#canadianprivacy — Public Fediverse posts

Quebec's public sector privacy law names two parties an organization must notify after a breach: the Commission d'acces a l'information, and each person affected.

The timing requirement is "avec diligence". No number of days appears anywhere in the section. It also lets notice to individuals wait while a criminal investigation would be hindered.

Nothing in it attaches to telling the public. And in May 2025 the Commission stopped publishing its list of reported incidents.

So when the Commission de la construction du Quebec was attacked on 24 August 2026:

26 Aug, the CCQ says publicly it was attacked, and cannot yet say what was taken.
1 Sep, the ransomware group lists it on their leak site.
4 Sep, the CCQ names the group.
11 Sep, letters to affected people start going out.
14 Sep, reporters find passports and bank statements on the leak site.

Only the letters are in the statute.

https://cyberdoubts.com/teardowns/the-law-names-who-you-have-to-tell/

#CanadianPrivacy #infosec #Quebec

There is a law in force in Canada right now that cannot yet identify the organizations it binds.

That is not a criticism of the drafting. Phased coming into force is normal. It does leave everyone in an odd spot: the Act is law, and the substantive obligations wait on an order that has not been made.

https://cyberdoubts.com/teardowns/bill-c8-part-2-whats-still-undecided/

#CanadianPrivacy #cybersecurity #Canada

Most coverage of Bill C-8 stopped at royal assent, as though assent was the event.

The part that decides who the Act actually binds sits further down, in language nobody quotes: the definition of a designated operator, and the schedule that is supposed to list them.

Schedule 1 names six sectors. Schedule 2, where the classes of designated operator go, is empty in the enacted text. Designation arrives later, by regulation.

So an organization reading the Act today can see the sector it works in and still not learn whether the obligations apply to it.

https://cyberdoubts.com/teardowns/bill-c8-what-the-cyber-security-act-actually-requires/

#CanadianPrivacy #cybersecurity #Canada

The barcode on the back of a Canadian driver's licence is not one bit of information.

It is the whole record: name, date of birth, address, document number, expiry, and in some provinces sex and postal code. A scanner reads all of it, because that is what scanners do.

153 million of those scans are for sale. Per Krebs, a search of the service returns approximately 1.1 million Canadian results.

The part nobody is covering: a Canadian regulator documented this exact failure in 2021, and most of the country has no regulator that can order anyone to fix it.

https://cyberdoubts.com/teardowns/nobody-asks-what-happens-after-the-scan/

#privacy #CanadianPrivacy #PIPEDA

Hello, and an introduction since the account is new.

I write cyberdoubts.com: breach teardowns, CVE reactions, and the Canadian regulatory half that US-written security commentary leaves out. Bill C-8 and the CCSPA, PIPEDA and the provincial privacy patchwork, CCCS advisories.

Pseudonymous because I work in security and keep the two separate. Every claim traces to a public source, archived at capture, and I say plainly when something is not verified rather than filling the gap.

#introduction #infosec #CanadianPrivacy

📎 Meet my new profile icon: Clippy the Paperclip! 🖇️✨

You might recognize this little guy from the ‘90s, but Clippy’s back—and this time, he’s a symbol of resistance! 🛠️💙 Inspired by Louis Rossmann, Clippy has become the mascot of a growing digital rebellion against Big Tech’s planned obsolescence, surveillance, and the "shitification" of everything we love. He’s here to remind us that tech should serve people, not the other way around.

I personalized mine with a blue beret. That’s my little wink to Blue Beanie Day—and web accessibility—to make the internet work for everyone. (Because yes, even the revolution needs to be inclusive! 😉)

P.S. If anyone knows how to add alt text to profile pics, let me know—I’d love to have an image description in my profile!

P.P.S. 📎 To fight against Big Tech's "shitification" and advocate for the right to repair and personal ownership, visit fulu.org/newsletter

📎 To get information on how to repair products you own and choose privacy-respecting and consumer-friendly products for your next purchase, visit https://consumerrights.wiki/Main_Page

#ClippyRebellion #RightToRepair #DigitalRights #PrivacyMatters #A11y #BlueBeanieDay #TechForGood #FixItDontTossIt #AntiSurveillance #WebForAll #RightToRepair #digitalrights #privacy #cybersecurity #freedom #StopChatControl #NoMassSurveillance #SavePrivacy #TechPolicy #ActNow #clippy #AntiObsolescence #TechForGood #SustainableTech #ConsumerRights #FixItDontTossIt #RepairRevolution #EthicalTech #PrivacyMatters #DIYRepair #ConsumerPower #BuyItForLife #DigitalPrivacy #EUtechPolicy #PrivacyIsARight #OSA #StopBillC2 #NoMassSurveillance #CanadianPrivacy #StopSwissSpying #PrivacyNotParanoia #NoBigBrotherCH #DemokratieStattÜberwachungsstaat #Überwachungsstaat