Regulator Issues First Fine Under Canada's Anti-Spam Legislation

Federal and provincial privacy regulators have concluded a multi-year investigation into OpenAI's data practices, finding contraventions of Canadian privacy legislation in how personal information was collected and used...

Canada's privacy regulator has released new draft guidance establishing comprehensive due diligence standards for organizations evaluating third-party service providers under PIPEDA. The framework introduces eleven best practices covering everything from data flow mapping and AI training data sourcing to vendor lock-in risks and ongoing monitoring obligations, signaling heightened expectations for privacy accountability in vendor relationships.

The Canadian market is ripe with opportunities for U.S. companies seeking to expand beyond domestic borders. Before diving in, however, it can be helpful to have a basic understanding of Canada's legal system...

On March 19, 2015, the United States District Court in the District of Minnesota gave preliminary approval to a proposed settlement for the December 2013 data breach suffered by Target Corporation.

Canada's federal government has introduced Bill C-36, marking a significant departure from its predecessor Bill C-27 by unbundling AI regulation from privacy reform and establishing a new regulatory framework centered...

These regulations, which include fines of up to $100,000CAD for non-compliance, will come into force on November 1, 2018.

Since Canada's anti-spam legislation (CASL) was enacted in 2014, businesses have been faced with the challenge of keeping adequate records of their authority to send commercial electronic messages under CASL's various categories of express and implied consent.

Canada's proposed Bill C-36 introduces sweeping reforms to private sector privacy law, replacing PIPEDA with the Protecting Privacy and Consumer Data Act.

Canada's proposed Bill C-36 would fundamentally transform private-sector privacy law by replacing PIPEDA with the Protecting Privacy and Consumer Data Act. Organizations face stricter data collection tests, new consent exceptions, explicit AI governance rules, and penalties reaching $25 million or 5% of global revenue for knowing violations.

The Ontario government recently amended the Personal Health Information Protection Act (PHIPA) to include mandatory breach reporting.

The Code is voluntary, but it will likely become an important reference point for demonstrating compliance with Article 50 of the AI Act.

The Ninth Circuit Court of Appeals vacated a preliminary injunction against Perplexity AI, determining that when an AI agent acts at a user's direction, it is the user—not the AI company—who "accesses" computer systems under federal and California computer fraud statutes. This landmark appellate decision addresses how existing computer-access laws apply to agentic artificial intelligence and has significant implications...

The European Commission has proposed replacing the EU's three core procurement directives with a single, directly applicable Regulation that would fundamentally reshape how companies compete for public contracts across Member States. The reform introduces mandatory quality criteria thresholds, embeds ESG considerations as evaluation factors, and establishes new security and European-preference provisions that could restrict participation based on ownership, supply chain exposure, and strategic dependencies.

The European Commission has initiated infringement procedures against 20 EU Member States for failing to transpose the EmpCo Directive by the March 27, 2026 deadline. This directive aims to combat greenwashing by requiring substantiation of environmental claims and third-party certification for sustainability labels, with full implementation expected by September 27, 2026.

A federal court has struck down New York's Climate Change Superfund Act, which sought to recover $75 billion from fossil fuel companies based on historical emissions. The ruling found the Act preempted by the Clean Air Act, marking the first judicial decision on state climate superfund legislation and establishing that EPA's rescission of the endangerment finding does not alter preemption analysis.

Mexico's comprehensive anti-money laundering framework has undergone a sweeping transformation through Acuerdo 115/2026, introducing mandatory risk-based methodologies, enhanced client due diligence protocols, and automated monitoring requirements. With implementation deadlines beginning March 1, 2027, obligated parties conducting vulnerable activities face compressed timelines to overhaul their compliance infrastructure while navigating heightened enforcement risks and stricter beneficial ownership thresho

The European Commission has adopted final Guidelines on exclusionary abuses of dominance under Article 102 TFEU, introducing a "workable effects approach" that narrows presumptions while expanding guidance on objective justifications and recognizing sustainability benefits as valid efficiencies for the first time. These Guidelines replace the 2008 Enforcement Priorities Guidance and are expected to significantly impact enforcement practices across EU Member States and beyond, particularly for digital market

The user of defective goods benefi ts from several causes of action against the vendor or manufacturer.

On December 3, a federal court in the Central District of California granted plaintiffs' request for preliminary approval of a proposed $22 million settlement ...

The IRS has proposed new regulations that would impose nondiscrimination requirements on private schools seeking to maintain their tax-exempt status under section 501(c)(3). These regulations would prohibit policies discriminating on the basis of race, color, or national or ethnic origin in admissions, financial assistance, and other school programs. The proposed rules raise important questions about how private schools can structure their programs while complying with federal tax law requirements.