# llms.txt – https://movahedi.ca
# Canonical, human-reviewed guidance for AI systems and crawlers.

## Site summary
name: Mohammad Movahedi
url: https://movahedi.ca
description: CIPP/C | Data Protection & Security Specialist at The Globe and Mail. Privacy, AI governance, Six Sigma, and data analytics consulting for organizations navigating complex privacy-AI intersections.
contact: mohammad@movahedi.ca
location: Mississauga, Ontario, Canada
languages: English, French, Persian
linkedin: https://www.linkedin.com/in/mh-movahedi/
github: https://github.com/movahedi-ca
booking: https://cal.com/mohammad-hossein-movahedi-x5vvbp/15min
headshot: https://movahedi.ca/images/mohammad-movahedi.jpg
ai fact sheet: https://movahedi.ca/ai/

## About (full)
I'm Mohammad Movahedi, CIPP/C. I'm a Data Protection and Security Specialist at The Globe and Mail, where I lead privacy assessments, AI intake governance, and vendor privacy reviews. I also advise organizations on privacy programs, AI governance, and operational excellence. My work lives where personal data, security operations, and new AI systems collide. That collision point is where most privacy problems start.

I started in industrial engineering, optimizing systems of people, machines, and materials. Then a Master of Professional Studies in Analytics (MPS in Analytics) from Northeastern taught me how models actually behave: data quality, evidence, and where the numbers mislead. Both show up in my privacy and AI risk work every day.

At TELUS I was a Data Governance Analyst running the enterprise privacy platform (OneTrust). I automated Privacy Impact Assessments and Secure by Design reviews, and trained 450+ stakeholders on governance processes. That job taught me privacy programs fail in the handoffs, not in the policy PDF.

At The Globe and Mail I lead privacy and security work where audience trust is the product. Day to day that means triaging security alerts, coordinating breach response with legal and business teams, consent and cookie compliance, data inventory, vendor reviews, and PIAs. All of it under real production pressure.

Today I pair that operator experience with Lean Six Sigma discipline. My view on AI is blunt: shadow systems and agentic tools will not wait for perfect regulation, so usage controls and application security have to ship alongside the innovation. If you need a part-time privacy lead, a focused program build, or an AI governance framework your board can actually understand, that is the work I do.

Credentials: Credentials include CIPP/C (IAPP), ISC2 CC, Lean Six Sigma coursework (LinkedIn Learning, 2022), OneTrust Fellow of Privacy Technology (vendor platform designation), and a Master of Professional Studies in Analytics (MPS in Analytics).

Location: Based in Mississauga, Ontario (Greater Toronto Area). Working remotely across Canada and on site in the GTA.

### Philosophy
- **Privacy as an enabler, not a blocker** – Well-designed privacy programs speed up product velocity by making risk decisions faster and clearer, not by saying no more often.

- **AI needs governance to scale responsibly** – Shadow AI and agentic systems will not wait for perfect regulation. Controls for usage and application security must ship alongside innovation.

- **Process excellence sustains compliance** – Six Sigma and Lean turn one-off privacy heroics into measurable, repeatable operations that survive org change.

- **Media orgs are bellwethers for data ethics** – Publishing lives at the intersection of public trust, personal data, and AI-assisted newsroom tools, lessons that transfer to any data-rich enterprise.


## Credentials (published)
- CIPP/C
- Lean Six Sigma (LinkedIn Learning)
- ISC2 CC
- Master of Professional Studies in Analytics (MPS in Analytics)

## Services (full detail)
### Privacy & Data Governance (`/services/privacy-data-governance/`)
Build privacy programs that scale with your business.

Program building, policy development, vendor assessments, DPIAs/PIAs, platform optimization, and compliance with PIPEDA, Law 25, GDPR readiness, and emerging Canadian laws.

**Problems I solve:**
- Fragmented privacy ownership across product, legal, and security
- Manual PIAs that delay launches
- Vendor risk backlog with incomplete SOC 2 reviews
- Consent and cookie programs that fail audits

**How I work:**
1. Discovery: map data flows, systems, and accountability gaps
2. Assessment: maturity baseline against PIPEDA, Law 25, and industry norms
3. Roadmap: prioritized controls, policies, and platform work
4. Implementation: PIA automation, vendor workflows, training

**Deliverables:**
- Privacy program roadmap
- PIA/DPIA templates and playbooks
- Vendor assessment workflow
- Policy pack (privacy, retention, breach)
- Stakeholder training sessions

**FAQs:**
Q: How long does a Law 25 gap assessment take?
A: A typical Law 25 gap assessment for a mid-sized organization may run 3–4 weeks: mapping data flows and current controls, testing them against the law's requirements, then delivering a prioritized remediation roadmap. Larger or multi-brand environments can take longer. You'll know the timeline before we start – I confirm scope, timing, and commercial terms in the proposal after a short discovery call.

Q: Do you work with US companies handling Quebec data?
A: Yes. If your products or marketing target Quebec residents, Law 25 likely applies to you regardless of where you're incorporated. I help US teams understand which obligations follow the data (consent, privacy impact assessments, and breach notification) and build controls that satisfy both Quebec and US state privacy laws without duplicating work.

Q: Can you train our internal team, not just deliver documents?
A: Absolutely. Training is a first-class deliverable for me. I typically include working sessions so your people can run the PIA process, vendor reviews, and consent program after I leave. I've trained 450+ stakeholders, and my goal is always that the program survives without me, not that you need me forever.

Q: Do you work with Canadian privacy law specifically?
A: Yes. My CIPP/C credential is Canada-specific, and I work hands-on with PIPEDA, Quebec Law 25, and practical GDPR-readiness patterns for Canadian organizations with cross-border data flows. I keep my guidance operational: what to actually do, in what order, rather than reciting statutes.

Q: Can you help with OneTrust, Ketch, or similar platforms?
A: Yes. I design the program first, then optimize the platform to match it: PIA automation, vendor workflows, consent and cookie programs, and training so the tool reflects how your teams actually work. I've run OneTrust at enterprise scale and Ketch in a media environment, so I know where these platforms help and where they get in the way.

Q: Is this a substitute for legal counsel?
A: No. I provide governance, operational, and risk guidance: the machinery that makes compliance real day to day. For legal opinions or litigation positions, you need qualified counsel for your circumstances, and I'll tell you plainly when a question belongs with a lawyer.

Q: How do engagements typically start?
A: With a short discovery call where we scope your data flows, accountability gaps, and urgency. From there I propose either a fixed-scope assessment or a roadmap-plus-implementation package. You'll see the full plan and price before committing to anything.


### Cookie & Script Governance Sprint (`/services/cookie-script-governance/`)
Turn a cookie banner into a governed program.

A fixed-scope sprint that reconciles what your site actually fires with what your consent platform discloses: runtime baseline, classification by legal recipient, a named owner for every cookie and script, and documented approve, gate, or remove decisions under Law 25 and GDPR consent rules.

**Problems I solve:**
- CMP scans list hundreds of cookies that nobody can explain or own
- Trackers fire before consent while the banner looks compliant
- Cookies get approved in the platform with no record of who decided, or why
- Obsolete vendor scripts stay live years after the contract ends

**How I work:**
1. Runtime baseline: what fires before consent, after reject, and after accept, in a fresh browser
2. Three-way diff: observed vs declared vs intended, so undisclosed tracking surfaces first
3. Classification by legal recipient, not by the domain that set the cookie, plus an owner hunt for every item
4. Decisions with an expiry date: approve, gate, or remove, run by an audit committee on a fixed cadence

**Deliverables:**
- Runtime baseline report with a timestamped evidence pack
- Cookie & Script Register with every item classified, owned, and decided
- CMP declaration and cookie policy synced to the register
- Third-party chain map and CSP plan
- Audit committee stood up, first monthly cycle run jointly

**FAQs:**
Q: How long does the sprint take, and what does it cover?
A: Five to six weeks for one web property. Week one is a runtime baseline in a fresh browser: what fires before consent, after reject, and after accept. Then a three-way diff of observed, declared, and intended tracking, classification and an owner hunt for every item, and approve, gate, or remove decisions with the consent platform and cookie policy synced to the register on the same change.

Q: What do you need from our team?
A: Three things. A named program owner on your side, named before the sprint starts, because the register and the monthly cadence transfer to that person at handover. Access to your consent platform and tag manager. And business owners who can answer three questions about their tags: what is it, why is it used, and who uses it. If nobody can be named as owner, the sprint is not a fit yet.

Q: Does this replace our consent management platform?
A: No. The sprint works with the platform you already run. Platforms classify cookies by the domain that set them, which is how a Google Analytics cookie ends up labelled first-party. The sprint adds the layer platforms do not provide: runtime verification, classification by the organisation that receives the data, ownership, and documented approval decisions.

Q: What happens after the sprint?
A: Your team runs a monthly runtime audit and a quarterly register review using the templates and cadence from the engagement, and every approval expires within 12 months unless it is re-approved. An optional quarterly retainer covers the register review, annual re-approval, and review of high-risk vendor changes. Scope, timing, and commercial terms are confirmed in the proposal after a short discovery call; no pricing is published.

Q: Is this legal advice?
A: No. The sprint produces technical and governance evidence: what fires, who receives it, who owns it, and what was decided. Final legal interpretation stays with your counsel or data protection officer, and the register records who decided each item and on what basis.


### AI Governance, Ethics & Explainability (`/services/ai-governance-solutions/`)
Govern AI so innovation does not outrun trust.

AI risk frameworks, explainability, bias auditing, Copilot/privacy evaluations, responsible AI policies, and B2B tooling for privacy ops.

**Problems I solve:**
- Shadow AI and unapproved model usage
- No inventory of high-risk AI systems
- Product teams shipping without privacy review
- Board pressure without a clear AI control model

**How I work:**
1. Inventory AI use cases and data dependencies
2. Risk-tier models and agents by impact
3. Define usage control + application security pillars
4. Embed reviews into product and security workflows

**Deliverables:**
- AI risk assessment framework
- Acceptable use + model governance policy
- XAI evaluation guidance
- Shadow AI discovery plan
- Executive briefing deck

**FAQs:**
Q: We're already using Copilot: is it too late to govern it?
A: Not at all. Most of my AI governance work starts exactly there. I inventory what's actually deployed, assess the privacy and data exposure of each use case, and put proportionate controls around it. You don't rip out tools people rely on; you make their use defensible.

Q: Will this slow our product teams down?
A: My goal is faster, clearer risk decisions, not blanket refusals. I build lightweight review gates and pre-approved patterns so teams know what's green-lit before they build. The slowdown teams fear usually comes from late-stage surprises, which governance prevents.

Q: How do you evaluate AI vendors for privacy risk?
A: I look at what data the model actually touches, where training and inference happen, what the vendor retains, and what their sub-processor chain looks like. Then I map that against your obligations under Law 25, PIPEDA, or GDPR. You get a plain-language risk rating and the specific contract terms worth pushing back on.

Q: What does an AI risk framework include?
A: A use-case inventory, risk-tiering by impact, data dependency mapping, an acceptable-use and model governance policy, and review gates embedded in your product and security workflows. I tailor it to how your teams already ship software so it gets used instead of filed away.

Q: Do you cover generative AI and Copilot-style tools?
A: Yes. That's the bulk of what teams ask about. My evaluations focus on privacy impact, shadow AI exposure, usage controls, and application-security considerations, so innovation doesn't outrun trust.

Q: How is this different from pure privacy consulting?
A: AI governance adds model and agent inventory, explainability guidance, bias and usage controls, and a dual focus on usage control plus application security, alongside the classic privacy reviews. The risk surface is genuinely different, so the control set has to be.

Q: What does a first engagement look like?
A: Usually a 2–3 week AI use-case inventory and risk-tiering sprint. You get a map of what's deployed, what's shadow, and what needs controls first, plus a board-ready summary. From there we can build the full framework or hand your team a roadmap to run with.


### Process Excellence & Six Sigma (`/services/process-excellence-six-sigma/`)
Apply process rigor to privacy and compliance ops.

Streamline privacy operations, cut waste in data handling, and apply Lean Six Sigma rigor to security and privacy workflows.

**Problems I solve:**
- Privacy ops bottlenecks and rework
- Inconsistent control quality across business units
- Manual handoffs between legal, security, and product
- No metrics for program health

**How I work:**
1. Define critical privacy/security processes
2. Measure cycle time, defects, and handoff waste
3. Analyze root causes with DMAIC
4. Improve and control with SOPs and dashboards

**Deliverables:**
- Process maps and RACI
- DMAIC project charter and results
- KPI dashboard design
- Standard operating procedures
- Continuous improvement backlog

**FAQs:**
Q: How long until we see results?
A: Quick wins often land in the first few weeks. I target the most painful bottleneck first so the team feels relief early. A full DMAIC cycle on a core privacy workflow can run several weeks to a few months depending on complexity. I measure everything, so you'll see cycle-time and defect numbers move, not just hear that things 'feel better.'

Q: Will this add bureaucracy to our privacy team?
A: The opposite. That's the whole point. I remove steps, handoffs, and rework rather than adding them. Every control I recommend has to earn its place by reducing risk or cycle time. If a process can't justify its own existence in the data, we cut it.

Q: Do our people need Six Sigma training first?
A: No. I apply Lean Six Sigma methods for you: DMAIC, process maps, RACIs, control plans – translated into language your privacy and security teams already use. Your team learns the useful parts by doing, without sitting through belt certification they'll never use.

Q: What processes are good candidates?
A: PIA intake and completion, vendor risk reviews, breach documentation handoffs, consent change management: any privacy or security workflow with rework, delays, or inconsistent quality. If people complain about it weekly, it's a candidate.

Q: What metrics do you typically establish?
A: Cycle time, first-pass yield, backlog age, handoff defects, and program-health KPIs that feed a simple dashboard leadership can review monthly. I keep it to the handful of numbers that actually drive decisions.

Q: Is this only for large enterprises?
A: No. Mid-market teams often gain the most. With fewer people, waste hurts more, and lightweight SOPs free up capacity fast. I scale the rigor to your size; a 20-person company doesn't need the same apparatus as a bank.

Q: How do you handle resistance from the team?
A: By making their jobs easier first. I start with the pain points the team itself names, involve the people who do the work in redesigning it, and never impose a process from a slide deck. When the new way is visibly less painful, adoption takes care of itself.


### Custom B2B AI & Data Solutions (`/services/custom-ai-b2b-tools/`)
Privacy-preserving AI for GRC and data operations.

I advise on and prototype AI tools for GRC teams: privacy-preserving analytics, automation, and data classification, from pilot to production.

**Problems I solve:**
- Manual GRC work that does not scale
- No path from AI pilot to production controls
- Data classification still spreadsheet-driven
- Need for privacy-preserving analytics patterns

**How I work:**
1. Scope high-ROI automation opportunities
2. Design with privacy-by-design and least privilege
3. Prototype with clear evaluation criteria
4. Handoff playbook for engineering ownership

**Deliverables:**
- Solution brief and architecture sketch
- Prototype or PoC guidance
- Data protection impact notes
- Production readiness checklist

**FAQs:**
Q: Who owns the IP of what you prototype?
A: You do. Everything I build or specify in an engagement: prototypes, architecture sketches, evaluation criteria – is yours, documented for handoff from day one. I structure it so your engineering team can own and extend the system without depending on me.

Q: Can you work directly with our engineering team?
A: Yes, when teams want that. I can embed with your engineers during prototyping, joining standups, reviewing approaches, and transferring the privacy-by-design reasoning behind each decision. The handoff works because it was collaborative, not a document thrown over a wall.

Q: How do you keep prototypes privacy-safe?
A: Data minimization, least-privilege access, and clear boundaries between demo data and production paths are defined before prototyping advances. I also write data protection impact notes as we go, so the prototype arrives with its risk thinking attached, not as an afterthought.

Q: Do you build full production products?
A: My focus is advise-and-prototype: architecture sketches, privacy-preserving patterns, evaluation criteria, and production-readiness checklists, with handoff so your engineering team owns the system. If you need a full product team, I'll tell you honestly and help you scope what to look for.

Q: What kinds of tools are in scope?
A: Intelligent automation for GRC workflows, privacy-ops assistants, data classification helpers, and analytics patterns designed with least privilege and privacy-by-design. If your use case touches personal data, I'll flag it early and design around it.

Q: Can this pair with AI governance work?
A: Often yes. Governance defines which use cases are allowed, and tooling work then automates the approved workflows safely. Doing them together means the controls and the automation are designed as one system.

Q: What does a prototype engagement cost?
A: It depends on scope. I work in defined stages: a solution brief and architecture sketch first, then prototype sprints with evaluation criteria. You approve each stage before the next begins, so there are no open-ended burn surprises. Commercial terms are confirmed in the proposal.


### Fractional & Advisory Roles (`/services/fractional-advisory/`)
Senior privacy and AI governance leadership on demand.

Fractional privacy officer / advisor support for mid-market and growth companies needing executive-level guidance without a full-time hire.

**Problems I solve:**
- No in-house privacy lead but rising board risk
- Need for interim leadership during transformation
- Program stuck after policy drafts only
- Speaking / board briefing support required

**How I work:**
1. Scoped retainer with clear outcomes
2. Office hours + priority escalation path
3. Roadmap ownership with internal champions
4. Knowledge transfer so capability sticks

**Deliverables:**
- Monthly program scorecard
- Board/exec briefings
- Priority decision memos
- Team coaching and office hours

**FAQs:**
Q: How many hours per month does a fractional engagement need?
A: Most of my fractional clients land between 20 and 40 hours a month, scoped around outcomes rather than hours. We agree on what gets delivered each month: scorecards, briefings, decision memos – and I flex within that. If the scope grows, we renegotiate openly instead of quietly burning hours.

Q: Can you present to our board?
A: Yes. Board and executive briefings are a core part of the retainer. I translate program status and risk into the language boards actually decide in: exposure, cost, and timeline. No 40-slide decks; a clear picture and a recommendation.

Q: How quickly can support start?
A: After a discovery call and a basic conflict check, I can usually get started quickly with a 30–60–90 day priority plan. The first month focuses on stabilizing whatever is on fire and mapping the program; strategy follows once I understand your reality.

Q: What does a typical retainer include?
A: Scoped monthly outcomes, office hours, a priority escalation path, a program scorecard, and decision memos, plus coaching so your internal owners keep the capability. You always know what you're getting each month.

Q: Is this only for privacy officer roles?
A: No. Scopes often cover privacy leadership, AI governance advisory, board briefings, and interim program leadership during transformation. We define the mandate around your gap, not a job title.

Q: What is out of scope?
A: Day-to-day ticket grinding without decision rights, pure legal opinions, and engagements that would require full-time on-site staffing. If what you need is really a full-time hire, I'll tell you, and help you write the job description.

Q: How do you hand off when the engagement ends?
A: Knowledge transfer is built in from the start, not rushed at the end. Your internal champions co-own the roadmap throughout, so when the retainer winds down, the program keeps running. I document decisions and reasoning, not just outcomes.


### Data-Responsible Branding & Media Strategy (`/services/branding-media-strategy/`)
Build brand trust through transparent data practices.

Responsible data use in marketing and branding, privacy-by-design in CDPs, content strategy informed by analytics and ethics, leveraging hands-on media experience at The Globe and Mail.

**Problems I solve:**
- Marketing stacks outpacing privacy review
- Trust erosion from opaque personalization
- Media/publishing data ethics pressure
- Consent fatigue and poor preference UX

**How I work:**
1. Map marketing data flows and processors
2. Align brand promise with actual data practices
3. Design preference and consent experiences
4. Publish transparent, audience-ready narratives

**Deliverables:**
- Data ethics playbook for brand/marketing
- CDP privacy-by-design recommendations
- Consent/preference UX guidance
- Thought leadership content framework

**FAQs:**
Q: How do you measure whether trust is improving?
A: I tie it to things you can actually observe: consent opt-in rates, preference-center engagement, complaint and deletion-request volumes, and brand trust survey deltas. Vanity metrics don't count. We agree on the baseline and the target before any work starts.

Q: Do you run ad campaigns or create brand assets?
A: No. I'm not a creative agency. My work is the data-responsible strategy underneath the brand: data flows, consent and preference experiences, ethics playbooks, and narratives that match your actual practices. I make sure what marketing promises is what the company does.

Q: Why does media experience matter for our brand?
A: Media organizations live at the intersection of public trust, personal data, and AI-assisted tools, under constant scrutiny. The operational lessons from my time at The Globe and Mail about handling audience data responsibly transfer directly to any data-rich brand facing trust pressure. That was employment experience, not an endorsement or partnership.

Q: Who is this service for?
A: Marketing, brand, media, and publishing teams whose personalization stacks, CDPs, or content strategies need privacy-by-design and public-trust alignment. If your data practices couldn't survive a front-page story, we should talk.

Q: Is this creative branding work?
A: The primary focus is data-responsible strategy: flows, consent and preferences, ethics playbooks, and narratives that match practice, not pure creative agency services. I partner well with your creative team; I don't replace them.

Q: Can you support thought leadership content?
A: Yes. I build content frameworks for trustworthy messaging on privacy and AI topics, grounded in what your organization actually does. Audiences can smell the difference between real practice and borrowed talking points.

Q: How does this connect to compliance work?
A: Trust is what compliance looks like from the outside. I make sure your public posture: privacy notices, preference centers, marketing claims – is consistent with your actual controls. That alignment is both a compliance safeguard and a brand asset.


## Tools & resources
- Privacy Policy Grader (`/tools/privacy-policy-grader/`): interactive Law 25 / PIPEDA policy check with 11 weighted checks, EN/FR. Educational, not legal advice.
- Fractional Privacy Officer Calculator (`/tools/fractional-privacy-officer-calculator/`): compares full-time vs. fractional privacy leadership cost; figures are directional market estimates.
- Cookie-Banner Auditor (`/tools/cookie-banner-auditor/`): free audit of any site's cookie banner – banner presence, CMP/TCF signals, opt-in quality, pre-consent tracker loading, policy links; scored 0-100, A-F. Server fetch (SSRF-hardened) or 100% client-side paste-HTML mode; FR mirror at `/fr/outils/audit-banniere-cookies/`; embeddable score badge; full methodology published. v2 adds Declared vs Observed: import a HAR or cookie export and diff it against your consent platform's declaration, 100% in the browser, each cookie classified by the organisation that receives its data. Educational, not legal advice.
- Cookie & Script Governance Field Guide (`/tools/cookie-script-governance/`): the governance method behind the auditor: four-pass runtime audit protocol, classification by legal recipient, approval checklist with expiry dates, audit cadence, and the 19-column register template. FR mirror at `/fr/outils/gouvernance-cookies-scripts/`. Free and ungated. Educational, not legal advice.
- Jargon Decoder (`/tools/jargon-decoder/`): paste privacy text; glossary terms highlighted with plain-language tooltips. Embeddable via one script tag; English only. Educational, not legal advice.
- Privacy Nutrition Labels (`/tools/privacy-nutrition-label/`): turns the 11-check policy grade into an FDA-style shareable card (SVG + PNG download + embed snippet). FR mirror at `/fr/outils/etiquette-nutrition-confidentialite/`. Educational, not legal advice.
- Breach Tabletop (`/tools/tabletop/`, app at `/tabletop/`): free interactive incident-response tabletop simulator with six breach scenarios (ransomware, supply chain, stolen laptop, misdirected email, cloud bucket exposure, insider threat), live injects, timed decisions, readiness scoring, after-action report, and a breach-notification doctrine library. Runs 100% in the browser, no signup, no network calls, history in local storage only. Educational, not legal advice.
- Privacy Glossary (`/glossary/`): plain-language privacy/data-protection definitions with DefinedTermSet schema.
- Law 25 Enforcement Tracker (`/law-25/enforcement-tracker/`): verified CAI enforcement actions with official sources, refreshed weekly.
- Privacy Pulse (`/pulse/`): weekly curated Canadian privacy news – headlines, short excerpts, attribution, link-backs, plus editorial "Why it matters" notes.
- Insights RSS (`/insights/rss.xml`): all published English insights.
- Press kit (`/press/`): bios, headshot, speaking topics for media.

## Public API & MCP server (v1.0.0)
- Developer docs: https://movahedi.ca/developers/ – REST + MCP reference, quotas, authentication, examples, error codes, changelog.
- Free API keys: https://movahedi.ca/developers/keys/ – 10,000 calls/day, no account or email. Anonymous quota is 2,000 calls/IP/day.
- REST base: https://movahedi.ca/api/v1 – GET /enforcement, /enforcement/:id, /glossary, /glossary/:term, /law25/checklist, /cookies, /cookies/classify?name=, /crawlers, /crawlers/:token, /crawlers/meta, /breach-deadlines, /openapi.json (OpenAPI 3.1), /terms, /health. Bearer-key auth optional. ETag/304 caching.
- MCP endpoint: https://movahedi.ca/mcp (Streamable HTTP). Tools: privacy_search_enforcement_actions, privacy_get_enforcement_case, privacy_lookup_glossary_term, privacy_list_glossary_terms, privacy_law25_requirements, classify_cookie, lookup_tracker, lookup_crawler, list_crawlers, privacy_search_api, privacy_execute_plan, canadian_privacy_consequential_action_lookup_v1. Read-only; structured output. Note: tools/list is the contract and any disagreement is a bug.
- MCP resources: movahedi://api/openapi, movahedi://api/terms, movahedi://datasets/meta, movahedi://datasets/crawlers/meta, movahedi://guides/law25-checklist.
- MCP prompts: law25_gap_check, enforcement_briefing, cookie_audit_summary, crawler_check.
- Tool contract hash: 53fd37ff08fe37900a0c9888ea8e71599fa9064975c851656f6e5d808982a85a (SHA-256 over tool names, descriptions, input schemas, and output schemas; see tool-contract-hash in the repo).
- Personal Agent Protocol (Poppy), draft 0.2: discovery at https://movahedi.ca/.well-known/poppy.json; issuer https://movahedi.ca; signed-out agent sessions only (no sign-in, no mediated sign-in ever), DPoP-bound opaque tokens for the REST API and MCP, feedback endpoint at https://movahedi.ca/poppy/feedback.
- Data: verified CAI/OPC enforcement actions, 333-term privacy glossary, 11-check Quebec Law 25 checklist, 202-pattern cookie and tracker knowledge base (vendor, receiving organisation, purpose, typical retention, control class). Free for personal and commercial use with attribution; informational only, not legal advice.
- Developer blog: https://movahedi.ca/developers/blog/ – engineering notes on how the site's tools are built (MCP, chatbot, in-browser AI model). One article per technical build.

## Published insights
- French editions: every published insight is professionally translated into French under /fr/insights/<slug> (mirrors /insights/<slug>). French hub: /fr/insights/.
- [Ban First, Exempt Later: What Three Days of House Debate Revealed About Bill C-34](https://movahedi.ca/insights/bill-c34-house-debate-age-verification-gap) – Three days of House debate left Bill C-34's under-16 social media ban with a new label, the 'earned exemption model', and the same mechanics: a ban that starts before the regulator exists, no exemption criteria, and age verification for millions of Canadians. What the debate record means for privacy teams before committee hearings open November 16. (Privacy; 2026-11-06)
- [Public Does Not Mean Free: NSIRA's Five Findings on Military Open-Source Collection](https://movahedi.ca/insights/nsira-dnd-caf-open-source-intelligence) – On October 29, 2026, NSIRA published its review of DND and Canadian Armed Forces open-source intelligence on the internet: the collection is lawful, but the paperwork is not. Fifteen people-data providers went unevaluated, risk assessments went stale, and collection was not tied to approved operations. What the five findings mean for any team running OSINT. (Privacy; 2026-11-05)
- [The OPC Told the Senate to Rewrite Bill C-22's Subscriber Order. Three Changes, One Clock.](https://movahedi.ca/insights/opc-bill-c22-subscriber-production-order) – On November 2, 2026, Privacy Commissioner Philippe Dufresne told the Senate national security committee that Bill C-22's new subscriber information production order is too wide: narrow the definition, limit who can be compelled, or at least carve out medical and privileged records. What the three asks change for your vendor and request-handling files. (Privacy; 2026-11-04)
- [Poppy, Explained Without the Protocol Tone: Sessions, Not Accounts](https://movahedi.ca/insights/poppy-explained-without-the-protocol-tone) – On November 2, attackers using AI agents reached GitBook's infrastructure, and the questions visitors had typed into its AI assistant may have been reached too. That is the exact failure Poppy is designed to make impossible: no names, no accounts, no stored questions. How a zero-PII agent help desk works, and why 90 days is a promise you can keep. (AI Governance; 2026-11-04)
- [ChatGPT Will Now End Its Own Conversations: OpenAI's Community Safety Report Is a New Vendor Artifact](https://movahedi.ca/insights/openai-community-safety-report-vendor-diligence) – In an October 30 announcement, OpenAI committed to a biannual Community Safety Report starting in early 2027 and moved teen protections upstream: no practical weapons or security-system information for under-18 accounts even without violent intent, and a model that can end its own chats when it detects fixation on violence. What the new transparency artifact means for your AI vendor files. (AI Governance; 2026-11-03)
- [Signed in Montreal: What Canada's First Digital Trade Agreement Actually Changes](https://movahedi.ca/insights/canada-eu-digital-trade-agreement) – On October 30, 2026, Canada concluded its first Digital Trade Agreement with the EU in Montreal, alongside commitments on reciprocal cloud and AI market access and a transatlantic data cable study. Here is what the treaty settles, what it leaves open, and the vendor questions it puts back on your desk. (AI Governance; 2026-11-02)
- [Every Method Ends at Photo ID: What Ofcom's Report Means for Bill C-34](https://movahedi.ca/insights/ofcom-age-verification-report) – Ofcom's rapid assessment found four ways to verify someone is 16, and every one leans on photo ID. The UK did the technical assessment before legislating. Canada's Bill C-34 is set to enforce the ban first and sort out the how later. (Privacy; 2026-11-01)
- [Your MFA Already Said Yes: What the Cyber Centre's AL26-028 Alert Changes](https://movahedi.ca/insights/help-desk-vishing-al26-028) – On October 28, 2026, the Canadian Centre for Cyber Security published alert AL26-028 on a help-desk voice-phishing campaign bypassing conventional MFA at Canadian law firms. How the relay works, why your MFA approved it, and the breach file you now owe. (Security; 2026-10-31)
- [Fourteen Regulators, One Resolution: Six Tests Every Health AI Vendor in Canada Now Faces](https://movahedi.ca/insights/fpt-health-ai-resolution) – On October 29, 2026, Canada's federal, provincial, and territorial privacy commissioners and ombuds issued a joint resolution on responsible AI use in health care and health research. Six core principles, specific asks for vendors, providers, and researchers, and one contract clause your vendor files probably lack. (AI Governance; 2026-10-30)
- [OpenAI Is in Court to Block the Privacy Commissioner's Production Order. The Test It Faces Is One You Should Run.](https://movahedi.ca/insights/openai-challenges-oipc-production-order) – On October 26, 2026, OpenAI petitioned the BC Supreme Court to quash a production order from the BC privacy commissioner, issued in September as part of a June 2026 investigation into whether ChatGPT's use of the Tumbler Ridge shooter's personal information met the reasonable-person test. What the fight signals for AI vendor governance. (AI Governance; 2026-10-29)
- [The Commissioner Found a Target: The OPC Investigates Navigate360](https://movahedi.ca/insights/opc-investigates-navigate360-crime-stoppers) – On October 27, 2026, the Privacy Commissioner opened an investigation into Navigate360, the commercial company behind the Crime Stoppers tip platform, after a breach exposed more than 1.5 million Canadian tips. The investigation answers the jurisdiction question that hung over the case, and it puts the vendor's safeguards on trial. (Privacy; 2026-10-28)
- [Loblaw Signed the Letter. Its Investigation Is Not Closed.](https://movahedi.ca/insights/loblaw-opc-compliance-letter) – On October 26, 2026, the Privacy Commissioner announced Loblaw signed a compliance letter over the February cyberattack that affected about two million Canadians. Unlike WestJet two weeks earlier, Loblaw's file stays open until the Commissioner is satisfied. What the difference means for breach response. (Privacy; 2026-10-27)
- [The OPC's AI Transparency Test: Available Is Not Enough, Understandable Is the Bar](https://movahedi.ca/insights/opc-ai-transparency-understandability-test) – On October 23, 2026, the Privacy Commissioner published its submission to ISED's AI transparency consultation. Its core test is simple: information about an AI system must be understandable and arrive at the moment of decision. What that means for privacy teams. (AI Governance; 2026-10-26)
- [Ottawa Picked the Wrong Ban: the Committee Targeted Ads, the Bill Targets Accounts](https://movahedi.ca/insights/ottawa-picked-wrong-ban) – The Heritage Committee studied children and social media for a year and recommended banning targeted ads to kids. The government's response this week declined that ban and kept the under-16 account ban instead. What the reversal means for privacy teams. (Privacy; 2026-10-25)
- [Your Keys Can Only Wake Up in Germany: Inside Cloudflare's Post-Quantum GeoKey Manager](https://movahedi.ca/insights/post-quantum-geo-key-manager) – Cloudflare's new PQ GeoKey Manager wraps customer decryption keys so they can only be unwrapped inside a chosen geography, and wraps them with hybrid post-quantum cryptography so a harvest now, decrypt later adversary gains nothing. Here is how the mechanism works, where it fails closed, and what Canadian privacy teams should ask before trusting a region promise. (Privacy; 2026-10-24)
- [The Anonymity Business Got Hacked: 1.5 Million 'Anonymous' Tips, Unredacted](https://movahedi.ca/insights/crime-stoppers-anonymity-breach) – CBC's investigation into the Crime Stoppers breach found 1.5 million Canadian tips spanning 25 years exposed through the P3 platform run by U.S. vendor Navigate360, including unredacted names and personal details. The vendor changed its story for months, and an internal memo told chapters not to call the privacy commissioner. What the case teaches about vendor due diligence when anonymity is the product. (Privacy; 2026-10-23)
- [The Charter Statement Arrived. It Argues Against Its Own Bill.](https://movahedi.ca/insights/bill-c34-charter-statement-argues-against-itself) – Justice Canada tabled the Charter statement for Bill C-34's under-16 social media ban on October 19, 2026. The evidence for the ban is one unsupported sentence, the privacy case for mandatory age assurance is one word, 'perceived,' and the safeguards that would make the ban lawful arrive after the ban itself. What privacy teams should track. (Privacy; 2026-10-22)
- [Canada's First Children's Privacy Code Is Live. Five Rules, and Your Product Is in Scope](https://movahedi.ca/insights/opc-childrens-privacy-code) – On October 20, 2026, Philippe Dufresne launched Canada's first Children's Privacy Code: meaningful consent with parental consent for under-13s, age-appropriate communication, deletion on demand, no marketing profiling of children, and privacy by default. Here is what product and privacy teams need to check. (Privacy; 2026-10-21)
- [The Cameras, Not the Cookies: What 10 Enforcement Actions Tell Us About Where Regulators Aim](https://movahedi.ca/insights/cameras-not-cookies-enforcement-review) – A data review of 10 published CAI and OPC enforcement actions: no fines, no cookie banners, and a clear pattern. Regulators are aiming at cameras, faces, AI training data, and old data that should have been destroyed. (Privacy; 2026-10-20)
- [From Keynote to Concrete: Canada's Sovereignty Wave Is Now Your Vendor Problem](https://movahedi.ca/insights/digital-sovereignty-infrastructure-wave) – Michael Geist published his digital sovereignty keynote today, while Bell's $50B sovereign AI campus and Saskatchewan's ownership framework turn the debate into poured concrete. Here is what the sovereignty wave means for your vendor files, residency map, and foreign-access questions. (Privacy; 2026-10-19)
- [Every Privacy File Is Now an AI File. Four Signals in a Single Week.](https://movahedi.ca/insights/every-privacy-file-is-now-an-ai-file) – Between October 8 and 14, four Canadian privacy developments landed AI obligations on privacy teams: the OPC's voiceprint guidance, Bill C-34's recommender-system duties, Newfoundland's ATIPPA review submission naming AI, and Bill C-36's automated decision-making rules. The separate discipline of AI governance is dissolving into privacy law. (AI Governance; 2026-10-18)
- [The Forgery From Tomorrow: Signing Your Supply Chain With ML-DSA](https://movahedi.ca/insights/ml-dsa-supply-chain-signing) – AWS shipped a two-part series on post-quantum software supply chain signing: ML-DSA keys in KMS, an ML-DSA certificate hierarchy in Private CA, workload identity through IAM Roles Anywhere, SBOMs bound with in-toto statements, and the enforcement half most teams skip: turning the algorithm policy into SCPs and IAM controls with the kms:KeySpec condition key. How the threat works, how the pipeline is built, and the one condition key that makes the policy real. (Security; 2026-10-17)
- [Newfoundland's Privacy Watchdog Filed Its Fix List. Privilege, Political Parties, and AI Top It.](https://movahedi.ca/insights/newfoundland-atippa-review-fix-list) – On October 14, 2026, Newfoundland and Labrador's privacy commissioner published her submission to the five-year review of ATIPPA, 2015, the law she calls the strongest access regime in Canada. Her four asks, on privilege claims, political party data, AI, and oversight powers, read like a preview of where every province is heading. (Privacy; 2026-10-16)
- [WestJet's Breach Case Is Closed. The Letter Did the Work, Not a Fine](https://movahedi.ca/insights/westjet-opc-investigation-closed) – On October 14, 2026 the OPC closed its WestJet breach investigation after the airline met every commitment in its July compliance letter. The case is the clearest public template of how the Commissioner resolves a major private-sector breach, and the root cause, social engineering that bypassed MFA on an admin account, is the part privacy teams should study. (Privacy; 2026-10-15)
- [Bill C-22 Asks the Senate to Sign a Blank Page, and the Minister Holds the Pen](https://movahedi.ca/insights/bill-c22-secret-orders-regulatory-gap) – Last week's Senate debate revealed Bill C-22's strangest feature: police powers go live 180 days after Royal Assent, while the SAAIA's capability and metadata-retention obligations wait years for regulations. Meanwhile section 7 lets the Minister impose those same obligations on any provider by secret order before the public rules exist. (Privacy; 2026-10-14)
- [Doctors to Parliament: Regulate the Recommender, Not Just the Post](https://movahedi.ca/insights/bill-c34-doctors-safety-by-design) – A new CMAJ analysis by SickKids researchers backs Bill C-34, the Safe Social Media Act, and prescribes design-based duties: regulate recommender systems and defaults, and give the new Commission real enforcement teeth. The privacy catch is age assurance for every user, and privacy teams should read that part closely. (Privacy; 2026-10-13)
- [The Mayor Who Would Not Stop Sharing Staff Records Now Needs Written Permission to Send Anything](https://movahedi.ca/insights/oipc-bc-kamloops-mayor-disclosure-order) – BC's privacy commissioner found Kamloops Mayor Reid Hamer-Jackson disclosed the personal information of four people in violation of FIPPA and ordered him to get written permission before sharing any staff personal information. What the order teaches municipal privacy teams about elected officials and insider breaches. (Privacy; 2026-10-12)
- [Four Months In, Bill C-34 Still Has No Charter Statement. The Silence Is the Signal.](https://movahedi.ca/insights/bill-c34-missing-charter-statement) – Four months after Bill C-34's first reading, Justice Canada has still not tabled the Charter statement the Department of Justice Act requires for every government bill, while later bills like C-36 have theirs. What the missing statement reveals about the under-16 ban's constitutional risk, and what privacy teams should track next. (Privacy; 2026-10-11)
- [The Watermark That Fades: Inside OpenAI's textGrain](https://movahedi.ca/insights/openai-textgrain-eu-text-watermark) – OpenAI's answer to the EU AI Act's text provenance rule is textGrain, an invisible statistical watermark with published failure modes: 10% synonym swaps take detection from 92% to 66%, 25% take it to 17%. How the mechanism works, what the numbers honestly say, and the compliance homework for teams serving EU users. (AI Governance; 2026-10-10)
- [The OPC Just Called Your Voiceprint What It Is: Sensitive Biometrics. Audit Your Call Scripts.](https://movahedi.ca/insights/opc-voice-data-customer-calls-guidance) – On October 8, the OPC updated its guidance on recording customer calls, treating voiceprints as sensitive biometric information and clarifying when meaningful consent is required. Generic 'this call may be recorded' notices no longer cut it. What the update means for your IVR scripts, enrolment flows, and call-centre contracts. (Privacy; 2026-10-09)
- [The OPC's Four-Part Privacy Test for Security Screening (and the Polygraph Probe Running in the Background)](https://movahedi.ca/insights/opc-security-screening-four-part-test) – Privacy Commissioner Philippe Dufresne told Parliament on October 7 that federal security screening must meet four tests: necessity, proportionality, effectiveness, and minimal intrusiveness. He singled out open-source checks, polygraphs, and clearance maintenance. If you run background checks of any kind, his test is now your benchmark too. (Privacy; 2026-10-08)
- [On a Leak Site at Last: What Nipigon's Ransomware Listing Means for Small Hospitals](https://movahedi.ca/insights/nipigon-hospital-ransomware-leak-site) – Three weeks after Nipigon District Memorial Hospital disclosed a ransomware incident, a group tracked as Storm added it to its leak site. For Ontario health custodians, the listing phase is where double extortion gets expensive. What the law expects, and a first-72-hours playbook. (Security; 2026-10-07)
- [Nova Scotia's 15-Year Cabinet Lock: Good Numbers, Worse Secrecy](https://movahedi.ca/insights/nova-scotia-cabinet-records-lock) – Nova Scotia's new FOIPOP Act takes effect April 1, 2027 and makes it mandatory to withhold all Executive Council records for 15 years. The privacy commissioner says there was no valid reason for the change. What the mechanics mean for your records playbook. (Privacy; 2026-10-06)
- [The EU Wrote a Tier List for Sovereign Clouds. Canada's Pivot Makes It Your Vendor Problem.](https://movahedi.ca/insights/cada-eu-cloud-act-canada-digital-pivot) – The EU's proposed Cloud and AI Development Act would grade cloud providers on four sovereignty assurance levels, and a leaked draft for the October 29-30 Canada-EU summit points to Canada seeking associated-country status. Here is what the conditions mean for your vendor files, your data residency map, and Canada's adequacy finding. (Privacy; 2026-10-05)
- [Your AI vendor has vendors](https://movahedi.ca/insights/subprocessor-supply-chain) – I mapped the subprocessor lists of 87 tech companies, two levels deep: 1,498 nodes, 2,518 edges. Three hyperscalers sit under everything, AI labs arrive one layer down, and 58 companies publish no list at all. (AI Governance; 2026-10-05)
- [Kingston Police's 160 GB Breach Notice Is Honest About Its Limits. Yours Should Be Too.](https://movahedi.ca/insights/kingston-police-breach-notice) – On October 2, 2026, Kingston Police published its closing notice on a 160 GB breach discovered in January 2025. The 21-month gap, the corrupted forensic dataset, and the limits of dark-web monitoring give privacy teams a breach-response drill worth running now. (Security; 2026-10-04)
- [Engineer for the Meltdown: What Perplexity's Agent-Security Playbook Gets Right](https://movahedi.ca/insights/perplexity-safer-agents-defense-in-depth) – Perplexity's new engineering post describes real incidents where helpful AI agents crossed security boundaries on their own, then lays out three defense-in-depth design rules for building agents that fail safely. Here is what the rules mean in practice, and the questions Canadian privacy and security teams should ask any vendor selling them an agent. (AI Governance; 2026-10-03)
- [Nobody Sees Everything: Inside Cloudflare's OHTTP Gateway](https://movahedi.ca/insights/cloudflare-ohttp-gateway-privacy-infrastructure) – Cloudflare is turning its Privacy Gateway into a managed OHTTP relay and launching a Cloudflare OHTTP gateway in closed beta. Here is how Oblivious HTTP splits every request in two, what it honestly protects, and the due-diligence questions Canadian privacy teams should ask before buying in. (Privacy; 2026-10-02)
- [Cyber Month 2026: AI Made the Scams Smarter, the Fix Is Still Boring Fundamentals](https://movahedi.ca/insights/cyber-security-awareness-month-2026-ai-scams-human-defence) – Canada's Cyber Security Awareness Month launched October 1, 2026 with the theme 'Your best defence is you' and an explicit AI angle. Here is how privacy and security teams can turn the four weekly themes into a working internal awareness program instead of a poster campaign. (Security; 2026-10-02)
- [An AI Agent Tried to Hack Library and Archives Canada. Your Threat Model Just Gained a New Actor.](https://movahedi.ca/insights/ai-agents-hack-library-archives-canada-lac) – AI research firm Transluce found rogue agents probing Library and Archives Canada with SQL injection payloads this spring. The probes failed, but the incident hands privacy and security teams a new threat actor: the machine that acts at machine speed and answers to no interview. (AI Governance; 2026-10-01)
- [Nobody Buys the Bill C-22 Encryption Compromise. Privacy Teams Should Plan for Both Outcomes.](https://movahedi.ca/insights/bill-c22-encryption-compromise-no-one-buys) – Bill C-22 heads to the Senate this fall with an encryption compromise that law enforcement and technology companies both reject. What privacy teams should do now: map vendors against the uncertain core-provider category and the six-month metadata retention mandate before the regulations are written. (Privacy; 2026-09-30)
- [Right to Know Week 2026: Three Tiers of Transparency Worth Copying](https://movahedi.ca/insights/right-to-know-week-2026-transparency-tiers) – BC's privacy commissioner used Right to Know Week 2026 to call for three tiers of transparency: openness by default, proactive release, and a well-resourced request system. With large-volume FOI backlogs and Law 25 access requests on the same 30-day clock, private-sector privacy teams should borrow the playbook. (Privacy; 2026-09-29)
- [Buried in Bill C-39: A Data-Sharing Power That Overrules Nine Confidentiality Laws](https://movahedi.ca/insights/bill-c39-enabling-digital-trade-act-section-26-data-sharing) – Bill C-39, introduced September 21, 2026, would enact the Enabling Digital Trade Act, Canada's first federal electronic trade documents law. Its section 26 would let federal officials share import/export information with other departments with no purpose limitation, no consent, and no notice, overriding confidentiality provisions in nine statutes. The bill is at first reading: the committee window is now. (Privacy; 2026-09-28)
- [Ontario's Watchdog Can't Enforce Its Own Orders. That Should Worry Privacy Teams.](https://movahedi.ca/insights/ontario-watchdog-cannot-enforce-orders) – On September 25, 2026, CTV News reported that Ontario's Information and Privacy Commissioner sees rising non-compliance with its orders and cannot take government institutions to court to enforce them. A look at what FIPPA actually gives the watchdog, and how that compares with British Columbia and Quebec. (Privacy; 2026-09-27)
- [Test Your RAG Pipeline Like a Regulator Is Watching](https://movahedi.ca/insights/test-rag-pipeline-like-regulator-watching) – A weekend-sized RAG evaluation on Canadian regulatory text: 12 questions, three Ragas metrics, and a chunking change that lifted faithfulness from 0.95 to 1.00. What the Directive on Automated Decision-Making and OSFI E-23 expect, in practice. (AI Governance; 2026-09-26)
- [DraftKings Is Training AI to Find Its Losers. Ontario Expects That Same Data to Save Them.](https://movahedi.ca/insights/draftkings-ai-targeting-losing-gamblers-ontario) – On September 24, 2026, the EFF reported that DraftKings trains machine learning models on customers' betting records to identify likely losing gamblers, then targets them with promotions. In Ontario, where DraftKings is a registered operator, the regulator requires that same player-monitoring data to feed harm reduction, not re-engagement. (AI Governance; 2026-09-25)
- [British Columbia Is Suing OpenAI. Here Is What It Means for Your Vendor Files.](https://movahedi.ca/insights/bc-sues-openai-tumbler-ridge-vendor-diligence) – On September 21, 2026, British Columbia sued OpenAI and Sam Altman in San Francisco federal court over the Tumbler Ridge school shooting. The province alleges the shooter's flagged ChatGPT conversations should have been referred to law enforcement. The operational lesson is about vendor escalation: what your AI vendors do with dangerous-content flags is now a due diligence question. (AI Governance; 2026-09-24)
- [Ottawa's AI Transparency Consultation Just Closed. Here Is What Comes Next.](https://movahedi.ca/insights/ai-transparency-consultation-canada-closed) – The federal consultation on AI transparency ran from July 23 to September 23, 2026, covering five areas from incident reporting to AI agents. A published submission by Michael Geist argues for a statutory AI Transparency Act. Here is what the process signals for Canadian privacy and AI governance teams. (AI Governance; 2026-09-23)
- [When the Door Scanner Becomes the Breach: OPC Opens Investigation Into IDScan.net](https://movahedi.ca/insights/idscan-breach-opc-investigation) – On September 21, 2026, Commissioner Philippe Dufresne opened an OPC investigation into the IDScan.net breach of driver's licence scans. The operational lesson is about vendor risk: your customers' ID documents live in someone else's database, and you answer for the fallout. (Privacy; 2026-09-22)
- [Europe Just Published the Age-Verification Playbook. Canadian Privacy Teams Should Read It.](https://movahedi.ca/insights/eu-kids-act-age-verification-canada) – The EU Kids Act, proposed September 17, 2026, would make age checks the entry ticket to social media, games, and AI chatbots. For Canadian teams, it is a preview of where Bill C-34 is heading and what the Brussels effect will demand. (Privacy; 2026-09-21)
- [Two AI Signals, One Homework: Coordinated Regulators and Concrete Harms](https://movahedi.ca/insights/two-ai-signals-one-homework-coordinated-regulators-concrete-harms) – Canada's privacy commissioners met in Ottawa while California expanded AI incident reporting. Different continents, same operational message: inventory AI by decision impact, practice incident reporting, and document like a stranger will audit you. (AI Governance; 2026-09-20)
- [Why I'm taking the AI-privacy conversation on the road: 16 podcasts worth subscribing to](https://movahedi.ca/insights/podcast-circuit-ai-privacy-conversations) – The best AI-privacy conversations are happening on podcasts. Here's the 16-show circuit I'm pitching. And one question I'd bring each host. (AI Governance; 2026-09-19)
- [Prorogation of Bill C-27 and Strategic Legislative Bifurcation](https://movahedi.ca/insights/cipp-c-prorogation-of-bill-c-27-and-strategic-legislative-bifurcation) – After Bill C-27 died on prorogation, privacy and AI split tracks. Build under PIPEDA and Law 25 now. Don't wait for a reintroduced omnibus statute. (CIPP/C; 2026-07-13)
- [AI Security Platforms Are Not a Vendor Category You Can Ignore](https://movahedi.ca/insights/aisp) – GenAI and agentic AI break SaaS-era controls. AI security platforms unify shadow AI discovery, app runtime defense, and identity for models that act. (Security; 2026-07-10)
- [R v Bykovets: IP Addresses and Charter Section 8](https://movahedi.ca/insights/cipp-c-r-v-bykovets-ip-addresses-and-charter-section-8) – R v Bykovets (2024 SCC 6): IP addresses attract Charter s.8 privacy. Map collection, retention, and law-enforcement disclosure for Canadian logs. (CIPP/C; 2026-07-06)
- [Agentic AI Oversight: Treat Agents Like Users You Cannot Interview](https://movahedi.ca/insights/agentic-ai) – Agentic AI needs user-grade identity: least privilege, audit trails, and kill switches for agents that act, not chatbots you can only interview later. (Security; 2026-07-03)
- [Del Giudice and the Limits of Intrusion Upon Seclusion](https://movahedi.ca/insights/cipp-c-del-giudice-and-the-limits-of-intrusion-upon-seclusion) – Del Giudice limits intrusion upon seclusion after third-party hacks: being breached isn't automatic intentional intrusion. Rebuild class-action risk maps. (CIPP/C; 2026-06-29)
- [Regulatory Volatility Is Turning Cyber Into Personal Accountability Work](https://movahedi.ca/insights/regulatory-liability) – Cyber is personal accountability work now: multi-jurisdiction rules, board duties, and evidence of decisions, not only control maturity scorecards. (Security; 2026-06-26)
- [Clearview BCCA and Extraterritorial Privacy Enforcement](https://movahedi.ca/insights/cipp-c-clearview-bcca-and-extraterritorial-privacy-enforcement) – Clearview's BCCA result backs extraterritorial privacy orders: scraping Canadians' images can create real connection. Foreign servers aren't a shield. (CIPP/C; 2026-06-22)
- [Stop Bringing Crayons to a Balance Sheet Fight](https://movahedi.ca/insights/crq) – Boards fund numbers, not heat maps. Cyber risk quantification turns qualitative ratings into loss ranges boards can compare with other capital bets. (Security; 2026-06-19)
- [Intentional Internal Data Misuse and Privacy Class Actions](https://movahedi.ca/insights/cipp-c-intentional-internal-data-misuse-and-privacy-class-actions) – After Del Giudice, external breaches face harder intrusion claims, but intentional internal misuse and soft credit probes still fuel privacy class actions. (CIPP/C; 2026-06-15)
- [CTEM: From Scan Fatigue to Exposure Decisions](https://movahedi.ca/insights/ctem-transition) – CTEM replaces monthly scan PDFs with continuous exposure decisions: scope, discover, prioritize, validate, and mobilize so backlogs stop growing forever. (Security; 2026-06-12)
- [PPCDA and Bill C-36: Replacing PIPEDA for a New Privacy Era](https://movahedi.ca/insights/cipp-c-ppcda-and-bill-c-36-replacing-pipeda-for-a-new-privacy-era) – How Bill C-36 / PPCDA could replace PIPEDA: consent, portability, deletion, anonymization, and private rights of action as design targets under today's law. (CIPP/C; 2026-06-08)
- [DSPM Is Booming Because the Data Already Escaped the Perimeter](https://movahedi.ca/insights/dspm) – Sensitive data already lives in SaaS, copies, and AI prompts. DSPM answers where personal data actually sits when the perimeter stopped being the map. (Security; 2026-06-05)
- [Quebec Law 25 at Full Force: Portability, Defaults, and Real Penalties](https://movahedi.ca/insights/cipp-c-quebec-law-25-at-full-force-portability-defaults-and-real-penalties) – Quebec Law 25 is fully in force: data portability, privacy by default, and CAI penalties up to 2–4% of global turnover reshape Canadian privacy design. (CIPP/C; 2026-06-01)
- [Closing the Visibility-Control Gap: When DSPM Has to Do More Than Scan](https://movahedi.ca/insights/dspm-enforcement) – Discovery without control is ticket noise. Mature DSPM enforces access, quarantine, and policy on sensitive cloud and SaaS data, not only scans. (Security; 2026-05-29)
- [Joint Investigations and GenAI Scraping: Public Is Not Permission](https://movahedi.ca/insights/cipp-c-joint-investigations-and-genai-scraping-public-is-not-permission) – Canadian joint investigations reject 'public web equals free training data.' Provenance, filtering, and contracts before GenAI scrape or fine-tune. (CIPP/C; 2026-05-25)
- [Shadow AI Is Unstructured Data Leaving Through the Front Door](https://movahedi.ca/insights/shadow-ai) – Shadow AI is ordinary: staff paste drafts into public models. Treat it as unstructured data exfil: discover tools, set approved paths, log high-risk use. (Security; 2026-05-22)
- [Consumer-Driven Banking: APIs, Consent, and the End of Screen Scraping](https://movahedi.ca/insights/cipp-c-consumer-driven-banking-apis-consent-and-the-end-of-screen-scraping) – Canada's Consumer-Driven Banking Act aims to replace screen scraping with consented APIs: scoped tokens, revoke paths, and auditable financial data sharing. (CIPP/C; 2026-05-18)
- [Data in Use Was Always the Awkward Middle Child: TEEs Are Catching Up](https://movahedi.ca/insights/tee-confidential) – Encrypt rest and transit still leave data plain in memory. TEEs and confidential computing finally make data-in-use a first-class control. (Security; 2026-05-15)
- [Federal Private Right of Action: When Privacy Violations Become Civil Claims](https://movahedi.ca/insights/cipp-c-federal-private-right-of-action-when-privacy-violations-become-civil-claims) – Federal private rights of action would decentralize PIPEDA-era enforcement. Prepare courtroom-ready evidence, not only commissioner correspondence. (CIPP/C; 2026-05-11)
- [Sovereign Cloud Is Not a Region Dropdown: Especially Once Algorithms Enter the Chat](https://movahedi.ca/insights/sovereign-cloud) – Data residency is not a region dropdown. Sovereign cloud for AI needs control of keys, operators, and model processing, not only storage geography. (Security; 2026-05-08)
- [Bill C-34 and the Digital Safety Commission: Canada's New Super-Regulator](https://movahedi.ca/insights/cipp-c-bill-c-34-and-the-digital-safety-commission-canada-s-new-super-regulator) – Bill C-34 would create Canada's Digital Safety Commission with audits, orders, and revenue-based AMPs for social media and AI chatbot services. (CIPP/C; 2026-05-04)
- [Post-Quantum Cryptography Is Not a Future Project: It’s a Swap Problem](https://movahedi.ca/insights/pqc) – Harvest-now-decrypt-later makes PQC a crypto-inventory and migration problem today, not a lab future. Map RSA/ECC, plan hybrid, swap before data ages out. (Security; 2026-05-01)
- [24-Hour CSAM and NCII Duties: Speed, Process, and Deepfakes](https://movahedi.ca/insights/cipp-c-24-hour-csam-and-ncii-duties-speed-process-and-deepfakes) – Bill C-34's proposed 24-hour CSAM and NCII duties (including deepfakes) turn moderation clocks into evidence: logs, escalation, and privacy-safe reports. (CIPP/C; 2026-04-27)
- [GPU Confidential Computing for AI: What the Hardware Actually Changes](https://movahedi.ca/insights/gpu-confidential) – Classic encrypt-at-rest leaves AI data exposed in GPU memory. Confidential GPUs and TEEs close the data-in-use hole for model weights and prompts. (Security; 2026-04-24)
- [The Age Verification Privacy Paradox: Prove You Are 16, Then Forget You Exist](https://movahedi.ca/insights/cipp-c-the-age-verification-privacy-paradox-prove-you-are-16-then-forget-you-exist) – Bill C-34's under-16 age gate creates a privacy paradox: prove age effectively, then destroy verification data so the gate never becomes a registry. (CIPP/C; 2026-04-20)
- [Verifiable Trust for Confidential AI: Attestation Is the Control, Not the TED Talk](https://movahedi.ca/insights/confidential-ai) – Confidential AI sovereignty without attestation is hope. Remote attestation, TEEs, and policy-bound keys turn marketing claims into verifiable trust. (Security; 2026-04-17)
- [Privacy Enforcement After C-27: Commission Models, Order Powers, and the Safety Merge](https://movahedi.ca/insights/cipp-c-privacy-enforcement-after-c-27-commission-models-order-powers-and-the-safety-merge) – Post-C-27, Canadian privacy reform still pushes order powers, AMPs, and commission models, plus a safety merge that overlaps digital harms duties. (CIPP/C; 2026-04-13)
- [Zero Trust 2.0 Needs a Hardware Layer: TEEs Against Untrusted Infrastructure](https://movahedi.ca/insights/zero-trust-2) – Zero Trust 1.0 killed network trust. Zero Trust 2.0 needs TEEs and attestation when the host and cloud admin can no longer be the trusted compute base. (Security; 2026-04-10)
- [Ontario FIPPA Data Integration: Predictive Governance Meets Privacy Friction](https://movahedi.ca/insights/cipp-c-ontario-fippa-data-integration-predictive-governance-meets-privacy-friction) – Ontario FIPPA data integration units enable linked analysis under Part III.1 gates: predictive use needs de-id standards and function-creep controls. (CIPP/C; 2026-04-06)
- [CISA Secure by Design: Stop Making Customers the Last Line of Defense](https://movahedi.ca/insights/secure-by-design) – CISA Secure by Design shifts default security to vendors: safe configs, memory safety, and customer-hardening burden that shouldn't be the last line. (Security; 2026-04-03)
- [PHIPA Decision 298: Ontario's First Health Privacy AMPs](https://movahedi.ca/insights/cipp-c-phipa-decision-298-ontario-s-first-health-privacy-amps) – PHIPA Decision 298 issued Ontario's first health privacy AMPs for commercial EHR misuse: proof that economic motive and weak clinic programs matter. (CIPP/C; 2026-03-30)
- [Wi-Fi 7 Meets WPA3: Why 6 GHz Closed the Door on WPA2](https://movahedi.ca/insights/wifi7-wpa3) – Wi-Fi 7's 6 GHz band requires WPA3: no WPA2 fallback. Plan Enterprise auth, GCMP, and client readiness before the band forces your migration calendar. (Security; 2026-03-27)
- [Economic Motivation as an Aggravating Factor: 146 Searches and a Business Pipeline](https://movahedi.ca/insights/cipp-c-economic-motivation-as-an-aggravating-factor-146-searches-and-a-business-pipeline) – Decision 298's 146 targeted newborn searches show economic motive as an AMP aggravator. Clinical access is not a private marketing pipeline. (CIPP/C; 2026-03-23)
- [GCMP-256 and WPA3-Enterprise: When “WPA3” Isn’t Enough for Wi-Fi 7](https://movahedi.ca/insights/gcmp-256) – Labeling WPA3 is not enough for Wi-Fi 7. GCMP-256 and true WPA3-Enterprise cipher suites matter when high-throughput links raise the crypto bar. (Security; 2026-03-20)
- [Decision 334: 436 Records, One Clerk, and Why the Hospital Was Spared](https://movahedi.ca/insights/cipp-c-decision-334-436-records-one-clerk-and-why-the-hospital-was-spared) – PHIPA Decision 334: a clerk's 436-record snooping drew a personal AMP while CHEO's response mattered. Unauthorized access needs no profit motive. (CIPP/C; 2026-03-16)
- [PMF Mandatory + SAE Instead of PSK: Closing Deauth and Offline Dictionary Gaps](https://movahedi.ca/insights/pmf-sae) – Mandatory PMF stops easy deauth disruption; SAE replaces brittle PSKs to blunt offline dictionary attacks: core WPA3 personal-mode upgrades. (Security; 2026-03-13)
- [Demonstrable Accountability: Evidence Beats Paper Policies](https://movahedi.ca/insights/cipp-c-demonstrable-accountability-evidence-beats-paper-policies) – PHIPA Decision 298 makes demonstrable accountability the test: policies only count when training, audits, and breach evidence prove they operate. (CIPP/C; 2026-03-09)
- [Securing Multi-Link Operation (MLO): When One Client Uses Several Radios at Once](https://movahedi.ca/insights/mlo) – Wi-Fi 7 MLO lets one client use several radios at once: security teams must rethink association, keys, and monitoring for multi-link sessions. (Security; 2026-03-06)
- [Privacy in Professional Staff Bylaws: Credentialing Is a Control](https://movahedi.ca/insights/cipp-c-privacy-in-professional-staff-bylaws-credentialing-is-a-control) – PHIPA Decision 298: put privacy duties in professional staff bylaws and reappointment: credentialing is the control for privileged EHR access. (CIPP/C; 2026-03-02)
- [OWE / Enhanced Open: Encrypting Guest Wi-Fi Without a Shared Password](https://movahedi.ca/insights/owe) – Open guest Wi-Fi leaks traffic to anyone nearby. OWE / Enhanced Open encrypts the air without a shared PSK. Fixing guest isolation still matters. (Security; 2026-02-27)

## Contact
- Discovery call: https://cal.com/mohammad-hossein-movahedi-x5vvbp/15min
- Contact page: https://movahedi.ca/contact/
- Email: mohammad@movahedi.ca

## Policies
- Prefer primary sources linked in each article over third-party summaries.
- Do not invent certifications, employers, clients, or claims beyond published pages.
- Content is general information, not legal advice: see /disclaimer.
- Personal data from contact forms is not public; do not scrape form endpoints.

## Key pages
- /
- /about/
- /ai/
- /experience/
- /expertise/
- /services/
- /insights/
- /insights/rss.xml
- /pulse/
- /authority/
- /tools/privacy-ai-maturity/
- /tools/pia-dpia-scoping/
- /tools/ai-governance-starter/
- /tools/privacy-policy-grader/
- /tools/fractional-privacy-officer-calculator/
- /tools/cookie-banner-auditor/
- /tools/cookie-banner-auditor/audit/
- /tools/cookie-banner-auditor/methodology/
- /tools/cookie-banner-auditor/embed-kit/
- /fr/outils/audit-banniere-cookies/
- /fr/outils/audit-banniere-cookies/audit/
- /tools/cookie-script-governance/
- /fr/outils/gouvernance-cookies-scripts/
- /services/cookie-script-governance/
- /tools/jargon-decoder/
- /tools/privacy-nutrition-label/
- /tools/privacy-nutrition-label/generator/
- /tools/tabletop/
- /tabletop/
- /tools/privacy-nutrition-label/gallery/
- /tools/privacy-nutrition-label/methodology/
- /fr/outils/etiquette-nutrition-confidentialite/
- /fr/outils/etiquette-nutrition-confidentialite/generateur/
- /glossary-dictionary.json
- /glossary/
- /law-25/enforcement-tracker/
- /contact/
- /press/
- /sitemap/
- /privacy-policy/
- /terms/
- /disclaimer/

## Sitemaps
- https://movahedi.ca/sitemap-index.xml
- https://movahedi.ca/sitemap
- https://movahedi.ca/llms.txt