[emacsen]

I am not a lawyer, but if it's provable that your data was stolen, why wouldn't a citizen be able to take an entity to court for what would be reason precautions and protections around their data?

If you can show that they didn't have audits, protections against their DB, etc. then I can imagine they'd be as liable as a private entity.

But as is mentioned, this is all but demanded of Canadians to use this service, and yet the government is absolving itself of liability.

[Kranar]

Due to the principle of sovereign immunity. A government can only be sued if it explicitly has granted permission, otherwise the government is immune from civil action.