The Office of the Information and Privacy Commissioner of Ontario has been proactive with its business and consumer support during Commissioner Patricia Kosseim's first five-year term. Kosseim told attendees at the IAPP Canada Privacy Symposium 2025 the IPC's initiatives and support system will only grow as she moves into her second term.
With the building blocks in place, Kosseim said the IPC is equipped to tackle and play a role in "five futures" that will cement provincial and federal privacy standards for years to come. The focuses include harmonized Canadian privacy laws, privacy's environmental impacts, children's privacy, sustaining the privacy profession and growing the IPC's impacts.
Each of the core imperatives requires cooperation across the IPC, lawmakers, businesses and consumers, and Kosseim indicated the unison will make the difference in the ever-changing digital economy.
"We live in a data-driven world propelled by AI that may feel very scary and overwhelming at times," Kosseim said in her closing keynote remarks. "But we can't give up the good fight. By collaborating, being flexible in our approach, and stepping forward with courage and perseverance, we can shape better outcomes and help build a better future."
Case for harmonization 'never been stronger'
Efforts to align Canada's federal and provincial privacy statutes predate Kosseim's first term, but she has played witness to the peaks and valleys of the process in recent attempts.
Ontario joined Quebec in completing meaningful changes to its provincial privacy law through the Strengthening Cyber Security and Building Trust in the Public Sector Act. The bill, which earned royal assent November 2024, brought significant updates to provisions of the Freedom of Information and Protection of Privacy Act while raising new cybersecurity and artificial intelligence requirements.
Other provinces have not moved as quickly on reform, and the same can be said about federal reforms to the Personal Information Protection and Electronic Documents Act.
The Parliament of Canada stood up and considered different PIPEDA reform vehicles in recent years that each failed. The latest attempt with Bill C-27 fell short as federal elections cleared the legislative docket.
Kosseim said the uncertainty around global trade and social policies creates a domestic policy rethink that privacy laws can be a part of. She indicated the "case for harmonized privacy laws has never been stronger," with provisional differences and "glaring gaps" within the patchwork making business compliance "needlessly complex."
She stressed the importance of provincial and territorial interpretation remaining in place, but advocated for federal floor to create certainty for businesses and consumers alike.
"There's an economic burden to regulatory compliance across provincial borders, and in some cases, an opportunity cost in having to forgo markets altogether," Kosseim said. "We do need a basic common canvas to work from if we want to empower innovation, investment and trust in our digital economy."
Children front and center
Kosseim touted the IPC as a "steadfast champion" for children's privacy rights during her first term.
Efforts to ensure protections is one aspect of the IPC's children's work, but its privacy education initiatives are also making waves.
The Privacy Pursuit lesson plans are a joint project from the IPC and MediaSmarts that "help educators teach students in Grades 2 through 8 about why privacy is important and how to protect their privacy online." Also being integrated into schools is a digital privacy charter that Kosseim described as "12 clear commitments for schools to help empower students to make informed privacy choices."
Kosseim added the charter applies to educators and schools as well, with wide adoption being essential to prevent incidents like the recent PowerSchool data breach sweeping through Canadian schools.
"Now is the time for education leaders to courageously step forward and sign on to this charter to make these protections a reality," she said.
Advice to the profession
While in the midst of a transition period to her second term, Kosseim only asked IPC staff to "start thinking about the next tranche of big, bold ideas" to keep its offerings "fresh, modern and innovative."
Concepts for next steps will depend on strong input from privacy professionals doing the work on the ground. Kosseim stressed flexibility and education among professionals, to the extent of collecting a spectrum of knowledge and experiences.
"Don't be afraid to take a non-linear path," she said. "If an exciting opportunity comes up in another department, organization or even sector that will give you a different vantage point on privacy issues you really care about, don't dismiss it just because it's not a step up the organizational chart."
Joe Duball is the news editor for the IAPP.
