and unlimited data transfers, with the goal of 90 percent household availability by 2021, and 100 percent availability by 2031,4 which was identified as Canada’s “Universal Service Objective” in a landmark 2016 policy decision.5 Canada is on track with these goals, moving from 89.7 percent availability in 2020 to 91.4 percent availability in 2021—thus achieving the first objective—with 75 percent of all subscribers having service of at least 50 Mbps download speeds and 10 Mbps upload speeds as of the third quarter of 2022.6

In conjunction with the 2016 decision, the CRTC declared high-speed internet access a “basic telecommunications service” and established a C$750 million dollar ($554 million) fund to reach those targets.7 In 2018, the CRTC announced criteria for the fund’s use.8 A second round of calls for project applications was opened in November 2019,9 and the distribution of these funds continued through 2022, with C$226.5 million ($167.4 million) awarded as of May 2023.10 A third round of calls for project applications opened in November 2022, with a focus on remote transportation corridors and satellite-dependent communities.11 The CRTC’s fund is part of a larger commitment to broadband access in Canada through the C$3.225 billion ($2.38 billion) Universal Broadband Fund (see A2).12

While robust infrastructure generally safeguards against power shortages or blackouts that limit Canadians’ internet access, a failure following a maintenance update caused a country-wide mobile and internet outage for customers of one of the major internet service providers (ISPs), Rogers, that lasted 15 hours in July 2022.13

A2 1.00-3.00 pts0-3 pts
Is access to the internet prohibitively expensive or beyond the reach of certain segments of the population for geographical, social, or other reasons? 2.002 3.003

Internet access is not prohibitively expensive or beyond the reach of most segments of the population, although a digital divide in terms of geography persists, and people with lower incomes struggle to afford access. The government named universal access as the first of 10 draft principles for a digitally connected Canada in its October 2019 Digital Charter.1

Mobile broadband data remains expensive compared to fixed-line broadband data. High-speed, fixed-line access remains relatively affordable due to robust competition; prices became even more competitive when the CRTC reduced the price of wholesale high-speed internet access in 2016,2 and again in March 2023.3 According to 2022 ITU data, a 5 gigabyte (GB) fixed broadband connection costs 1.0 percent of gross national income (GNI) per capita, while a 2 GB mobile broadband connection costs 0.9 percent of GNI per capita.4

Perhaps the most important obstacle to availability and ease of access is geography: 82 percent of Canada’s population lives in urban areas.5 While providing “reliable and affordable telecommunications services of high quality” to rural areas is enshrined in law,6 affordable high-speed internet service is less available in more isolated areas, especially in the vast northern territories. Connectivity projects initiated under the CRTC’s recent call for applications (see A1), however, could help to lessen this divide.

High-speed internet access is also more expensive in rural areas than in cities, and rural customers have fewer choices of ISPs, according to figures from the CRTC.7 In 2021, rural customers paid on average C$7.47 ($5.52) more per month than urban customers for a CRTC–defined “high-quality” fixed-broadband package with 50 Mbps download speeds, 10 Mbps upload speeds, and unlimited data transfers.8 Major ISPs generally offer services with data caps, resulting in increased fees for users who exceed the limit. Such limits are much more restrictive for wireless connectivity than for wired connectivity, which further exacerbates the urban-rural divide in terms of cost. The federal government’s 2023 budget promised a crackdown on “junk fees,” including internet overage charges, which may help to lower prices for both wireless and wired connectivity.9

When considering the CRTC’s high-quality service definitions, the urban-rural divide is extremely significant: service with 50 Mbps download speeds, 10 Mbps upload speeds, and unlimited data transfers is available to 99.2 percent of urban households, but only 62 percent of rural households.10 The divide may finally be shrinking, however, as the 53-percentage point spread from 2019 decreased to 37 percentage points in 2021.11

The government has generally taken a patchwork approach to improving connectivity in remote communities, with different government departments providing funds and strategies seemingly without a central, detailed plan. In 2019, the government pledged to spend between C$5 billion ($3.7 billion) and C$6 billion ($4.4 billion) to improve rural broadband services over 10 years.12 The 2021 budget—presented that April as the first budget in two years due the COVID-19 pandemic13 —included an additional C$1 billion ($783 million) that will in part go towards improving rural and remote broadband access.14 In November 2022, Prime Minister Trudeau announced that C$475 million ($351 million) would be added to the Universal Broadband Fund, bringing the initiative to C$3.225 billion ($2.38 billion).15 While the minister of rural economic development proposed a comprehensive strategy for improving connectivity in 2019,16 it has produced few tangible results. A March 2023 report by the auditor general found that the government’s 2019 strategy had not meaningfully reduced the country’s urban-rural digital divide, particularly for remote First Nations communities, and had failed to measure all dimensions that affect affordability, such as household income.17

The urban-rural divide increased during the COVID-19 pandemic,18 and a merger between two of Canada’s largest telecommunications companies is also expected to intensify the divide (see A4).19

There is also a significant access gap in terms of income: as of 2021, the penetration rate for “excellent data quality” home internet access for the highest income quartile was 90.7 percent, while the equivalent penetration rate for the lowest income quartile was only 75.9 percent.20

Internet connections are widely available in public spaces such as cafés, shopping malls, and libraries, generally free of charge.

A3 1.00-6.00 pts0-6 pts
Does the government exercise technical or legal control over internet infrastructure for the purposes of restricting connectivity? 6.006 6.006

The government does not exercise technical or legal control over the internet infrastructure for censorship. Authorities do not restrict access to any social media platforms or communications apps. In early 2023, the federal government and all provincial governments banned TikTok from government-issued phones over security and privacy concerns, but no restrictions were placed on personal devices (see B1).1

The government has not centralized the telecommunications infrastructure. However, given the vertical integration of the marketplace, the infrastructure is controlled by a small number of companies, which could theoretically facilitate greater control of content and the implementation of surveillance technologies.

A4 1.00-6.00 pts0-6 pts
Are there legal, regulatory, or economic obstacles that restrict the diversity of service providers? 5.005 6.006

There are some legal and economic obstacles that restrict the diversity of service providers, although the market remains relatively open. Specifically, the legal requirements for Canadian ownership of service providers, combined with the high costs of entry and infrastructure, has led to market concentration, especially for mobile service.

To operate as a Canadian telecommunications provider, a company must meet the requirements in Section 16 of the Telecommunications Act. The telecommunications market has been dominated in recent years by the five largest companies (Bell, Québecor, Rogers, Shaw, and TELUS), which accounted for approximately 91 percent of the total telecommunications market as of January 2023, based on market capitalization.1

The telecommunications market in Canada is set to become even more concentrated following the completed merger of two of the five largest companies, Rogers and Shaw. After the CRTC approved the broadcasting portion of the merger in 2021,2 the government, through the minister of innovation, science and industry, gave final approval to the merger, valued at C$26 billion ($19.2 billion), on March 31, 2023;3 the deal was finalized three days later, on April 3.4 On orders of the government, as a condition to the merger, the deal excluded Shaw’s wireless division, Freedom Mobile, which will be purchased by Québecor's Vidéotron. The government claimed that this act will actually increase competition and affordability in the telecommunications sector,5 but commentators remain unconvinced.6

Canadians have a choice of wireless internet providers, all of which are privately owned. With the launch of Freedom Mobile’s first nationwide plan in May 2023,7 there are at least four providers to choose from in all markets, although providers vary from region to region and some providers are restricted to urban areas. Restrictions on foreign investment and ownership impose barriers to entry, limiting competition in the telecommunications market.8 The provision of access services is subject to regulation, with rules on tower-sharing and domestic-roaming agreements and a consumer regulator to address consumer concerns.

Three mobile service providers dominate the market, with Bell, TELUS, and Rogers accounting for 88.3 percent of the mobile market’s revenue in 2021.9 Their market share has remained relatively steady over the years. These companies are also leaders in the provision of fixed-line internet service (via phone lines or cable), along with Cogeco, and Vidéotron. While Canadians generally enjoy a choice of fixed-line internet providers, the available choices vary from region to region. There is often only one choice per technology type, leading to a public perception that options are limited and prices kept artificially high. This perception is not without merit, as Canada’s wireless prices continue to be rated among the highest in the world.10 However, in March 2020 the government ordered the three largest wireless companies (Bell, TELUS, and Rogers) to lower their prices by 25 percent over the next two years.11 This was achieved for “mid-range” wireless plans by January 2022.12 Wireless prices fell by 2.6 percent on average in 2022.13

A5 1.00-4.00 pts0-4 pts
Do national regulatory bodies that oversee service providers and digital technology fail to operate in a free, fair, and independent manner? 4.004 4.004

The CRTC largely operates independently of the government. The government appoints the CRTC chairperson and commissioners without public consultation, but they are not subject to political pressure. In some cases, the government has provided guidance on policy expectations regarding telecommunications regulations, but its input is nonbinding. Moreover, CRTC decisions can be appealed, or a government review can be requested. The government has rarely overturned CRTC decisions.

The CRTC’s regulatory powers extend to internet access, but traditionally not to internet content, a principle known as the “new media exemption.” The CRTC’s position to refrain from internet content regulation dates to 1999 and has been reinforced on numerous occasions since,1 including by the Supreme Court of Canada (SCC).2 Amendments to Canada’s Broadcasting Act in the form of Bill C-11, called the “Online Streaming Act,” proposed in February 20223 and ultimately made law in April 2023,4 threaten to dramatically alter Canada’s media landscape and expand the scope of the CRTC’s regulatory powers. It potentially allows for regulation of the internet and its content in new and myriad ways, effectively discarding the new media exemption and regulating content from non-Canadian sources (see B3).5

B Limits on Content

B1 1.00-6.00 pts0-6 pts
Does the state block or filter, or compel service providers to block or filter, internet content, particularly material that is protected by international human rights standards? 5.005 6.006

The government does not generally block or filter online content or require service providers to do so. Project Cleanfeed Canada allows ISPs to block child sexual abuse imagery hosted outside of Canada, restrictions that are permissible under international human rights standards (see B3).

In February and March 2023, the federal government1 and all Canadian provinces2 banned the use and download of TikTok on government-issued devices, citing cybersecurity and privacy concerns over the Chinese-owned video platform. The actions followed similar bans in the United States and European Union (EU). No such restrictions have been implemented for personal devices.

In November 2019, a court ordered all of Canada’s major ISPs to block several domains associated with a service that sold copyright-infringing programming. Several large media companies petitioned the Federal Court in Bell Media Inc. v. GoldTV.Biz to order the domains’ blocking for rebroadcasting their programming without permission. Twelve domains and subdomains were blocked under the order, which permitted the media companies to seek further blocking orders for websites infringing on their programming. 3 Legal experts criticized the decision on numerous grounds, including by calling it an overreach by the court into a policy issue that should be decided by Parliament or the CRTC.4 The decision was appealed by ISP TekSavvy, which the Federal Court of Appeal rejected in May 2021, concluding that the lower court judge did have the authority to grant website blocking orders (see B2).5 In March 2022, the SCC declined to hear TekSavvy’s second appeal, ending the case.6

The media companies from the Bell Media case took the next step in seeking site-blocking in October 2021, when they filed for a case seeking a “dynamic” site-blocking order. In May 2022, the Federal Court granted a preliminary injunction that required ISPs to block internet protocol (IP) addresses of websites showing pirated content (specifically, live streamed professional hockey games) in real time.7 The temporary order, which lasted the duration of the professional hockey season, is considered the first of its kind in North America.8 The order was quietly renewed in November 2022 for the 2022–23 National Hockey League (NHL) season.9 In December 2022, Bell Media also secured a similar site-blocking order during the 2022 FIFA World Cup.10

Previously, in 2018, a group of over 25 ISPs, media companies, creative companies, and other interested parties—including major entities like Bell, Rogers, and the Canadian Broadcasting Corporation (CBC)—banded together as “FairPlay Canada”11 to petition the CRTC to establish an independent body that would recommend blocking access to “websites and services that are blatantly, overwhelmingly, or structurally engaged in piracy.”12 Ultimately, the CRTC rejected the proposal that year after determining that it lacked jurisdiction to implement the plan.

In January 2021, the CRTC launched a public consultation “to strengthen Canadians’ online safety” by blocking certain sites infected with botnets.13 The plan has come under fire by commentators,14 and submissions to the consultation process from a broad range of industry actors almost universally opposed it.15 In June 2022, the CRTC released an enforcement decision that confirmed botnets need to be regulated, provided a framework for doing so, and required a CRTC working group to present a plan to block such websites within nine months.16 After several months of gathering submissions,17 the working group presented a draft of this plan in April 2023, which advised blocking botnet command-and-control servers at the IP layer and ensuring that the blocking framework would not be used for criminal or political purposes. The framework did not provide specifics on how the blocking system would work, only general principles.18

B2 1.00-4.00 pts0-4 pts
Do state or nonstate actors employ legal, administrative, or other means to force publishers, content hosts, or digital platforms to delete content, particularly material that is protected by international human rights standards? 3.003 4.004

Nonstate actors, specifically large media companies, have used legal means to force digital platforms to delete content, generally for copyright infringement. However, 2018 legal amendments to the Copyright Act reduced the misuse of the law’s notice-and-notice regime.

The previous notice-and-notice regime required ISPs to forward notices from copyright holders claiming infringement to the alleged copyright violator (see B3). Several US–based antipiracy firms, including Rightscorp and CEG-TEK, used the system to send notifications to subscribers that misstated Canadian copyright law, citing US awards for damages and threatening the termination of internet access. The notifications sowed fear among Canadians, and many paid the settlement fees proposed in the notices.1 In 2018, Parliament passed amendments to the program to restrict the information that can be included in the notices, no longer allowing misstatements of Canadian law. Further, ISPs are no longer required to forward notices to subscribers if they contain an offer to settle the infringement claim, a request or demand for payment or personal information, or a URL linking to such offers or demands.2

Media companies have continued to use the courts to shut down and penalize operators of websites and other online services that redistribute their content in violation of copyright laws, or that offer services facilitating such activities. In November 2019, a group of media companies sought and obtained an order forcing ISPs to block certain websites that hosted copyright-infringing content, which was subsequently upheld by a court of appeal in May 2021 (see B1 and B3). During the previous coverage period, in February 2022, a long-running case between all of Canada’s major media companies and an owner of a website that distributed software facilitating online piracy, known as TVAddons, came to an end with a C$25 million ($19.6 million) settlement in which the owner admitted liability, and the offending site was shut down.3

In 2017, the SCC upheld the decision by the British Columbia Court of Appeal in Google, Inc. v. Equustek Solutions, Inc.,4 ordering Google to remove URLs in its global index pointing to websites that infringed on the plaintiffs’ trademark (see B3).

Defamation claims may also result in content removal, as content hosts fear potential liability as publishers of the defamatory content (see C3). Defamation claims may also prevent the posting of content, as the British Columbia Court of Appeal demonstrated in a 2018 case when it ordered a defendant not to post anything about the plaintiff and awarded damages.5 In 2018, the SCC ruled that a case involving the publication of defamatory content on an Israeli website against a Canadian resident should be heard in Israel rather than Canada, despite the fact that damages were incurred in Canada.6 In 2021, a British Columbia court came to the opposite conclusion, specifically that a defamation case against Twitter could proceed in Canada.7 More recently, a March 2022 court decision granted a temporary injunction against TikTok user Brooke Dietrich, ordering her to stop using the platform to advocate against antiabortion group 40 Days for Life and preventing others from reposting her content (see B8 and C3).8

In Quebec, where French is recognized as the only official language, websites that are commercial in nature are legally required to be in French,9 although they can also be in other languages. Violators may receive a warning from a government agency and are then subject to fines if they do not comply. Recent updates to the Quebec language law in the form of Bill 96, which became law in June 2022, have imposed even more onerous obligations on the use of French online, and provide for harsher fines.10 Some website operators may choose to take their sites down rather than pay for translation or face fines. National or international operators of websites that do business in Quebec (and would therefore be subject to the law) sometimes block Quebec residents’ access to their websites rather than comply,11 and at least one company temporarily halted e-commerce in Quebec as a result of Bill 96.12

B3 1.00-4.00 pts0-4 pts
Do restrictions on the internet and digital content lack transparency, proportionality to the stated aims, or an independent appeals process? 4.004 4.004

Restrictions on the internet are generally fair and proportionate. However, the new Online Streaming Act has raised potential concerns about the transparency and proportionality of internet content restrictions, though the full implications of the regulations had yet to be seen in practice during the coverage period.

The Online Streaming Act, also known as Bill C-11, which became law in April 2023, amends Canada's Broadcasting Act to allow the CRTC to regulate online streaming services (which are defined as "online undertakings") on par with traditional over-the-air broadcasters. The CRTC is empowered to enforce Canadian content (“CanCon”) regulations for streaming platforms by requiring them to promote content that originates in Canada and is created by Canadians, amounting to a significant expansion of the CRTC’s regulatory powers (see A5).1 The law allows the CRTC to impose regulations on streaming platforms regarding the proportion of Canadian programs to be broadcast and requires those services to make investments supporting the Canadian broadcasting system.2

The final law as passed did not include Senate amendments that would have explicitly shielded user-generated content from the law, raising significant concerns that the CRTC could potentially regulate such content.3 However, the government has consistently rejected claims that it intends to regulate user-generated content, such as videos uploaded to YouTube, under the law.4 After the coverage period, in June 2023, the Department of Canadian Heritage issued proposed regulations for how the CRTC should implement the new law. The proposed policy directs the CRTC to exclude social media creators from potential regulation and “only regulate social media platforms insofar as they are acting like broadcasters.”5 The effects of such regulations in practice remained unclear during the coverage period.

In August 2021, the government released a technical paper for its forthcoming harmful online content legislation (see C6).6 The proposed framework establishes a notice-and-takedown regime for online communications services (OCS) and online communications service providers (OCSP) to limit the spread of child sexual exploitation content, terrorist content, content that incites violence, hate speech, and the nonconsensual sharing of intimate images. Additionally, the framework for the law enables ISPs to block websites that have not removed child sexual exploitation or terrorist content.7 Significant monetary penalties for noncompliance by OCSs and OCSPs include administrative monetary penalties (AMPs) in line with recently proposed privacy laws (see C5).8 In 2022, the government assembled an expert advisory panel9 and held cross-country roundtables10 on the proposed online safety legislation, but the consultation process was criticized for a lack of transparency.11 As of May 2023, no legislation has yet been introduced.

Canada’s largest ISPs participate in Project Cleanfeed Canada, an initiative that allows ISPs to block access to child sexual abuse images that are hosted outside the country (as opposed to content hosted within Canada, which is subject to removal).12 Accessing child sexual abuse imagery is illegal in Canada under section 163.1(4.1) of the criminal code,13 as well as under international human rights standards.

Bill 74, Quebec’s controversial law requiring ISPs to block access to gambling sites, came into effect in 2016,14 but remains inoperative as a Quebec court declared the law unconstitutional in 2018, ruling online gambling a federal rather than provincial matter.15 In May 2021, the Quebec Court of Appeal upheld that ruling,16 and in March 2022, the SCC declined to hear the matter.17

In 2004, the SCC ruled that ISPs are not liable for copyright infringement violations committed by their subscribers,18 a principle now enshrined in law.19 Copyright law includes a notice-and-notice provision, in effect since 2015, which was amended in 2018 (see B2). No content is removed from the internet without a court order. Content may be ordered blocked at the ISP level by a court (see B1), and ISPs do not disclose subscriber information without court approval, although the granting of such approvals have become more common in recent years.20

The SCC’s ruling in Google, Inc. v. Equustek Solutions, Inc.—wherein Google was ordered to remove URLs in its global index pointing to websites that infringed on the plaintiffs’ trademark—was strictly focused on the law of intellectual property and interlocutory injunctions. Whether such worldwide orders may be granted in other areas of the law in the future, or whether they will have effect in foreign jurisdictions, is unclear.21

Although platforms are legally protected from liability for copyright infringement by their users, they may face liability for alleged defamation once they have been alerted to the publication of the ostensibly defamatory content.22 A court may also order the removal of such content. The SCC has held that merely linking to defamatory content on the internet is not defamation in and of itself; it would only be defamation if a site actually repeats the defamatory material. URLs in such cases would not be removed.23

B4 1.00-4.00 pts0-4 pts
Do online journalists, commentators, and ordinary users practice self-censorship? 4.004 4.004

Score Change: The score improved from 3 to 4 because there was no indication that Canadians engaged in significant online self-censorship during the coverage period.

Online self-censorship is not widespread. Certain individuals may self-censor for fear of potential government surveillance under Bill C-51, the Anti-Terrorism Act, which was reformed in 2019 (see C5). However, there was no indication that this had a chilling effect on online speech during the coverage period.

B5 1.00-4.00 pts0-4 pts
Are online sources of information controlled or manipulated by the government or other powerful actors to advance a particular political interest? 4.004 4.004

Online sources of information are not widely controlled or manipulated by the government or other powerful actors.

The government advanced legislation to combat disinformation and foreign interference in advance of the October 2019 federal election. The Election Modernization Act, which went into effect in June of that year, provides for a number of reforms, such as regulations on third-party online advertising and restrictions on how much campaigns can spend before a campaign season officially commences.1 In March 2021, certain provisions of the Election Modernization Act prohibiting misinformation about political candidates’ past criminal offenses and their place of birth were struck down by an Ontario Court as unconstitutional, because they violated the right to freedom of speech.2 In March 2022, a report by the Canadian Election Misinformation Project found that while there was a significant amount of false information spread on social media during the 2021 electoral period, the overall effects of mis- and disinformation were minimal.3

In recent years, the Canadian government has advanced several proposals and taken some action to target disinformation online, especially related to COVID-19 and the 2022 full-scale Russian military invasion of Ukraine, notably through its Digital Citizen Initiative, described as “a multi-component strategy that aims to support democracy and social inclusion in Canada by building citizen resilience against online disinformation.”4

B6 1.00-3.00 pts0-3 pts
Are there economic or regulatory constraints that negatively affect users’ ability to publish content online? 3.003 3.003

There were few economic or regulatory constraints on users’ ability to publish legal content online during the coverage period. However, the passage of the Online News Act after the coverage period may have significant consequences on this ability in the future.

In April 2022, the government introduced Bill C-18, the Online News Act,1 which requires digital news intermediaries, including Google and Meta, to negotiate agreements that compensate Canadian media companies for providing news content on the intermediaries’ platforms. In February 2023, open internet advocates raised concerns that Bill C-18 could facilitate restrictions on the online content available to Canadians and create economic barriers for new companies looking to enter the digital market.2 That month, Google reportedly blocked news content for some Canadian users, apparently in an effort to test compliance with the bill.3 In March, Meta announced that it would make all news content unavailable on Facebook and Instagram in Canada if the bill became law,4 a position the company reiterated in May.5

The Online News Act became law after the coverage period, on June 22, 2023.6 In response, Google announced on June 29 that it would remove links to Canadian news from search results in Canada once the law takes effect, after regulations had been established.7 Meta announced in early August that it had already begun restricting access to news content on Facebook and Instagram in Canada.8

Canada has strengthened its commitment to net neutrality as a matter of national policy, ensuring that ISPs present web content neutrally. In 2017, the CRTC enacted a pair of telecommunications policies that effectively prohibited differential pricing for some data services offered by ISPs and the zero-rating of certain media services, barring ISPs from offering such preferred media free of charge.9 With these policies, the CRTC has substantively completed a national framework that ensures the continuation of net neutrality. In a 2018 report, a parliamentary committee encouraged the government to strengthen net neutrality even further by enshrining the principle in the Telecommunications Act.10

In January 2020, the government released a detailed report from a legislative review panel on the future of Canada’s communications legislation, the result of a review initiated in its 2017 budget.11 Commentators have warned that the report, which focused heavily on content produced in Canada, may herald the weakening of net neutrality.12 However, the report itself included a commitment to the net neutrality principle.13

The Department of Canadian Heritage, in the wake of its own report, announced a deal with Netflix in 2017, in which the streaming service pledged to spend a minimum of C$500 million ($370 million) on Canadian productions over the next five years14 —a target that it had reportedly exceeded by 2019.15 Furthermore, the Online Streaming Act will require online undertakings to contribute to funding Canadian content (see B3). In its January 2020 review, the legislative review panel recommended that the national Goods and Services Tax (GST) should apply to “media communications services provided by foreign online providers,” reversing a previous decision to exempt Netflix from the tax.16 Measures to charge GST or Harmonized Sales Tax (HST) rates, depending on the province (a range of 5 percent to 15 percent) on digital businesses, including digital platform operators, came into effect in July 2021,17 after having been proposed in the government’s April 2021 budget18 and passed into law that June.19

In December 2021, the federal government proposed an additional “Digital Services Tax” (DST) where online companies with annual worldwide revenues of over €750 million ($777 million) would have to pay a 3 percent tax on their Canadian revenues, if those Canadian revenues are greater than C$20 million ($14.8 million).20 The DST would not come into force before 2024, but would apply retroactively as of 2022 if passed. By the end of the coverage period, the government appeared to be moving forward with the tax, despite complaints from US tech industry groups and opposition from US trade officials.21

Numerous provinces, including British Columbia, Quebec, and Saskatchewan, had already been levying provincial sales taxes for several years on out-of-province digital platforms, including Netflix, Google, Amazon, and, in Quebec’s case, Spotify.22 In December 2021, the Manitoba provincial government also added a sales tax,23 and in July 2022, the British Columbia government began to apply sales taxes to online marketplaces such as eBay.24

B7 1.00-4.00 pts0-4 pts
Does the online information landscape lack diversity and reliability? 4.004 4.004

The online environment in Canada is relatively diverse, and internet users have access to a wide range of news and opinions on a variety of topics. All major media organizations operate websites that feature articles and audio and video content. The public broadcaster maintains a comprehensive website that includes news articles and streamed video programming. Paywalls are increasingly used by newspapers publishing online, but many high-quality, independent news and commentary sites remain accessible for free. While some sites are partisan in nature, a wide array of political viewpoints are available online. Additionally, there are online media dedicated to the perspectives of Canada’s First Nations peoples1 and LGBT+ Canadians.2

Misinformation surrounding the COVID-19 virus was a significant issue in Canada throughout the pandemic,3 and Russian disinformation about the war in Ukraine has reportedly undermined Canadians’ ability to obtain accurate information about the war.4

There is a wide range of content available in both official federal languages (English and French), as well as many other languages.

The Online News Act, which became law in June 2023, after the coverage period, could facilitate restrictions on the news content available to Canadians on certain online platforms (see B6). Two months later, in August, Meta announced that it had started restricting access to news content on Facebook and Instagram in Canada.5 Such restrictions have the potential to significantly undermine the diversity of the online information landscape in the future.

B8 1.00-6.00 pts0-6 pts
Do conditions impede users’ ability to mobilize, form communities, and campaign, particularly on political and social issues? 6.006 6.006

Digital mobilization tools, including social media platforms and communication apps, are available and are used to build support for political and social movements. Much online activism that targets the information and communications technology (ICT) sector is spearheaded by a popular nonpartisan, nonprofit organization called Open Media, which advocates for three pillars of internet rights—free expression, access, and privacy.1

Canadians were especially active in the online #MeToo movement,2 which prompted the justice minister to consider updating laws to ensure victims of sexual violence are treated more compassionately in courtrooms.3 This online activism also influenced the government to introduce Bill C-65,4 which became law in 2018 and dramatically updated the legal framework for harassment as it applies to the federal government and federally regulated workplaces.5 Online activism likely played a role in the decision to legalize cannabis countrywide,6 which also went into effect in 2018. As the COVID-19 pandemic progressed, Canadians used the internet to help organize in-person protests once again, around issues ranging from Black Lives Matter7 to protests against mask mandates and other pandemic-related public health measures.8 The so-called “Trucker Convoy” of early 2022 in Ottawa was fueled by online activity, including crowdfunding efforts to financially support attendees.9

In March 2022, the Ontario Superior Court of Justice granted a temporary injunction against TikTok user Brooke Dietrich, ordering her to stop all activist activities on the platform against the antiabortion group 40 Days for Life; the case remained ongoing during the coverage period (see C3).10

C Violations of User Rights

C1 1.00-6.00 pts0-6 pts
Do the constitution or other laws fail to protect rights such as freedom of expression, access to information, and press freedom, including on the internet, and are they enforced by a judiciary that lacks independence? 5.005 6.006

The constitution includes strong protections for freedom of speech and freedom of the press. Freedom of speech is protected as a “fundamental freedom” by Section 2 of the Canadian Charter of Rights and Freedoms. Under the Charter, one’s freedom of expression is “subject only to such reasonable limits prescribed by law as can be demonstrably justified in a free and democratic society.”1 These protections apply to all forms of speech, whether online or offline. There are a few restrictions that apply to online speech (see C2).

C2 1.00-4.00 pts0-4 pts
Are there laws that assign criminal penalties or civil liability for online activities, particularly those that are protected under international human rights standards? 2.002 4.004

Users can face significant criminal penalties for some forms of online expression, as well as civil liability for defamation emanating from common law principles. Some provincial defamation laws and the general civil liability regime in Quebec also limit freedom of expression online.

Hate speech, along with advocating genocide and uttering threats and defamatory libel, are also regulated under the criminal code.1 Punishment for defamatory libel, advocating genocide, and uttering threats may include imprisonment for up to five years. Hate speech is punishable by up to two years in prison. Human rights complaints regarding potentially defamatory statements can be decided through the mechanisms provided by provincial human rights laws and the Canadian Human Rights Act (CHRA).2 However, the controversial provision of the CHRA prohibiting online hate speech (section 13), which was criticized for being overly broad, was repealed in 2013.3

In June 2021, the government introduced Bill C-36,4 which would have amended the criminal code to enable an individual to appear before a court if they are concerned that someone may commit an offense “motivated by bias, prejudice or hate based on race, national or ethnic origin, language, colour, religion, sex, age, mental or physical disability, sexual orientation, gender identity or expression, or any other similar factor.”5 The bill reintroduced the controversial provision of the CHRA prohibiting online hate speech and would also allow victims of hate speech to send formal complaints to the Canadian Human Rights Tribunal. However, the bill did not advance by the closure of the 43rd parliament in August 2021.6 In February 2022, the reelected Liberal government announced its intention to reintroduce similar legislation,7 but no such legislation had moved forward by the end of the current coverage period.

In January 2021, an Ontario court took the definition of defamation one step further when it recognized a common law tort of “internet harassment” to address the defendant’s online conduct and publications in Caplan v. Atas (see C3 and C7). In this case, the court defined “internet harassment” as “serial publications of defamatory material,” which are used to “harass, harry, and molest” the victim.8

Antispam legislation enacted in 2014 requires opt-in consent to send commercial electronic messages. Critics of the legislation have argued that it is overly broad and overregulates commercial speech. After the Federal Court of Appeal upheld the constitutionality of the law in 2020,9 in March 2021, the SCC refused to hear an appeal, effectively ending any constitutional challenge.10

C3 1.00-6.00 pts0-6 pts
Are individuals penalized for online activities, particularly those that are protected under international human rights standards? 6.006 6.006

Individuals were not arrested or prosecuted for online activities that are protected under international human rights standards during the coverage period, though courts have recently increased awards in online defamation cases.

Generally, writers, commentators, and bloggers are not subject to legal sanction for content that they post on the internet. Internet users are free to discuss any political or social issues without risk of prosecution, unless the discourse violates the hate speech provisions in the criminal code, or rises to the level of harassment, which is both a criminal offense1 and now an actionable civil tort in Canada (see C2 and C7).

Canadian courts take a proactive approach when hearing online defamation cases and are increasingly willing to grant large monetary awards in some cases. In January 2020, an Ontario judge issued significant awards for defamation against anonymous online defendants for only the second time in Canadian legal history.2 In October 2021, an Ontario court awarded C$50,000 ($37,000) each to two plaintiffs in a defamation suit against an individual who had initiated a social media campaign against them in 2020. The campaign began after the defendant saw screenshots from the plaintiffs’ Snapchat video that the defendant assumed mocked the May 2020 murder of George Floyd in the United States.3

More recently, in April 2023, an Ontario court awarded C$75,000 ($55,000) in damages to a labor union, determining that a former member defamed the union by claiming on Facebook that it had falsified the results of a COVID-19 vaccination survey.4 Also in April 2023, an Alberta court awarded C$300,000 ($222,000) in general damages for defamation, C$100,000 ($74,000) in general damages for harassment, and C$250,000 ($185,000) in aggravated damages to an employee of a regional health authority who had been repeatedly defamed and harassed by a former candidate for mayor of Calgary on his online talk show.5

In September 2022, an Ontario court rejected Brooke Dietrich’s motion to dismiss a defamation case brought against her by the antiabortion group 40 Days for Life in connection with a TikTok campaign that Dietrich had used to advocate against the group (see B8).6 Dietrich appealed the decision to dismiss her motion, and also challenged an injunction that prevents her from posting on TikTok (see B2).7 The case remained ongoing at the end of the coverage period.8

C4 1.00-4.00 pts0-4 pts
Does the government place restrictions on anonymous communication or encryption? 4.004 4.004

The government does not impose any restrictions on anonymous communication or encryption. Canadians are free to use encryption services and communicate anonymously online without any fear of civil or criminal sanction. In August 2019, the minister of public safety and emergency preparedness suggested that technology companies must actively combat the online exploitation of children, which he said is facilitated by encrypted communications.1 The comments followed a July 2019 communiqué, and preceded an October 2019 communiqué, from ministers in the “Five Eyes alliance”—five countries that maintain an intelligence operations agreement, including Canada—that criticized technology companies for providing encrypted products and limiting law enforcement access to those products.2 In October 2020, the Five Eyes joined the governments of Japan and India in requesting a “backdoor” for encrypted communications services.3 The joint statement expressed support for strong encryption while claiming that end-to-end encryption without a backdoor for law enforcement could undermine public safety.4

C5 1.00-6.00 pts0-6 pts
Does state surveillance of internet activities infringe on users’ right to privacy? 4.004 6.006

State surveillance of internet users under limited circumstances may infringe on privacy rights. In 2015, the government passed Bill C-51, the Anti-Terrorism Act, permitting information sharing across government agencies for a wide range of purposes, many of which are unrelated to terrorism. Several efforts to reform Canada’s antiterrorism laws have subsequently materialized, most recently with Bill C-59.

Bill C-59, an Act Respecting National Security Matters,1 was introduced in 2017 to address some of the more problematic provisions of the Anti-Terrorism Act,2 and was passed in June 2019.3 The law limits the broad criminal-speech provisions originally seen in Bill C-51. Bill C-59 is also meant to enhance parliamentary oversight through the creation of a National Security and Intelligence Review Agency and an Office of the Intelligence Commissioner.4 It still allows the government to engage in cyberoperations, but its powers to do so are more limited than what was provided for in Bill C-51.5 Civil society groups raised concerns that Bill C-59 does not fully address surveillance issues posed by previous legislation6 and still grants too much power to the government, including the ability to engage in mass data collection.7 In February 2021, judges began hearing related cases and have set limits on the government’s intelligence agency (CSIS), including its ability to spy on foreign countries.8

The Office of the Privacy Commissioner (OPC) provides an important oversight function concerning the privacy of users’ data. The privacy commissioner, Philippe Dufresne, is an officer of Parliament who reports directly to the House of Commons and the Senate. The commissioner’s mandate includes overseeing compliance with the Privacy Act,9 which covers the practices of federal government departments and agencies related to the handling of personal information.

A general right to privacy is not enshrined in Canadian law, though the Canadian Charter of Rights and Freedoms includes protections against unreasonable search or seizure, which are often interpreted as a right to privacy.10 This was demonstrated in 2020, when the Alberta Court of Appeal determined that a law that allowed for unrestricted searches of personal electronic devices by border agents violated this protection.11

In December 2021, Prime Minister Justin Trudeau announced his intention to propose legislation to strengthen privacy protections for users in the near future, provide for significant monetary penalties for noncompliance, and enable massive enforcement powers for the federal privacy authorities and a new privacy tribunal.12 The government had introduced a bill to this effect in 2020, Bill C-11, but it did not advance after the August 2021 closure of the 43rd parliament.13 The federal government is seeking to catch up with provincial privacy laws, notably the privacy reforms passed in September 2021 in Quebec that are similar to the General Data Protection Regulation (GDPR) of the EU.14

In June 2022, the government introduced Bill C-27, the Digital Charter Implementation Act, which generally presents the same framework as Bill C-11.15 In addition to the new privacy protections, Bill C-27 also includes the Artificial Intelligence and Data Act to introduce a regulatory framework for AI systems, which was not previously found in Bill C-11.16 The House of Commons completed a second reading of Bill C-27 in April 2023, which puts the potential passage of the bill relatively far in the future.17

The SCC has also expanded privacy rights relating to technology. Most recently, in 2018, the court ruled that privacy rights are still protected when a computer is shared with others.18 In 2017, the court extended the right to privacy to text messages in a pair of companion cases. First, the court held that there could be a reasonable expectation of privacy in received text messages, whereas previously, privacy protections only applied to sent messages.19 In the second case, the court held that the sender of text messages has a reasonable expectation of privacy, even when they are stored on the telecommunications provider’s computers.20 However, the SCC has not found a reasonable expectation of privacy on the internet in more egregious circumstances, for example in exchanges of Facebook messages and emails in relation to a police sting regarding the criminal luring of minors.21

In June 2022, the national police force disclosed its use of spyware to hack a suspect’s phones or laptop and collect data, including by turning on device cameras and microphones remotely. According to the Royal Canadian Mounted Police (RCMP), spyware is only used during serious criminal and national security investigations when less intrusive techniques are unsuccessful; its use always requires authorization from a judge. The force reported deploying spyware in 10 investigations between 2018 and 2020.22 In response to the disclosure, the Canadian Civil Liberties Association (CCLA) called for a moratorium on the RCMP’s use of spyware in August 2022.23 A report released by a parliamentary ethics committee in November 2022 recommended that the government create a list of banned spyware vendors and require government entities to submit privacy impact assessments prior to the use of “high-risk technological tools,” though it stopped short of reiterating calls for a spyware moratorium.24

The COVID-19 pandemic provided authorities with an opportunity to erode privacy rights. For example, the Ontario government’s April 2020 emergency order allowed it to share personal information in their possession with emergency response personnel, including police officers and paramedics.25 In August 2020, Ontario officials ended this information-sharing practice following a lawsuit from human rights organizations.26 The OPC’s annual report released in September 2022 reiterated the emphasis of the two previous years’ reports on the need for heightened privacy during the pandemic and the necessary reforms to privacy laws.27 In May 2023, the OPC published an investigation into whether the federal government’s health authorities overreached when analyzing Canadians’ cell phone location data during the pandemic. The investigation found that the public health authorities took adequate measures for the de-identification of personal data and implemented protections to prevent re-identification, determining that privacy complaints were unfounded and the Privacy Act had not been violated. However, the OPC also provided the public health authorities with several recommendations to strengthen privacy protections.28

C6 1.00-6.00 pts0-6 pts
Does monitoring and collection of user data by service providers and other technology companies infringe on users’ right to privacy? 4.004 6.006

Both ISPs and mobile service providers may be legally required to aid the government in monitoring communications of their users.

The OPC and the Privacy Commissioner oversee compliance with the private sector privacy law,1 the Personal Information Protection and Electronic Documents Act (PIPEDA).2 PIPEDA was modified by the Digital Privacy Act,3 passed in 2015, which expanded the scope for companies to make voluntary warrantless disclosures of personal information under certain circumstances by allowing for such disclosures to be made to any organization, not just law enforcement. The act also established new mandatory security breach disclosure requirements, which came into force in 2018.4 PIPEDA, however, remains relatively powerless. A privacy protection bill presented in June 2022 (see C5), which would implement a new Consumer Privacy Protection Act to replace PIPEDA, includes significant fines for non-compliance with the bill’s data protection framework, similar to penalties found in the GDPR.5

The OPC continues to call for changes to the Privacy Act6 —notably, to require mandatory data-breach reporting by the government—which has not been significantly amended since 1983. The commission argues that the act is outdated, does not reflect current digital privacy concerns, and allows the government too much latitude to collect personal information.7

The OPC shocked the legal community in 2018 when it released a draft position paper concluding that PIPEDA contained a European-style “right to be forgotten” provision.8 Commentators questioned the OPC’s conclusions and reasoning.9 In 2018, the OPC submitted a reference question to the Federal Court to clarify whether indexing web pages and presenting results about a person’s name in Google’s search function fall under PIPEDA, which would support their right to be forgotten position. In July 2021, the Federal Court issued its decision and stated that indeed Google search falls under PIPEDA.10 Google appealed the decision in September 2021; the court has not yet rendered a decision as of the end of the coverage period.11

The OPC conducts investigations into major data breaches and other matters to determine whether private companies comply with PIPEDA. In the OPC’s investigation into the Cambridge Analytica scandal—wherein Cambridge Analytica improperly accessed the personal data of Facebook users—Facebook refused to take significant corrective measures or implement the OPC’s recommendations.12 In February 2020, the OPC filed an application with the Federal Court seeking a declaration that Facebook had violated PIPEDA and an order requiring Facebook take corrective action.13 In April 2023, the Federal Court ruled that Facebook had not violated PIPEDA;14 however, the OPC is appealing the decision.15 In another case from December 2021, the OPC found that Clearview AI had violated PIPEDA by scraping images from the internet without consent and sharing them with law enforcement. However, the OPC passed on enforcement of the relevant provisions of PIPEDA to provincial counterparts,16 demonstrating the law’s weakness. In January 2023, the OPC found that Home Depot had disclosed customers’ email addresses and purchase habits to Facebook without individuals’ consent, contrary to PIPEDA.17

Numerous court decisions have made it easier for Canadians to seek legal redress against foreign internet companies for privacy violations. In a landmark 2017 decision, the SCC ruled that residents of British Columbia could bring a class action suit against Facebook for violating certain privacy rights in a British Columbia court, despite Facebook’s choice-of-forum clause specifying California.18 Other courts followed up on this decision, with a Quebec court deciding that Yahoo’s choice-of-forum clause was inoperative, as its terms and conditions were deemed to be a consumer contract that granted jurisdiction to Quebec.19 While Yahoo’s choice-of-forum clause specified another Canadian province (Ontario) and not another country, the court’s reasoning could clearly apply internationally. In a significant 2017 decision, the Federal Court found that PIPEDA has extraterritorial application, and ordered a Romanian website to remove court decisions that contained easily searchable personal information of Canadian citizens. The site was ordered to never post such information again,20 and the court ordered the website to pay damages to the plaintiff.

The technical paper for harmful online content (see B3),21 which was introduced in August 2021, mandates that OCSPs retain data about individuals who might have shared harmful content and may be obligated to share this data with law enforcement.22

C7 1.00-5.00 pts0-5 pts
Are individuals subject to extralegal intimidation or physical violence by state authorities or any other actor in relation to their online activities? 5.005 5.005

There were no documented cases of violence or physical harassment in retaliation for online activities during the reporting period. However, cyberbullying, cyberstalking, and general online harassment, particularly affecting young people, is on the rise.1 A government study released in February 2023 found that one-quarter of Canadian teenagers experienced cybervictimization; however, some groups reported experiencing higher rates of cybervictimization, with over 50 percent of nonbinary teenagers reporting such harms.2

Women, including journalists, activists, and politicians, have also reported facing online intimidation and misogynistic messages. A 2020 survey found that 62 percent of Canadian women aged 15 to 25 have been harassed or abused online.3 Media reports from August 2022 noted a recent intensification in such threats against women. Women journalists, especially women journalists of color, shared anonymous emails that they had received containing threats of violence and sexual assault and misogynistic and racist language.4

The highly praised 2016 landmark civil court decision—in which a man was ordered to pay C$100,000 ($74,000) to his former partner for publishing intimate videos of her without her consent, causing severe emotional distress—has grown in significance in recent years.5 Though the details of this case remained in flux following the early 2016 decision,6 the privacy tort of “public disclosure of private facts” that the judge’s original decision established has since been adopted in several courts. The new tort was applied in a 2018 case, in which an individual was found liable for posting a sexually explicit video of a person without their consent on a pornographic website; they were ordered to pay C$100,000 ($74,000) in damages.7 The new tort was also applied in a different province for the first time in September 2021, when the Court of King’s Bench of Alberta (then the Court of the Queen’s Bench) used the tort in awarding C$185,000 ($137,000) in damages to a victim of nonconsensual distribution of intimate images.8

The 2016 case continues to be cited by other plaintiffs, authors, and courts.9 The Saskatchewan Court of King’s Bench, for instance, first recognized the tort of “public disclosure of private facts” in a September 2022 decision, awarding damages of C$160,000 ($118,000) to a victim whose husband uploaded intimate images of her to a pornographic website without her consent.10 Further, the recently established tort of “internet harassment” (see C2 and C3) could in theory also find relevance in these cases. There are also increasing calls for tech companies to take aggressive action in removing private material published without consent11 and to face criminal penalties should they not do so.12 Pornhub, a Montreal-based pornography platform, has faced numerous lawsuits in Canada and the United States accusing it of profiting from underage nonconsensual intimate images.13 In October 2021, the company settled one lawsuit in the United States brought forward by 50 women plaintiffs who alleged that the platform had knowingly partnered with a pornography provider that uploaded sexually explicit videos of the plaintiffs without their consent.14 These issues have been brought to the forefront again in light of Pornhub’s March 2023 sale to a Canadian private equity firm,15 as well as a Netflix documentary released around the same time as the sale.16

Additionally, many provinces, including Manitoba17 and Alberta,18 have previously passed laws that create civil torts for unauthorized distribution of intimate images and videos, and British Columbia also enacted legislation to do so in March 2023.19 Individuals are still prosecuted under Section 162.1 of the criminal code, which makes it a crime to publish, distribute, transmit, or sell intimate images without the consent of the person depicted.20 By December 2019, Canadian police forces had received nearly 5,000 complaints since nonconsensual sharing of intimate material was federally criminalized in 2014.21 In 2022 alone, there were 2,524 criminal incidents of nonconsensual distribution of intimate images in Canada.22

C8 1.00-3.00 pts0-3 pts
Are websites, governmental and private entities, service providers, or individual users subject to widespread hacking and other forms of cyberattack? 2.002 3.003

Cyberattacks and data breaches have become a serious issue in Canada, generally rising in number every year. During the 2021–22 period, the OPC received 645 data breach reports under PIPEDA, a decrease from the previous reporting period—the first in several years—that affected at least 1.9 million Canadian accounts.1 Despite the decrease, the OPC still considers data breaches a “significant area of concern.”2 Since a PIPEDA requirement that private companies report data breaches to the OPC came into effect in 2018 (see C6), the number of reports of such breaches has increased by 600 percent, according to the 2020–21 annual report.3 Whether the number of breaches is actually increasing or the mandatory reporting requirement has led to more accurate data is unclear; however, it is generally felt that cybercrime in Canada is still a bigger problem than the statistics reveal due to underreporting.4

Certain federally regulated industries are not covered by the mandatory breach reporting requirements found in PIPEDA. To fill this hole and provide for a more secure infrastructure generally, in June 2022 the federal government advanced Bill C-26, which would enact the Critical Cyber Systems Protection Act (CCSPA).5 The legislation would create new cybersecurity regulations, such as mandatory breach reporting and requirements to create cybersecurity programs, for critical infrastructure designated ”vital services” or “vital systems,” including telecommunications, energy, finance, and transportation.6 Analysts have noted that CCSPA is unprecedented because it would impose mandatory breach reporting requirements in the context of national security, rather than personal data protection, as is the case under PIPEDA.7 The bill completed its second reading in the House of Commons in March 2023.8

Statistics Canada reported that 70 percent of internet users suffered some sort of cybersecurity incident during 2022, up from 58 percent in 2020.9 About one-fifth of Canadian businesses were impacted by cybersecurity incidents in 2021,10 when the financial cost of data breaches to businesses hit an all-time high.11 A 2022 survey by the Canadian Internet Registration Authority (CIRA) indicated that 29 percent of respondent organizations had experienced a breach of customer or employee data, or both, within the previous year.12

In March 2022, a University of Toronto–based Citizen Lab report on digital transnational repression in Canada found that foreign dissidents and activists living in Canada, after fleeing their countries of origin to evade repression, had increasingly been the targets of hacking and phishing attempts and experienced takeovers of their social media and email accounts in recent years. Some reported having cut off contact with friends and relatives in their countries of origin out of concern for their safety in the face of such attempts.13

Major Canadian companies have recently been subject to cyberattacks and data breaches. In November 2022, the Sobeys grocery chain was the victim of an unspecified cyberattack—reportedly ransomware—that it estimated would cost C$25 million ($18.48 million) in losses. The attack closed the store’s pharmacies for four days and disrupted other services for about a week.14 In early 2022, an IKEA Canada data breach affected almost 100,000 Canadians.15 The OPC continues to find that Canadians are affected by international data breaches, including most recently by data breaches at MGM Resorts International and Marriott International.16

In a 2020 report, the government’s Centre for Cyber Security report cited state-sponsored actors from China, Russia, Iran, and North Korea as the greatest strategic cybersecurity threats to Canada.17 According to Microsoft’s Digital Defense Report, Canada was the third most-targeted country for Chinese and Russian state or state-linked attacks between July 2021 and June 2022, trailing only the United States and United Kingdom.18 Ransomware attackers have increasingly targeted critical infrastructure, emergency medical services, and law enforcement agencies in recent years.19

In December 2022, Amnesty International Canada announced that it was the victim of a suspected Chinese state-sponsored cyberattack two months earlier, in October. The attack was reportedly intended to surveil the work of the organization and to obtain personal information about the individuals who collaborate with it.20 Amnesty stated that no donor or membership data had been breached in the attack.21

Cyberattacks and data breaches have also affected federal government agencies and actors in recent years. In August 2020, the Canada Revenue Agency (CRA), the federal department that oversees taxation and other financial services, suffered multiple significant cyberattacks that compromised the usernames and passwords of thousands of online accounts,22 which led the CRA to lock out 800,000 Canadians from their accounts as a precautionary measure in March 2021.23 In August 2022, the Federal Court granted the certification of a class of victims of the data breach, allowing a class action lawsuit against the CRA and other government departments to move forward.24 The OPC reported that breach reports received from the public sector had risen from 280 in 2020–21 to 463 during the 2021–22 fiscal year, an increase of 65 percent.25 Even the computer system of the governor general (Canada’s official head of state) was hacked during the previous coverage period.26

On Canada

See all data, scores & information on this country or territory.

See More

Country Facts

  • Global Freedom Score

    98 100 free

  • Internet Freedom Score

    88 100 free

  • Freedom in the World Status

    Free

  • Networks Restricted

    No

  • Websites Blocked

    No

  • Pro-government Commentators

    No

  • Users Arrested

    No