The bill establishes a provincial private right of action for invasion of privacy and defines a data-centered framework for preventing and responding to breaches. It makes certain acts—surveillance, recordings, use of intimate or artificially generated images/voices—prima facie evidence of a privacy violation, allows suits to proceed without proof of damage, and authorizes remedies including damages, injunctions and accounting for profits.
Separately, the Act imposes baseline obligations on data controllers and processors in commercial contexts to implement security measures and to destroy data at the end of prescribed retention periods. It also creates a statutory security-freeze tool for consumer reporting agencies (no fees, agencies may not factor the freeze into scores) and exposes corporations to large summary-conviction fines (up to $30 million or 4% of worldwide revenue).
Key operational details—retention periods, deadlines for freezes, and technical safeguards—are left to Governor-in-Council regulations. The Act takes effect January 1, 2026.
At a Glance
What It Does
Creates a private tort for privacy violations and treats specified conduct (surveillance, recordings, non-consensual intimate images and AI‑generated likenesses) as presumptive proof of wrongdoing. It requires commercial data controllers/processors to secure and destroy personal data per regulations and gives consumers a statutory security freeze on credit files with no charge.
Who It Affects
Commercial data controllers and processors operating in Nova Scotia, consumer reporting agencies that maintain credit files, creators and distributors of intimate or AI‑generated likenesses, and individuals whose personal data is stored or exposed by those entities.
Why It Matters
It shifts enforcement power toward private litigation (no damage threshold), increases litigation and compliance risk for businesses holding consumer data, and gives consumers a direct tool to block disclosure of credit-reporting information—while delegating many technical and timing rules to regulation.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The Act has three interlocking parts: a private cause of action for privacy invasions, substantive rules for how personal data must be maintained and destroyed, and a mechanism for consumers to freeze their credit data. The private cause of action applies where someone wilfully invades another's privacy without lawful justification; plaintiffs do not have to prove actual financial or other damages to bring suit, and courts assess the privacy owed by asking what is reasonable in the circumstances.
One distinctive feature is the evidentiary presumption: proof that a defendant engaged in certain behavior—surveillance or eavesdropping, recording conversations or messages, misusing a person’s name/likeness/voice (including AI imitations) for commercial advantage, or disseminating intimate images (including AI‑generated intimate images)—is, absent contrary evidence, proof of a privacy violation. The bill also treats social insurance numbers and banking information as categorically deserving of privacy protection when a data breach occurs.For data handlers, the Act sets minimum operational duties: controllers and processors engaged in commercial activities must implement security measures and must destroy personal data when retention periods expire.
The text bans keeping personal data longer than necessary for the purpose it was collected and disallows storage beyond retention periods set in regulation. Many of the “how” questions—what security measures are required, retention lengths, and deadlines for placing or lifting a credit freeze—are delegated to Governor‑in‑Council regulations.The consumer-facing element is a security freeze regime for consumer reporting agencies.
A Nova Scotia consumer may require a freeze by providing identity documentation; agencies must place the freeze within regulatory deadlines, may not charge for placing or removing a freeze, may not penalize consumers by downgrading credit scores for exercising the right, and must respond to consumer‑directed disclosures. Remedies available to successful plaintiffs include damages, injunctions, an order for accounting of profits, and return of materials.
Corporations that breach the Act face summary-conviction fines up to $30 million or 4% of global revenue, whichever is higher. Finally, the Act says several existing provincial statutes prevail where there is conflict and comes into force January 1, 2026.
The Five Things You Need to Know
The Act creates a private tort for violation of privacy that plaintiffs may bring without proving actual damage.
Evidence of surveillance, recordings, using someone’s likeness or voice (including AI imitations), or distributing intimate or AI‑generated intimate images is prima facie proof of a privacy violation.
A data breach counts as a privacy violation only where the controller or processor handles personal data in the course of commercial activities; social insurance numbers and banking information are always treated as protected.
Consumers can require consumer reporting agencies to place a security freeze on their credit file; agencies must honor freezes within regulatory deadlines, may not charge fees, and may not factor the exercise of the freeze into credit ratings.
Corporations face a summary‑conviction fine of up to $30,000,000 or 4% of worldwide annual revenue (whichever is higher); many technical details (security measures, retention periods, freeze deadlines) are left to Governor‑in‑Council regulation.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Definitions — broad and consequential
Section 2 supplies sweeping definitions that shape the rest of the Act. It imports standard data governance categories (data controller/processor, personal data, identifiable individual) and adds an expansive definition of “artificial intelligence system,” which expressly covers neural networks, machine learning and genetic algorithms. That breadth brings deepfake generation, voice‑cloning and other algorithmic content squarely within the law’s scope when used to create or mimic an identifiable person.
Private right of action with a reasonableness test
Section 3 makes wilful, unjustified invasions of privacy a tort and allows actions to proceed without proof of damage. Courts must apply a contextual “reasonable in the circumstances” standard that balances the claimant’s expectation of privacy against lawful interests of others. Practically, that leaves judges substantial discretion in defining the boundary between permissible conduct and actionable invasions.
Prima facie proof for surveillance, recordings and AI‑generated likenesses
Section 4 lists specific behaviors (auditory/visual surveillance, recording conversations or messages, misuse of name/likeness/voice, use or distribution of intimate images) and declares them, absent counter‑evidence, to be proof of a privacy violation. The section explicitly includes imitations created by AI systems and artificially generated intimate images, shifting the evidentiary burden toward defendants in cases involving deepfakes or non‑consensual intimate material.
When a data breach equals a privacy violation
Section 5 defines a data breach and sets a gate for civil liability: a breach is actionable only if the controller or processor was engaged in commercial activities and the breached information was reasonably expected to be protected. The section carves out domestic‑use and journalistic/artistic activities from this commercial test and names social insurance numbers and banking information as always reasonably private—effectively elevating them to a per se protected category.
Security duties for data holders and a statutory credit freeze
Section 9 requires commercial controllers/processors to implement security measures and to destroy personal data at the end of regulated retention periods; it also bans storing data longer than necessary. Section 10 builds a consumer security‑freeze regime that obliges consumer reporting agencies to place and lift freezes within regulatory timelines, verify identity, allow consumer‑directed disclosures, and do so free of charge; agencies may disclose certain information to prescribed parties as defined in regulation.
Defences, remedies, and extinguishment
Section 6 lists defences and lawful exceptions (consent, lawful defence of person/property, court authorization, and proportionate law‑enforcement action). Section 7 authorizes remedies—damages, injunctions, accounting for profits and delivery of materials—while Section 8 states that the private right dies with the claimant, extinguishing actions on the death of the person whose privacy is alleged to have been violated.
Corporate fines, regulatory delegation, and statutory precedence
Section 11 exposes corporations that contravene Sections 9 or 10 to summary‑conviction fines up to $30,000,000 or 4% of worldwide annual revenue. Section 13 gives Governor in Council broad rule‑making power to set security standards, retention periods, and procedures for freezes. Section 12, however, states that where this Act conflicts with the Freedom of Information and Protection of Privacy Act, the Intimate Images and Cyber‑protection Act or the Personal Health Information Act, those statutes prevail—creating a built‑in hierarchy that narrows the Act’s reach in some areas.
This bill is one of many.
Codify tracks hundreds of bills on this topic across all five countries.
Explore this topic in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Victims of non‑consensual intimate-image distribution and AI deepfakes — the evidentiary presumption and private tort give them a clearer path to civil relief without proving financial loss.
- Consumers at risk of identity theft — the no‑fee security freeze provides a direct tool to prevent new credit applications while the freeze is in effect.
- Privacy‑minded litigants and advocacy groups — the private right of action creates standing for civil claims that previously relied on regulatory complaints.
Who Bears the Cost
- Consumer reporting agencies — they must build processes to verify identity, place and lift freezes within regulatory deadlines, handle consumer‑directed disclosures, and absorb the cost of a no‑fee service.
- Commercial data controllers and processors (including small businesses) — they must implement regulated security measures, revise retention and destruction practices, and face litigation and substantial fine exposure for breaches.
- Advertisers, platforms and AI developers — use of likenesses or AI‑generated voices for commercial advantage becomes higher risk because that use is treated as presumptive proof of violation if it identifies an individual.
Key Issues
The Core Tension
The central dilemma is between empowering individuals with an easy private cause of action and enabling predictable, administrable rules for organizations: the Act strengthens personal remedies (no damage requirement, prima facie proof for certain conduct, free credit freezes) but delegates many technical limits and deadlines to regulation and leaves ambiguous standards that heighten litigation and compliance costs for data holders.
The Act packs powerful tools for individuals into relatively short text, but it leaves crucial details to regulation and creates some awkward boundaries. The requirement that breach‑based violations apply only to actors engaged in "commercial activities" narrows exposure for many community groups, private households, and certain journalistic activities, but it also raises questions about edge cases (e.g., non‑profits charging fees or mixed‑purpose data uses).
The Governor in Council’s delegated authority covers security standards, retention lengths and freeze deadlines—meaning the Act’s practical impact depends heavily on regulator choices and timing.
Another practical tension is enforcement: the Act punishes corporations via summary conviction with very high monetary caps, but it does not create an express administrative enforcement regime or identify which prosecutor or agency will bring those cases. The coexistence clause that lets several existing provincial statutes prevail further complicates implementation—stakeholders will need line‑by‑line compliance checks to know which rules apply to health information, intimate‑image disputes, or FOI contexts.
Finally, broad and somewhat subjective standards—"wilfully" and "reasonable in the circumstances"—give courts latitude but also increase litigation risk and uncertainty for businesses trying to set clear operational rules.
There's more to this law than the bill.
Codify Laws traces every connection across the legislative lifecycle.