U.S. privacy rules vs Canadian law, a guide for cross-border newsrooms

What to take away

Why the two countries built privacy law differently

Congress never passed one statute covering all personal data. It passed laws industry by industry: health records, credit files, children's data, financial records. That is what reporters mean by sectoral U.S. privacy law. Your obligations follow the data, not the country.

The Federal Trade Commission fills part of the gap. It polices privacy promises as unfair or deceptive practices. The agency's privacy and security guidance describes what it expects from businesses. That matters when a company holding a source's data made a public promise about how it would handle it.

States fill the rest. California's consumer privacy law is the broadest. New York's SHIELD Act covers data security. Illinois' biometric law has produced litigation touching newsroom vendors. Texas, Florida, Virginia, Colorado and Connecticut have their own statutes.

Canada went the other way. One federal statute, PIPEDA, applies to private-sector organizations nationwide. The Office of the Privacy Commissioner of Canada summarizes the law and its provincial counterparts. British Columbia, Alberta and Quebec have private-sector laws deemed substantially similar.

So the framing question changes at the border. In the U.S. you ask which sector and which state. In Canada you ask whether PIPEDA or a provincial law governs, then check for provincial additions.

That difference shapes how you request records and how you store what you get. It is also a clean case of policy tools compared, because a statute and a regulator's guidance carry different weight.

PIPEDA: consent, purpose, safeguards, accountability

PIPEDA governs organizations that collect, use or disclose personal information in commercial activity. The Office of the Privacy Commissioner of Canada details PIPEDA's requirements and how they operate in practice.

Consent is the center of it. An organization needs meaningful consent for each purpose, and the purpose must be one a reasonable person would accept. Consent can be implied in low-risk situations, but the purpose still has to be stated.

Purpose limitation follows. Data collected for one purpose cannot be quietly reused for another. If a Canadian company handed a newsroom a dataset, ask what the company told people it was collecting for.

Accountability is the fourth piece. An organization must name someone responsible for compliance, protect the data with safeguards, and publish its policies. That paper trail is requestable.

PIPEDA has a journalistic purposes exception, and it is narrow. The Office of the Privacy Commissioner of Canada explains privacy obligations for businesses, which shows where newsgathering may sit. Do not treat it as blanket immunity.

Individuals can also demand to see what an organization holds about them. The Office of the Privacy Commissioner of Canada explains how individuals access personal information held by organizations. That request can surface what a company collected about your source. Standard government policy reporting habits apply: read the statute, not a summary of it.

Quebec Law 25 raises the bar

Quebec Law 25 modernized the province's private-sector privacy law and is being phased in. For a U.S. newsroom with Quebec sources or vendors, it is the most demanding regime in the country.

Consent has to be clear, free and informed, and requested separately for each purpose in many cases. Bundling permissions into one checkbox does not meet the standard. Individuals gain stronger access, correction and deletion rights, and some projects require a privacy impact assessment before they start.

The transfer rule is the one that catches newsrooms. Before personal information leaves Quebec, the organization must assess whether the destination offers comparable protection. If it does not, the organization adds safeguards or obtains consent. The assessment is documented and can be requested.

That rule reaches service providers. A Quebec organization using a U.S. cloud provider needs a written agreement with comparable protections. Your own publishing tools can trigger the obligation if they process Quebec data.

Enforcement gives Law 25 teeth that PIPEDA often lacks. Quebec's privacy commission can investigate and impose penalties. Treat Quebec data as high-risk and write down how you handled it.

Cross-border transfers: where the rules diverge most

Under PIPEDA, an organization stays accountable for personal information after it transfers the data to a third party, including a foreign one. The Office of the Privacy Commissioner of Canada expects contractual or other means to protect it. A Canadian company sending data to a U.S. newsroom should have a contract in place.

Quebec requires the comparability assessment described above. The destination's law is the test, not the contract alone. Many U.S. sectoral statutes do not meet it, so the Quebec organization must add safeguards or get consent.

U.S. law mostly does not restrict outbound transfers. HIPAA governs business associates handling health data. The Gramm-Leach-Bliley Act sets safeguards for financial data. A newsroom holding general personal data from the U.S. faces few transfer limits.

That asymmetry is the practical trap. A Canadian source's data may carry transfer conditions while a U.S. source's data does not. When data crosses the border, the stricter rule governs the whole set.

State law adds a thin layer. California gives consumers rights over their data, with journalism exemptions in many cases. Washington and Illinois are narrower still. When you weigh what a regulator's letter actually decides, a court reporting guide is a useful frame.

Breach notification: trigger, clock, recipient

PIPEDA requires an organization to report a breach to the Privacy Commissioner of Canada when it poses a real risk of significant harm, and to notify affected individuals. The clock is "as soon as feasible" after the organization determines a breach occurred. It also must keep records of every breach, reportable or not.

Quebec Law 25 requires notice to the province's privacy commission and to affected individuals when the breach poses a serious risk of harm. The law expects action without unreasonable delay. Read that as hours or days, not weeks.

U.S. federal law sets no general breach notification duty. HIPAA has its own rule for covered entities. The FTC can act when a company misstates its security, and its guidance for businesses describes those expectations.

State statutes fill the gap. Every state has a breach notification law, with different triggers and clocks. California, New York, Texas and Florida require notice without unreasonable delay. Some states name a fixed number of days, commonly 30 or 45.

If your newsroom holds Canadian data, a breach of your systems can trigger Canadian duties. You may owe notice to a Canadian regulator and to individuals, not only to U.S. authorities. Build the incident plan to the shortest applicable clock and keep your assessment in writing.

Access and correction rights

Under PIPEDA, an individual can ask an organization what personal information it holds about them. The organization must respond within 30 days, with limited extensions allowed. If the record is wrong, the individual can ask for correction, and the organization must correct it or annotate the file.

Quebec Law 25 keeps the 30-day window and adds a right to request deletion in some cases. Those rights shape how you handle a correction demand from a source.

In the U.S. the rights are sectoral. The Fair Credit Reporting Act lets consumers see credit files. HIPAA lets patients see health records. The Privacy Act covers federal agencies. No general federal law gives access to private-sector data.

States are moving. California, Virginia, Colorado and Connecticut give consumers rights to know, delete and correct. Journalism is often exempt or partly exempt.

Access rights double as a reporting tool. If a source wants to know what a company holds, the source files the request. The reply can confirm a leak and add detail. A clear court story checklist helps you separate a company's assertion from a regulator's finding.

Comparing the two regimes

Before you handle a cross-border dataset:

Worked example: a leaked Quebec dataset

A U.S. newsroom receives a dataset from a Quebec company. It holds names, emails and health details. Under Law 25, the company should have assessed whether the destination offered comparable protection before the data moved. The newsroom verifies what people were told at collection and whether publication serves a public interest.

If the newsroom's own systems are breached, Quebec's commission and affected individuals may need notice, and California or New York law may apply to sources living there. The shortest clock governs.

For access, a source can ask the Quebec company what it holds. The company answers within 30 days. That reply can confirm the leak and give the newsroom a second source of detail.

Two regulators, two sets of powers

Do not conflate the FTC and the Privacy Commissioner of Canada. The FTC can sue over deception. The Canadian commissioner investigates and reports, and under PIPEDA often lacks direct fining power. Quebec's commission can impose penalties.

Use precise labels. Write "sectoral U.S. privacy law" for the American approach. Name PIPEDA or Quebec Law 25 for Canadian rules. Before treating a regulator's letter as a finding, confirm what kind of official document you hold. Guidance, a complaint decision and a court ruling carry different weight.

Privacy rules keep moving. Quebec Law 25 is still phasing in and states keep legislating. Check the FTC and Privacy Commissioner sites before you publish, and put a review date in the file.

Common questions

Does PIPEDA apply to a U.S. newsroom?

PIPEDA covers organizations that collect personal information in commercial activity in Canada. A U.S. outlet with Canadian operations, Canadian vendors or Canadian sources may fall inside it. Check whether the specific activity is commercial and whether the journalistic exception reaches it.

What is the core difference between sectoral U.S. law and Canada's omnibus approach?

U.S. law covers named industries and adds state statutes, leaving gaps between them. Canada applies one federal statute to most private-sector organizations, with provincial laws layered on top. Coverage is broader in Canada and more fragmented in the U.S.

When must a breach be reported under Quebec Law 25?

Quebec requires prompt notice to the province's privacy commission and to affected individuals when a breach poses a serious risk of harm. The law expects action without unreasonable delay. Treat the clock as urgent and document your assessment.

Can a source see personal information a Canadian company holds?

Yes. Under PIPEDA and Quebec Law 25, an individual can request access to their personal information, and the organization must respond within 30 days. The individual can also ask for correction, and under Quebec law for deletion in some cases.