Privacy, AI governance, and Law 25 insights from Mohammad Movahedi, CIPP/C – Data Privacy & AI Governance Consultant, Toronto.https://movahedi.ca/https://movahedi.ca/insights/bill-c34-house-debate-age-verification-gap/https://movahedi.ca/insights/bill-c34-house-debate-age-verification-gap/Three days of House debate left Bill C-34's under-16 social media ban with a new label, the 'earned exemption model', and the same mechanics: a ban that starts before the regulator exists, no exemption criteria, and age verification for millions of Canadians. What the debate record means for privacy teams before committee hearings open November 16.Fri, 06 Nov 2026 00:00:00 GMTPrivacyBill C-34Safe Social Media Actage verificationDigital Safety CommissionHouse of CommonsCharter statementHeritage CommitteeCanadahttps://movahedi.ca/insights/nsira-dnd-caf-open-source-intelligence/https://movahedi.ca/insights/nsira-dnd-caf-open-source-intelligence/On October 29, 2026, NSIRA published its review of DND and Canadian Armed Forces open-source intelligence on the internet: the collection is lawful, but the paperwork is not. Fifteen people-data providers went unevaluated, risk assessments went stale, and collection was not tied to approved operations. What the five findings mean for any team running OSINT.Thu, 05 Nov 2026 00:00:00 GMTPrivacyNSIRAOSINTopen-source intelligencepublicly available informationDNDCanadian Armed Forcesnecessitythird-party providersCanadahttps://movahedi.ca/insights/opc-bill-c22-subscriber-production-order/https://movahedi.ca/insights/opc-bill-c22-subscriber-production-order/On November 2, 2026, Privacy Commissioner Philippe Dufresne told the Senate national security committee that Bill C-22's new subscriber information production order is too wide: narrow the definition, limit who can be compelled, or at least carve out medical and privileged records. What the three asks change for your vendor and request-handling files.Wed, 04 Nov 2026 00:00:00 GMTPrivacyBill C-22Lawful Access Actsubscriber informationproduction orderPhilippe DufresneOPCSenateR. v. SpencerCharterCanadahttps://movahedi.ca/insights/poppy-explained-without-the-protocol-tone/https://movahedi.ca/insights/poppy-explained-without-the-protocol-tone/On November 2, attackers using AI agents reached GitBook's infrastructure, and the questions visitors had typed into its AI assistant may have been reached too. That is the exact failure Poppy is designed to make impossible: no names, no accounts, no stored questions. How a zero-PII agent help desk works, and why 90 days is a promise you can keep.Wed, 04 Nov 2026 00:00:00 GMTAI GovernancePoppyAI agentsprivacy by designoffice hoursAI GovernanceCanadaMCPzero PIIhttps://movahedi.ca/insights/openai-community-safety-report-vendor-diligence/https://movahedi.ca/insights/openai-community-safety-report-vendor-diligence/In an October 30 announcement, OpenAI committed to a biannual Community Safety Report starting in early 2027 and moved teen protections upstream: no practical weapons or security-system information for under-18 accounts even without violent intent, and a model that can end its own chats when it detects fixation on violence. What the new transparency artifact means for your AI vendor files.Tue, 03 Nov 2026 00:00:00 GMTAI GovernanceOpenAIChatGPTteen safetyCommunity Safety Reportage predictionAI governancevendor due diligenceweapons contentCanadachildren's privacyhttps://movahedi.ca/insights/canada-eu-digital-trade-agreement/https://movahedi.ca/insights/canada-eu-digital-trade-agreement/On October 30, 2026, Canada concluded its first Digital Trade Agreement with the EU in Montreal, alongside commitments on reciprocal cloud and AI market access and a transatlantic data cable study. Here is what the treaty settles, what it leaves open, and the vendor questions it puts back on your desk.Mon, 02 Nov 2026 00:00:00 GMTAI GovernanceDigital Trade AgreementCanada-EU summitAlliance for the FutureCADACloud and AI Development Actdigital sovereigntyvendor due diligencecross-border data transferadequacydata residencyprocurementCanadahttps://movahedi.ca/insights/ofcom-age-verification-report/https://movahedi.ca/insights/ofcom-age-verification-report/Ofcom's rapid assessment found four ways to verify someone is 16, and every one leans on photo ID. The UK did the technical assessment before legislating. Canada's Bill C-34 is set to enforce the ban first and sort out the how later.Sun, 01 Nov 2026 00:00:00 GMTPrivacyBill C-34age verificationage assuranceOfcomDigital Safety Commissionchildren's privacyUnited Kingdomvendor due diligencefacial age estimationSafe Social Media Acthttps://movahedi.ca/insights/help-desk-vishing-al26-028/https://movahedi.ca/insights/help-desk-vishing-al26-028/On October 28, 2026, the Canadian Centre for Cyber Security published alert AL26-028 on a help-desk voice-phishing campaign bypassing conventional MFA at Canadian law firms. How the relay works, why your MFA approved it, and the breach file you now owe.Sat, 31 Oct 2026 00:00:00 GMTSecurityCyber CentrevishingMFAphishing-resistant MFAlaw firmsPIPEDAbreach notificationMicrosoft 365incident responseCanadahttps://movahedi.ca/insights/fpt-health-ai-resolution/https://movahedi.ca/insights/fpt-health-ai-resolution/On October 29, 2026, Canada's federal, provincial, and territorial privacy commissioners and ombuds issued a joint resolution on responsible AI use in health care and health research. Six core principles, specific asks for vendors, providers, and researchers, and one contract clause your vendor files probably lack.Fri, 30 Oct 2026 00:00:00 GMTAI GovernanceOPCprivacy commissionersAI governancehealth carehealth researchAI scribeshadow AITCPS 2vendor due diligenceCanadahttps://movahedi.ca/insights/openai-challenges-oipc-production-order/https://movahedi.ca/insights/openai-challenges-oipc-production-order/On October 26, 2026, OpenAI petitioned the BC Supreme Court to quash a production order from the BC privacy commissioner, issued in September as part of a June 2026 investigation into whether ChatGPT's use of the Tumbler Ridge shooter's personal information met the reasonable-person test. What the fight signals for AI vendor governance.Thu, 29 Oct 2026 00:00:00 GMTAI GovernanceOpenAIBC OIPCPIPAproduction orderTumbler RidgeChatGPTprivacy investigationreasonable person testvendor governanceCanadahttps://movahedi.ca/insights/opc-investigates-navigate360-crime-stoppers/https://movahedi.ca/insights/opc-investigates-navigate360-crime-stoppers/On October 27, 2026, the Privacy Commissioner opened an investigation into Navigate360, the commercial company behind the Crime Stoppers tip platform, after a breach exposed more than 1.5 million Canadian tips. The investigation answers the jurisdiction question that hung over the case, and it puts the vendor's safeguards on trial.Wed, 28 Oct 2026 00:00:00 GMTPrivacyOPCNavigate360Crime Stoppersdata breachPIPEDAvendor risksafeguardsinvestigationCanadahttps://movahedi.ca/insights/loblaw-opc-compliance-letter/https://movahedi.ca/insights/loblaw-opc-compliance-letter/On October 26, 2026, the Privacy Commissioner announced Loblaw signed a compliance letter over the February cyberattack that affected about two million Canadians. Unlike WestJet two weeks earlier, Loblaw's file stays open until the Commissioner is satisfied. What the difference means for breach response.Tue, 27 Oct 2026 00:00:00 GMTPrivacyOPCLoblawcompliance letterdata breachPIPEDAPC Optimumbreach notificationcredit monitoringCanadahttps://movahedi.ca/insights/opc-ai-transparency-understandability-test/https://movahedi.ca/insights/opc-ai-transparency-understandability-test/On October 23, 2026, the Privacy Commissioner published its submission to ISED's AI transparency consultation. Its core test is simple: information about an AI system must be understandable and arrive at the moment of decision. What that means for privacy teams.Mon, 26 Oct 2026 00:00:00 GMTAI GovernanceOPCAI transparencyISEDmeaningful consentPIPEDAAI-generated contentautomated decisionsAI incidentsBill C-36Canadahttps://movahedi.ca/insights/ottawa-picked-wrong-ban/https://movahedi.ca/insights/ottawa-picked-wrong-ban/The Heritage Committee studied children and social media for a year and recommended banning targeted ads to kids. The government's response this week declined that ban and kept the under-16 account ban instead. What the reversal means for privacy teams.Sun, 25 Oct 2026 00:00:00 GMTPrivacyBill C-34Safe Social Media ActHeritage Committeetargeted advertisingchildren's privacyDigital Safety Commissionage assuranceprofilingCanadahttps://movahedi.ca/insights/post-quantum-geo-key-manager/https://movahedi.ca/insights/post-quantum-geo-key-manager/Cloudflare's new PQ GeoKey Manager wraps customer decryption keys so they can only be unwrapped inside a chosen geography, and wraps them with hybrid post-quantum cryptography so a harvest now, decrypt later adversary gains nothing. Here is how the mechanism works, where it fails closed, and what Canadian privacy teams should ask before trusting a region promise.Sat, 24 Oct 2026 00:00:00 GMTPrivacypost-quantum cryptographydata sovereigntykey managementML-KEMHPKEdata residencyCloudflareLaw 25fail closedprivacy engineeringhttps://movahedi.ca/insights/crime-stoppers-anonymity-breach/https://movahedi.ca/insights/crime-stoppers-anonymity-breach/CBC's investigation into the Crime Stoppers breach found 1.5 million Canadian tips spanning 25 years exposed through the P3 platform run by U.S. vendor Navigate360, including unredacted names and personal details. The vendor changed its story for months, and an internal memo told chapters not to call the privacy commissioner. What the case teaches about vendor due diligence when anonymity is the product.Fri, 23 Oct 2026 00:00:00 GMTPrivacyCrime Stoppersdata breachNavigate360vendor riskthird-party due diligenceanonymityPIPEDAincident responsecross-border dataCanadahttps://movahedi.ca/insights/bill-c34-charter-statement-argues-against-itself/https://movahedi.ca/insights/bill-c34-charter-statement-argues-against-itself/Justice Canada tabled the Charter statement for Bill C-34's under-16 social media ban on October 19, 2026. The evidence for the ban is one unsupported sentence, the privacy case for mandatory age assurance is one word, 'perceived,' and the safeguards that would make the ban lawful arrive after the ban itself. What privacy teams should track.Thu, 22 Oct 2026 00:00:00 GMTPrivacyBill C-34Safe Social Media ActCharter statementage assurancesection 8Digital Safety Commissionminimum age requirementCanadahttps://movahedi.ca/insights/opc-childrens-privacy-code/https://movahedi.ca/insights/opc-childrens-privacy-code/On October 20, 2026, Philippe Dufresne launched Canada's first Children's Privacy Code: meaningful consent with parental consent for under-13s, age-appropriate communication, deletion on demand, no marketing profiling of children, and privacy by default. Here is what product and privacy teams need to check.Wed, 21 Oct 2026 00:00:00 GMTPrivacyOPCchildren's privacy codechildrenyouthmeaningful consentprofilingdeceptive designage assurancePIPEDACanadahttps://movahedi.ca/insights/cameras-not-cookies-enforcement-review/https://movahedi.ca/insights/cameras-not-cookies-enforcement-review/A data review of 10 published CAI and OPC enforcement actions: no fines, no cookie banners, and a clear pattern. Regulators are aiming at cameras, faces, AI training data, and old data that should have been destroyed.Tue, 20 Oct 2026 00:00:00 GMTPrivacyenforcementCAIOPCLaw 25facial recognitionbiometricsdata retentionAI governanceQuebecCanadahttps://movahedi.ca/insights/digital-sovereignty-infrastructure-wave/https://movahedi.ca/insights/digital-sovereignty-infrastructure-wave/Michael Geist published his digital sovereignty keynote today, while Bell's $50B sovereign AI campus and Saskatchewan's ownership framework turn the debate into poured concrete. Here is what the sovereignty wave means for your vendor files, residency map, and foreign-access questions.Mon, 19 Oct 2026 00:00:00 GMTPrivacydigital sovereigntydata residencysovereign cloudvendor due diligenceBell AI FabricSaskatchewandata centreCADACanadaAI governancehttps://movahedi.ca/insights/every-privacy-file-is-now-an-ai-file/https://movahedi.ca/insights/every-privacy-file-is-now-an-ai-file/Between October 8 and 14, four Canadian privacy developments landed AI obligations on privacy teams: the OPC's voiceprint guidance, Bill C-34's recommender-system duties, Newfoundland's ATIPPA review submission naming AI, and Bill C-36's automated decision-making rules. The separate discipline of AI governance is dissolving into privacy law.Sun, 18 Oct 2026 00:00:00 GMTAI GovernanceAI governanceautomated decision-makingBill C-34Bill C-36OPCNewfoundland and LabradorATIPPAvoiceprintsbiometric informationage assurancerecommender systemsprivacy lawCanadashadow AIhttps://movahedi.ca/insights/ml-dsa-supply-chain-signing/https://movahedi.ca/insights/ml-dsa-supply-chain-signing/AWS shipped a two-part series on post-quantum software supply chain signing: ML-DSA keys in KMS, an ML-DSA certificate hierarchy in Private CA, workload identity through IAM Roles Anywhere, SBOMs bound with in-toto statements, and the enforcement half most teams skip: turning the algorithm policy into SCPs and IAM controls with the kms:KeySpec condition key. How the threat works, how the pipeline is built, and the one condition key that makes the policy real.Sat, 17 Oct 2026 00:00:00 GMTSecurityML-DSApost-quantum cryptographysoftware supply chainAWSIAMservice control policiescode signingSBOMin-totoCNSA 2.0EU Cyber Resilience Actkey managementhttps://movahedi.ca/insights/newfoundland-atippa-review-fix-list/https://movahedi.ca/insights/newfoundland-atippa-review-fix-list/On October 14, 2026, Newfoundland and Labrador's privacy commissioner published her submission to the five-year review of ATIPPA, 2015, the law she calls the strongest access regime in Canada. Her four asks, on privilege claims, political party data, AI, and oversight powers, read like a preview of where every province is heading.Fri, 16 Oct 2026 00:00:00 GMTPrivacyATIPPANewfoundland and LabradorOIPCaccess to informationsolicitor-client privilegepolitical partiesAI governancestatutory reviewCanadahttps://movahedi.ca/insights/westjet-opc-investigation-closed/https://movahedi.ca/insights/westjet-opc-investigation-closed/On October 14, 2026 the OPC closed its WestJet breach investigation after the airline met every commitment in its July compliance letter. The case is the clearest public template of how the Commissioner resolves a major private-sector breach, and the root cause, social engineering that bypassed MFA on an admin account, is the part privacy teams should study.Thu, 15 Oct 2026 00:00:00 GMTPrivacyOPCWestJetdata breachcompliance letterPIPEDAincident responsemulti-factor authenticationidentity and access managementCanadahttps://movahedi.ca/insights/bill-c22-secret-orders-regulatory-gap/https://movahedi.ca/insights/bill-c22-secret-orders-regulatory-gap/Last week's Senate debate revealed Bill C-22's strangest feature: police powers go live 180 days after Royal Assent, while the SAAIA's capability and metadata-retention obligations wait years for regulations. Meanwhile section 7 lets the Minister impose those same obligations on any provider by secret order before the public rules exist.Wed, 14 Oct 2026 00:00:00 GMTPrivacyBill C-22Lawful Access ActSupporting Authorized Access to Information ActSAAIAministerial ordersmetadata retentionencryptionSenate of Canadaregulatory gapCanadahttps://movahedi.ca/insights/bill-c34-doctors-safety-by-design/https://movahedi.ca/insights/bill-c34-doctors-safety-by-design/A new CMAJ analysis by SickKids researchers backs Bill C-34, the Safe Social Media Act, and prescribes design-based duties: regulate recommender systems and defaults, and give the new Commission real enforcement teeth. The privacy catch is age assurance for every user, and privacy teams should read that part closely.Tue, 13 Oct 2026 00:00:00 GMTPrivacyBill C-34Safe Social Media ActCMAJchildren's privacyage assurancesafety by designDigital Safety Commissionrecommender systemsplatform designCanadahttps://movahedi.ca/insights/oipc-bc-kamloops-mayor-disclosure-order/https://movahedi.ca/insights/oipc-bc-kamloops-mayor-disclosure-order/BC's privacy commissioner found Kamloops Mayor Reid Hamer-Jackson disclosed the personal information of four people in violation of FIPPA and ordered him to get written permission before sharing any staff personal information. What the order teaches municipal privacy teams about elected officials and insider breaches.Mon, 12 Oct 2026 00:00:00 GMTPrivacyBC OIPCFIPPAKamloopsmunicipal privacyelected officialsprivacy breachs. 25.1insider threatBritish Columbiapublic sectorhttps://movahedi.ca/insights/bill-c34-missing-charter-statement/https://movahedi.ca/insights/bill-c34-missing-charter-statement/Four months after Bill C-34's first reading, Justice Canada has still not tabled the Charter statement the Department of Justice Act requires for every government bill, while later bills like C-36 have theirs. What the missing statement reveals about the under-16 ban's constitutional risk, and what privacy teams should track next.Sun, 11 Oct 2026 00:00:00 GMTPrivacyBill C-34Charter statementSafe Social Media Actage verificationMichael GeistDigital Safety CommissionAI chatbotssecond readingParliamentCanadahttps://movahedi.ca/insights/openai-textgrain-eu-text-watermark/https://movahedi.ca/insights/openai-textgrain-eu-text-watermark/OpenAI's answer to the EU AI Act's text provenance rule is textGrain, an invisible statistical watermark with published failure modes: 10% synonym swaps take detection from 92% to 66%, 25% take it to 17%. How the mechanism works, what the numbers honestly say, and the compliance homework for teams serving EU users.Sat, 10 Oct 2026 00:00:00 GMTAI GovernancetextGrainOpenAIwatermarkingEU AI ActArticle 50AI governanceprovenancesynthetic contentdetectionhttps://movahedi.ca/insights/opc-voice-data-customer-calls-guidance/https://movahedi.ca/insights/opc-voice-data-customer-calls-guidance/On October 8, the OPC updated its guidance on recording customer calls, treating voiceprints as sensitive biometric information and clarifying when meaningful consent is required. Generic 'this call may be recorded' notices no longer cut it. What the update means for your IVR scripts, enrolment flows, and call-centre contracts.Fri, 09 Oct 2026 00:00:00 GMTPrivacyOPCvoiceprintsbiometric informationcall recordingmeaningful consentPIPEDAcall centresthird-party riskvendor managementCanadahttps://movahedi.ca/insights/opc-security-screening-four-part-test/https://movahedi.ca/insights/opc-security-screening-four-part-test/Privacy Commissioner Philippe Dufresne told Parliament on October 7 that federal security screening must meet four tests: necessity, proportionality, effectiveness, and minimal intrusiveness. He singled out open-source checks, polygraphs, and clearance maintenance. If you run background checks of any kind, his test is now your benchmark too.Thu, 08 Oct 2026 00:00:00 GMTPrivacyOPCPhilippe Dufresnesecurity screeningsecurity clearancePrivacy ActTBSDirective on Security Screeningpolygraphbackground checksproportionalityhttps://movahedi.ca/insights/nipigon-hospital-ransomware-leak-site/https://movahedi.ca/insights/nipigon-hospital-ransomware-leak-site/Three weeks after Nipigon District Memorial Hospital disclosed a ransomware incident, a group tracked as Storm added it to its leak site. For Ontario health custodians, the listing phase is where double extortion gets expensive. What the law expects, and a first-72-hours playbook.Wed, 07 Oct 2026 00:00:00 GMTSecurityransomwaredouble extortionleak sitePHIPAbreach notificationOntario IPChealthcareincident responsesmall hospitalsCanadahttps://movahedi.ca/insights/nova-scotia-cabinet-records-lock/https://movahedi.ca/insights/nova-scotia-cabinet-records-lock/Nova Scotia's new FOIPOP Act takes effect April 1, 2027 and makes it mandatory to withhold all Executive Council records for 15 years. The privacy commissioner says there was no valid reason for the change. What the mechanics mean for your records playbook.Tue, 06 Oct 2026 00:00:00 GMTPrivacyNova ScotiaFOIPOPExecutive Council recordsaccess to informationcabinet confidencesRight to Know WeekDavid Nurserecords managementCanadatransparencyhttps://movahedi.ca/insights/cada-eu-cloud-act-canada-digital-pivot/https://movahedi.ca/insights/cada-eu-cloud-act-canada-digital-pivot/The EU's proposed Cloud and AI Development Act would grade cloud providers on four sovereignty assurance levels, and a leaked draft for the October 29-30 Canada-EU summit points to Canada seeking associated-country status. Here is what the conditions mean for your vendor files, your data residency map, and Canada's adequacy finding.Mon, 05 Oct 2026 00:00:00 GMTPrivacyCADACloud and AI Development Actdigital sovereigntysovereign cloudvendor due diligencedata residencyEU-Canada summitadequacyBill C-36Bill C-22cross-border transferCanadahttps://movahedi.ca/insights/subprocessor-supply-chain/https://movahedi.ca/insights/subprocessor-supply-chain/I mapped the subprocessor lists of 87 tech companies, two levels deep: 1,498 nodes, 2,518 edges. Three hyperscalers sit under everything, AI labs arrive one layer down, and 58 companies publish no list at all.Mon, 05 Oct 2026 00:00:00 GMTAI Governancesubprocessorssupply chainGDPRAI governancevendor managementhttps://movahedi.ca/insights/kingston-police-breach-notice/https://movahedi.ca/insights/kingston-police-breach-notice/On October 2, 2026, Kingston Police published its closing notice on a 160 GB breach discovered in January 2025. The 21-month gap, the corrupted forensic dataset, and the limits of dark-web monitoring give privacy teams a breach-response drill worth running now.Sun, 04 Oct 2026 00:00:00 GMTSecurityKingston Policedata breachbreach notificationVPNdark web monitoringdata retentionFIPPAOntario IPCincident responsehttps://movahedi.ca/insights/perplexity-safer-agents-defense-in-depth/https://movahedi.ca/insights/perplexity-safer-agents-defense-in-depth/Perplexity's new engineering post describes real incidents where helpful AI agents crossed security boundaries on their own, then lays out three defense-in-depth design rules for building agents that fail safely. Here is what the rules mean in practice, and the questions Canadian privacy and security teams should ask any vendor selling them an agent.Sat, 03 Oct 2026 00:00:00 GMTAI GovernanceAI agentsAI governanceagent securitydefense in depthPerplexitySecOpsprivacy engineeringcontainmenthttps://movahedi.ca/insights/cloudflare-ohttp-gateway-privacy-infrastructure/https://movahedi.ca/insights/cloudflare-ohttp-gateway-privacy-infrastructure/Cloudflare is turning its Privacy Gateway into a managed OHTTP relay and launching a Cloudflare OHTTP gateway in closed beta. Here is how Oblivious HTTP splits every request in two, what it honestly protects, and the due-diligence questions Canadian privacy teams should ask before buying in.Fri, 02 Oct 2026 00:00:00 GMTPrivacyOHTTPCloudflarePrivacy engineeringHPKEData minimizationVendor riskLaw 25https://movahedi.ca/insights/cyber-security-awareness-month-2026-ai-scams-human-defence/https://movahedi.ca/insights/cyber-security-awareness-month-2026-ai-scams-human-defence/Canada's Cyber Security Awareness Month launched October 1, 2026 with the theme 'Your best defence is you' and an explicit AI angle. Here is how privacy and security teams can turn the four weekly themes into a working internal awareness program instead of a poster campaign.Fri, 02 Oct 2026 00:00:00 GMTSecurityCyber Security Awareness MonthGet Cyber SafeAI scamsphishingMFACanadaprivacy operationsemployee trainingSecurityhttps://movahedi.ca/insights/ai-agents-hack-library-archives-canada-lac/https://movahedi.ca/insights/ai-agents-hack-library-archives-canada-lac/AI research firm Transluce found rogue agents probing Library and Archives Canada with SQL injection payloads this spring. The probes failed, but the incident hands privacy and security teams a new threat actor: the machine that acts at machine speed and answers to no interview.Thu, 01 Oct 2026 00:00:00 GMTAI GovernanceAI agentsAI governancecybersecurityLibrary and Archives CanadaTransluceattributionincident disclosurethreat modelingbenchmarksCanadahttps://movahedi.ca/insights/bill-c22-encryption-compromise-no-one-buys/https://movahedi.ca/insights/bill-c22-encryption-compromise-no-one-buys/Bill C-22 heads to the Senate this fall with an encryption compromise that law enforcement and technology companies both reject. What privacy teams should do now: map vendors against the uncertain core-provider category and the six-month metadata retention mandate before the regulations are written.Wed, 30 Sep 2026 00:00:00 GMTPrivacyBill C-22Lawful Access Actencryptionend-to-end encryptionSenatelawful accessmetadata retentionvendor riskCanadahttps://movahedi.ca/insights/right-to-know-week-2026-transparency-tiers/https://movahedi.ca/insights/right-to-know-week-2026-transparency-tiers/BC's privacy commissioner used Right to Know Week 2026 to call for three tiers of transparency: openness by default, proactive release, and a well-resourced request system. With large-volume FOI backlogs and Law 25 access requests on the same 30-day clock, private-sector privacy teams should borrow the playbook.Tue, 29 Sep 2026 00:00:00 GMTPrivacyRight to Know Weekaccess requestsFOIDSARLaw 25BC FIPPAOIPCtransparencyCanadaprivacy operationshttps://movahedi.ca/insights/bill-c39-enabling-digital-trade-act-section-26-data-sharing/https://movahedi.ca/insights/bill-c39-enabling-digital-trade-act-section-26-data-sharing/Bill C-39, introduced September 21, 2026, would enact the Enabling Digital Trade Act, Canada's first federal electronic trade documents law. Its section 26 would let federal officials share import/export information with other departments with no purpose limitation, no consent, and no notice, overriding confidentiality provisions in nine statutes. The bill is at first reading: the committee window is now.Mon, 28 Sep 2026 00:00:00 GMTPrivacyBill C-39Enabling Digital Trade Actdata sharingpurpose limitationfederal governmentParliamentUNCITRALtrade documentsCanadahttps://movahedi.ca/insights/ontario-watchdog-cannot-enforce-orders/https://movahedi.ca/insights/ontario-watchdog-cannot-enforce-orders/On September 25, 2026, CTV News reported that Ontario's Information and Privacy Commissioner sees rising non-compliance with its orders and cannot take government institutions to court to enforce them. A look at what FIPPA actually gives the watchdog, and how that compares with British Columbia and Quebec.Sun, 27 Sep 2026 00:00:00 GMTPrivacyOntario IPCFIPPAFOIEnforcementOrder-making powersSkills Development FundBC FIPPACanadahttps://movahedi.ca/insights/test-rag-pipeline-like-regulator-watching/https://movahedi.ca/insights/test-rag-pipeline-like-regulator-watching/A weekend-sized RAG evaluation on Canadian regulatory text: 12 questions, three Ragas metrics, and a chunking change that lifted faithfulness from 0.95 to 1.00. What the Directive on Automated Decision-Making and OSFI E-23 expect, in practice.Sat, 26 Sep 2026 00:00:00 GMTAI GovernanceRAG evaluationRagasAI governanceOSFI E-23Directive on Automated Decision-MakingCanadahttps://movahedi.ca/insights/draftkings-ai-targeting-losing-gamblers-ontario/https://movahedi.ca/insights/draftkings-ai-targeting-losing-gamblers-ontario/On September 24, 2026, the EFF reported that DraftKings trains machine learning models on customers' betting records to identify likely losing gamblers, then targets them with promotions. In Ontario, where DraftKings is a registered operator, the regulator requires that same player-monitoring data to feed harm reduction, not re-engagement.Fri, 25 Sep 2026 00:00:00 GMTAI GovernanceDraftKingsAI profilingBehavioral advertisingResponsible gamblingAGCOOntario iGamingPIPEDALaw 25Automated decisionsCanadahttps://movahedi.ca/insights/bc-sues-openai-tumbler-ridge-vendor-diligence/https://movahedi.ca/insights/bc-sues-openai-tumbler-ridge-vendor-diligence/On September 21, 2026, British Columbia sued OpenAI and Sam Altman in San Francisco federal court over the Tumbler Ridge school shooting. The province alleges the shooter's flagged ChatGPT conversations should have been referred to law enforcement. The operational lesson is about vendor escalation: what your AI vendors do with dangerous-content flags is now a due diligence question.Thu, 24 Sep 2026 00:00:00 GMTAI GovernanceBC lawsuitOpenAIAI safetyVendor due diligenceAI governanceSam AltmanThreat escalationGovernment plaintiffCanadahttps://movahedi.ca/insights/ai-transparency-consultation-canada-closed/https://movahedi.ca/insights/ai-transparency-consultation-canada-closed/The federal consultation on AI transparency ran from July 23 to September 23, 2026, covering five areas from incident reporting to AI agents. A published submission by Michael Geist argues for a statutory AI Transparency Act. Here is what the process signals for Canadian privacy and AI governance teams.Wed, 23 Sep 2026 00:00:00 GMTAI GovernanceAI transparencyAI governanceISED consultationAI incident reportingAI agentsAI-generated contentTraining dataGovernment of CanadaCanadahttps://movahedi.ca/insights/idscan-breach-opc-investigation/https://movahedi.ca/insights/idscan-breach-opc-investigation/On September 21, 2026, Commissioner Philippe Dufresne opened an OPC investigation into the IDScan.net breach of driver's licence scans. The operational lesson is about vendor risk: your customers' ID documents live in someone else's database, and you answer for the fallout.Tue, 22 Sep 2026 00:00:00 GMTPrivacyOPC investigationIDScan.netData breachPIPEDAThird-party riskVendor due diligenceBreach notificationIdentity documentsCanadahttps://movahedi.ca/insights/eu-kids-act-age-verification-canada/https://movahedi.ca/insights/eu-kids-act-age-verification-canada/The EU Kids Act, proposed September 17, 2026, would make age checks the entry ticket to social media, games, and AI chatbots. For Canadian teams, it is a preview of where Bill C-34 is heading and what the Brussels effect will demand.Mon, 21 Sep 2026 00:00:00 GMTPrivacyEU Kids ActAge verificationBill C-34Brussels effectChildren's privacyDigital Safety CommissionCanadaAI chatbotsData minimizationhttps://movahedi.ca/insights/two-ai-signals-one-homework-coordinated-regulators-concrete-harms/https://movahedi.ca/insights/two-ai-signals-one-homework-coordinated-regulators-concrete-harms/Canada's privacy commissioners met in Ottawa while California expanded AI incident reporting. Different continents, same operational message: inventory AI by decision impact, practice incident reporting, and document like a stranger will audit you.Sun, 20 Sep 2026 00:00:00 GMTAI GovernanceAI GovernancePrivacyCanadaFPTIncident reportingCaliforniaSB 53Digital sovereigntyJoint investigationsADMThttps://movahedi.ca/insights/podcast-circuit-ai-privacy-conversations/https://movahedi.ca/insights/podcast-circuit-ai-privacy-conversations/The best AI-privacy conversations are happening on podcasts. Here's the 16-show circuit I'm pitching. And one question I'd bring each host.Sat, 19 Sep 2026 00:00:00 GMTAI GovernancePrivacyAI governancePodcastsCanadaAI agentsLaw 25https://movahedi.ca/insights/cipp-c-prorogation-of-bill-c-27-and-strategic-legislative-bifurcation/https://movahedi.ca/insights/cipp-c-prorogation-of-bill-c-27-and-strategic-legislative-bifurcation/After Bill C-27 died on prorogation, privacy and AI split tracks. Build under PIPEDA and Law 25 now. Don't wait for a reintroduced omnibus statute.Mon, 13 Jul 2026 00:00:00 GMTCIPP/CPrivacyCanadaBill C-27AIDACPPAPIPEDALaw 25AI governancePrivacy reformhttps://movahedi.ca/insights/aisp/https://movahedi.ca/insights/aisp/GenAI and agentic AI break SaaS-era controls. AI security platforms unify shadow AI discovery, app runtime defense, and identity for models that act.Fri, 10 Jul 2026 00:00:00 GMTSecuritySecurityCybersecurityAI securityAISPShadow AIAgentic AIGenAIZero Trusthttps://movahedi.ca/insights/cipp-c-r-v-bykovets-ip-addresses-and-charter-section-8/https://movahedi.ca/insights/cipp-c-r-v-bykovets-ip-addresses-and-charter-section-8/R v Bykovets (2024 SCC 6): IP addresses attract Charter s.8 privacy. Map collection, retention, and law-enforcement disclosure for Canadian logs.Mon, 06 Jul 2026 00:00:00 GMTCIPP/CPrivacyCanadaR v BykovetsCharter section 8IP addressesPIPEDALaw 25Law enforcement disclosureData retentionhttps://movahedi.ca/insights/agentic-ai/https://movahedi.ca/insights/agentic-ai/Agentic AI needs user-grade identity: least privilege, audit trails, and kill switches for agents that act, not chatbots you can only interview later.Fri, 03 Jul 2026 00:00:00 GMTSecuritySecurityCybersecurityAgentic AIAI governanceIdentity & AccessNHIMAuditabilityLeast privilegehttps://movahedi.ca/insights/cipp-c-del-giudice-and-the-limits-of-intrusion-upon-seclusion/https://movahedi.ca/insights/cipp-c-del-giudice-and-the-limits-of-intrusion-upon-seclusion/Del Giudice limits intrusion upon seclusion after third-party hacks: being breached isn't automatic intentional intrusion. Rebuild class-action risk maps.Mon, 29 Jun 2026 00:00:00 GMTCIPP/CPrivacyCanadaDel GiudiceIntrusion upon seclusionPrivacy class actionsData breachCyberattack liabilityOntario Court of Appealhttps://movahedi.ca/insights/regulatory-liability/https://movahedi.ca/insights/regulatory-liability/Cyber is personal accountability work now: multi-jurisdiction rules, board duties, and evidence of decisions, not only control maturity scorecards.Fri, 26 Jun 2026 00:00:00 GMTSecuritySecurityCybersecurityRegulatory complianceGovernanceBoard accountabilityPrivacyRisk managementEvidencehttps://movahedi.ca/insights/cipp-c-clearview-bcca-and-extraterritorial-privacy-enforcement/https://movahedi.ca/insights/cipp-c-clearview-bcca-and-extraterritorial-privacy-enforcement/Clearview's BCCA result backs extraterritorial privacy orders: scraping Canadians' images can create real connection. Foreign servers aren't a shield.Mon, 22 Jun 2026 00:00:00 GMTCIPP/CPrivacyCanadaClearviewBCCAExtraterritorial enforcementBiometricsPIPEDAFacial recognitionOPChttps://movahedi.ca/insights/crq/https://movahedi.ca/insights/crq/Boards fund numbers, not heat maps. Cyber risk quantification turns qualitative ratings into loss ranges boards can compare with other capital bets.Fri, 19 Jun 2026 00:00:00 GMTSecuritySecurityCybersecurityCRQCyber risk quantificationRisk managementBoard reportingFAIRGovernancehttps://movahedi.ca/insights/cipp-c-intentional-internal-data-misuse-and-privacy-class-actions/https://movahedi.ca/insights/cipp-c-intentional-internal-data-misuse-and-privacy-class-actions/After Del Giudice, external breaches face harder intrusion claims, but intentional internal misuse and soft credit probes still fuel privacy class actions.Mon, 15 Jun 2026 00:00:00 GMTCIPP/CPrivacyCanadaDel GiudicePrivacy class actionsIntrusion upon seclusionInternal data misuseConsentLitigation riskhttps://movahedi.ca/insights/ctem-transition/https://movahedi.ca/insights/ctem-transition/CTEM replaces monthly scan PDFs with continuous exposure decisions: scope, discover, prioritize, validate, and mobilize so backlogs stop growing forever.Fri, 12 Jun 2026 00:00:00 GMTSecuritySecurityCybersecurityCTEMVulnerability managementExposure managementSecurity OperationsRisk prioritizationhttps://movahedi.ca/insights/cipp-c-ppcda-and-bill-c-36-replacing-pipeda-for-a-new-privacy-era/https://movahedi.ca/insights/cipp-c-ppcda-and-bill-c-36-replacing-pipeda-for-a-new-privacy-era/How Bill C-36 / PPCDA could replace PIPEDA: consent, portability, deletion, anonymization, and private rights of action as design targets under today's law.Mon, 08 Jun 2026 00:00:00 GMTCIPP/CPrivacyCanadaPIPEDAPPCDABill C-36Bill C-27Law 25Privacy reformAI governancehttps://movahedi.ca/insights/dspm/https://movahedi.ca/insights/dspm/Sensitive data already lives in SaaS, copies, and AI prompts. DSPM answers where personal data actually sits when the perimeter stopped being the map.Fri, 05 Jun 2026 00:00:00 GMTSecuritySecurityCybersecurityDSPMData securityShadow dataCloudPrivacySaaShttps://movahedi.ca/insights/cipp-c-quebec-law-25-at-full-force-portability-defaults-and-real-penalties/https://movahedi.ca/insights/cipp-c-quebec-law-25-at-full-force-portability-defaults-and-real-penalties/Quebec Law 25 is fully in force: data portability, privacy by default, and CAI penalties up to 2–4% of global turnover reshape Canadian privacy design.Mon, 01 Jun 2026 00:00:00 GMTCIPP/CPrivacyCanadaLaw 25QuebecCAIPIPEDAData portabilityPrivacy by defaultAMPshttps://movahedi.ca/insights/dspm-enforcement/https://movahedi.ca/insights/dspm-enforcement/Discovery without control is ticket noise. Mature DSPM enforces access, quarantine, and policy on sensitive cloud and SaaS data, not only scans.Fri, 29 May 2026 00:00:00 GMTSecuritySecurityCybersecurityDSPMData securityCloudSaaSAccess controlPrivacyhttps://movahedi.ca/insights/cipp-c-joint-investigations-and-genai-scraping-public-is-not-permission/https://movahedi.ca/insights/cipp-c-joint-investigations-and-genai-scraping-public-is-not-permission/Canadian joint investigations reject 'public web equals free training data.' Provenance, filtering, and contracts before GenAI scrape or fine-tune.Mon, 25 May 2026 00:00:00 GMTCIPP/CPrivacyCanadaPIPEDAClearviewGenAIWeb scrapingOPCLaw 25AI governancehttps://movahedi.ca/insights/shadow-ai/https://movahedi.ca/insights/shadow-ai/Shadow AI is ordinary: staff paste drafts into public models. Treat it as unstructured data exfil: discover tools, set approved paths, log high-risk use.Fri, 22 May 2026 00:00:00 GMTSecuritySecurityCybersecurityShadow AIGenAIData loss preventionAI governancePrivacyUnstructured datahttps://movahedi.ca/insights/cipp-c-consumer-driven-banking-apis-consent-and-the-end-of-screen-scraping/https://movahedi.ca/insights/cipp-c-consumer-driven-banking-apis-consent-and-the-end-of-screen-scraping/Canada's Consumer-Driven Banking Act aims to replace screen scraping with consented APIs: scoped tokens, revoke paths, and auditable financial data sharing.Mon, 18 May 2026 00:00:00 GMTCIPP/CPrivacyCanadaOpen bankingConsumer-Driven Banking ActScreen scrapingConsentFinancial dataFCAChttps://movahedi.ca/insights/tee-confidential/https://movahedi.ca/insights/tee-confidential/Encrypt rest and transit still leave data plain in memory. TEEs and confidential computing finally make data-in-use a first-class control.Fri, 15 May 2026 00:00:00 GMTSecuritySecurityCybersecurityTEEConfidential computingData in useZero TrustCryptographyAI securityhttps://movahedi.ca/insights/cipp-c-federal-private-right-of-action-when-privacy-violations-become-civil-claims/https://movahedi.ca/insights/cipp-c-federal-private-right-of-action-when-privacy-violations-become-civil-claims/Federal private rights of action would decentralize PIPEDA-era enforcement. Prepare courtroom-ready evidence, not only commissioner correspondence.Mon, 11 May 2026 00:00:00 GMTCIPP/CPrivacyCanadaPIPEDAPrivate right of actionPrivacy litigationPrivacy reformOPCBill C-27https://movahedi.ca/insights/sovereign-cloud/https://movahedi.ca/insights/sovereign-cloud/Data residency is not a region dropdown. Sovereign cloud for AI needs control of keys, operators, and model processing, not only storage geography.Fri, 08 May 2026 00:00:00 GMTSecuritySecurityCybersecuritySovereign cloudData residencyAI governancePrivacyKey managementCloudhttps://movahedi.ca/insights/cipp-c-bill-c-34-and-the-digital-safety-commission-canada-s-new-super-regulator/https://movahedi.ca/insights/cipp-c-bill-c-34-and-the-digital-safety-commission-canada-s-new-super-regulator/Bill C-34 would create Canada's Digital Safety Commission with audits, orders, and revenue-based AMPs for social media and AI chatbot services.Mon, 04 May 2026 00:00:00 GMTCIPP/CPrivacyCanadaBill C-34Digital Safety CommissionOnline harmsAI chatbotsAMPsSafe Social Media Acthttps://movahedi.ca/insights/pqc/https://movahedi.ca/insights/pqc/Harvest-now-decrypt-later makes PQC a crypto-inventory and migration problem today, not a lab future. Map RSA/ECC, plan hybrid, swap before data ages out.Fri, 01 May 2026 00:00:00 GMTSecuritySecurityCybersecurityPost-quantum cryptographyPQCCryptographyHarvest now decrypt laterKey managementCrypto agilityhttps://movahedi.ca/insights/cipp-c-24-hour-csam-and-ncii-duties-speed-process-and-deepfakes/https://movahedi.ca/insights/cipp-c-24-hour-csam-and-ncii-duties-speed-process-and-deepfakes/Bill C-34's proposed 24-hour CSAM and NCII duties (including deepfakes) turn moderation clocks into evidence: logs, escalation, and privacy-safe reports.Mon, 27 Apr 2026 00:00:00 GMTCIPP/CPrivacyCanadaBill C-34CSAMNCIIDeepfakesDigital safetyPIPEDATrust and safetyhttps://movahedi.ca/insights/gpu-confidential/https://movahedi.ca/insights/gpu-confidential/Classic encrypt-at-rest leaves AI data exposed in GPU memory. Confidential GPUs and TEEs close the data-in-use hole for model weights and prompts.Fri, 24 Apr 2026 00:00:00 GMTSecuritySecurityCybersecurityGPU confidential computingTEEAI securityData in useCryptographyCloudhttps://movahedi.ca/insights/cipp-c-the-age-verification-privacy-paradox-prove-you-are-16-then-forget-you-exist/https://movahedi.ca/insights/cipp-c-the-age-verification-privacy-paradox-prove-you-are-16-then-forget-you-exist/Bill C-34's under-16 age gate creates a privacy paradox: prove age effectively, then destroy verification data so the gate never becomes a registry.Mon, 20 Apr 2026 00:00:00 GMTCIPP/CPrivacyCanadaBill C-34Age verificationChildren's privacyDigital safetyData minimizationBiometricshttps://movahedi.ca/insights/confidential-ai/https://movahedi.ca/insights/confidential-ai/Confidential AI sovereignty without attestation is hope. Remote attestation, TEEs, and policy-bound keys turn marketing claims into verifiable trust.Fri, 17 Apr 2026 00:00:00 GMTSecuritySecurityCybersecurityConfidential AIAttestationTEEAI securityCryptographyData sovereigntyhttps://movahedi.ca/insights/cipp-c-privacy-enforcement-after-c-27-commission-models-order-powers-and-the-safety-merge/https://movahedi.ca/insights/cipp-c-privacy-enforcement-after-c-27-commission-models-order-powers-and-the-safety-merge/Post-C-27, Canadian privacy reform still pushes order powers, AMPs, and commission models, plus a safety merge that overlaps digital harms duties.Mon, 13 Apr 2026 00:00:00 GMTCIPP/CPrivacyCanadaBill C-27PIPEDAOPCAMPsPrivacy enforcementDigital safetyhttps://movahedi.ca/insights/zero-trust-2/https://movahedi.ca/insights/zero-trust-2/Zero Trust 1.0 killed network trust. Zero Trust 2.0 needs TEEs and attestation when the host and cloud admin can no longer be the trusted compute base.Fri, 10 Apr 2026 00:00:00 GMTSecuritySecurityCybersecurityZero TrustTEEConfidential computingAttestationHardware securityCryptographyhttps://movahedi.ca/insights/cipp-c-ontario-fippa-data-integration-predictive-governance-meets-privacy-friction/https://movahedi.ca/insights/cipp-c-ontario-fippa-data-integration-predictive-governance-meets-privacy-friction/Ontario FIPPA data integration units enable linked analysis under Part III.1 gates: predictive use needs de-id standards and function-creep controls.Mon, 06 Apr 2026 00:00:00 GMTCIPP/CPrivacyCanadaFIPPAOntarioData integrationOntario IPCDe-identificationPublic sector privacyhttps://movahedi.ca/insights/secure-by-design/https://movahedi.ca/insights/secure-by-design/CISA Secure by Design shifts default security to vendors: safe configs, memory safety, and customer-hardening burden that shouldn't be the last line.Fri, 03 Apr 2026 00:00:00 GMTSecuritySecurityCybersecurityCISASecure by DesignProduct securityVendor riskDefault securityMemory safetyhttps://movahedi.ca/insights/cipp-c-phipa-decision-298-ontario-s-first-health-privacy-amps/https://movahedi.ca/insights/cipp-c-phipa-decision-298-ontario-s-first-health-privacy-amps/PHIPA Decision 298 issued Ontario's first health privacy AMPs for commercial EHR misuse: proof that economic motive and weak clinic programs matter.Mon, 30 Mar 2026 00:00:00 GMTCIPP/CPrivacyCanadaPHIPAOntario IPCAMPsHealth privacyEHR accessAdministrative monetary penaltieshttps://movahedi.ca/insights/wifi7-wpa3/https://movahedi.ca/insights/wifi7-wpa3/Wi-Fi 7's 6 GHz band requires WPA3: no WPA2 fallback. Plan Enterprise auth, GCMP, and client readiness before the band forces your migration calendar.Fri, 27 Mar 2026 00:00:00 GMTSecuritySecurityCybersecurityWi-Fi 7WPA36 GHzWireless securityEnterprise Wi-FiCryptographyhttps://movahedi.ca/insights/cipp-c-economic-motivation-as-an-aggravating-factor-146-searches-and-a-business-pipeline/https://movahedi.ca/insights/cipp-c-economic-motivation-as-an-aggravating-factor-146-searches-and-a-business-pipeline/Decision 298's 146 targeted newborn searches show economic motive as an AMP aggravator. Clinical access is not a private marketing pipeline.Mon, 23 Mar 2026 00:00:00 GMTCIPP/CPrivacyCanadaPHIPAOntario IPCAMPsHealth privacyEHR accessEconomic motivationhttps://movahedi.ca/insights/gcmp-256/https://movahedi.ca/insights/gcmp-256/Labeling WPA3 is not enough for Wi-Fi 7. GCMP-256 and true WPA3-Enterprise cipher suites matter when high-throughput links raise the crypto bar.Fri, 20 Mar 2026 00:00:00 GMTSecuritySecurityCybersecurityGCMP-256WPA3-EnterpriseWi-Fi 7Wireless securityCryptography802.11behttps://movahedi.ca/insights/cipp-c-decision-334-436-records-one-clerk-and-why-the-hospital-was-spared/https://movahedi.ca/insights/cipp-c-decision-334-436-records-one-clerk-and-why-the-hospital-was-spared/PHIPA Decision 334: a clerk's 436-record snooping drew a personal AMP while CHEO's response mattered. Unauthorized access needs no profit motive.Mon, 16 Mar 2026 00:00:00 GMTCIPP/CPrivacyCanadaPHIPAOntario IPCAMPsHealth privacyUnauthorized accessCHEOhttps://movahedi.ca/insights/pmf-sae/https://movahedi.ca/insights/pmf-sae/Mandatory PMF stops easy deauth disruption; SAE replaces brittle PSKs to blunt offline dictionary attacks: core WPA3 personal-mode upgrades.Fri, 13 Mar 2026 00:00:00 GMTSecuritySecurityCybersecurityPMFSAEWPA3Wireless securityDeauthCryptographyhttps://movahedi.ca/insights/cipp-c-demonstrable-accountability-evidence-beats-paper-policies/https://movahedi.ca/insights/cipp-c-demonstrable-accountability-evidence-beats-paper-policies/PHIPA Decision 298 makes demonstrable accountability the test: policies only count when training, audits, and breach evidence prove they operate.Mon, 09 Mar 2026 00:00:00 GMTCIPP/CPrivacyCanadaPHIPADemonstrable accountabilityOntario IPCHealth privacyPrivacy managementAMPshttps://movahedi.ca/insights/mlo/https://movahedi.ca/insights/mlo/Wi-Fi 7 MLO lets one client use several radios at once: security teams must rethink association, keys, and monitoring for multi-link sessions.Fri, 06 Mar 2026 00:00:00 GMTSecuritySecurityCybersecurityMLOWi-Fi 7Multi-Link OperationWireless security802.11beWPA3https://movahedi.ca/insights/cipp-c-privacy-in-professional-staff-bylaws-credentialing-is-a-control/https://movahedi.ca/insights/cipp-c-privacy-in-professional-staff-bylaws-credentialing-is-a-control/PHIPA Decision 298: put privacy duties in professional staff bylaws and reappointment: credentialing is the control for privileged EHR access.Mon, 02 Mar 2026 00:00:00 GMTCIPP/CPrivacyCanadaPHIPAOntario IPCHealth privacyCredentialingProfessional staff bylawsEHR accesshttps://movahedi.ca/insights/owe/https://movahedi.ca/insights/owe/Open guest Wi-Fi leaks traffic to anyone nearby. OWE / Enhanced Open encrypts the air without a shared PSK. Fixing guest isolation still matters.Fri, 27 Feb 2026 00:00:00 GMTSecuritySecurityCybersecurityOWEEnhanced OpenWPA3Guest Wi-FiWireless securityCryptography