Canada: Introduced Digital Charter Implementation Act 2022 including cybersecurity regulation

On 16 June 2022, the Digital Charter Implementation Act 2022 was introduced in the Canadian House of Commons. The Act consists of three parts, named the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act respectively. It contains extensive regulations amending Canada's cybersecurity regime, primarily contained in the Consumer Privacy Protection Act. The cybersecurity regulations apply to all entities collecting personal information for commercial purposes, requiring them to establish physical, organisational, and technological safeguards to protect personal information under their control. The level of protection would need to be proportionate to the sensitivity of information, as well as the quantity, format, distribution, and means of storage of the information. Personal information must be protection against a number of types of breaches, including theft, unauthorised access, and loss. Breaches that reasonably create a real risk of significant harm to individuals must be reported to the Privacy Commissioner and the individual concerned.