June 17, 2026, 00:22 GMT | Comment
Canada's proposed Protecting Privacy and Consumer Data Act, also known as Bill C-26, would transform the country's privacy enforcement landscape, replacing key parts of its current private-sector privacy law with a stronger enforcement regime that recognizes privacy as a fundamental right. The legislation would create a powerful five-member Digital Safety and Data Protection Commission and authorize fines up to C$25 million ($17.75 million) or 5 percent of global revenue, whichever is greater, for some violations. The bill adds AI regulation, children's protections, privacy management requirements, expanded personal-data definitions and a private right of action, while shifting private-sector enforcement away from the
Office of the Privacy Commissioner of Canada.
Canada took a step toward a more aggressive, European-style data protection enforcement system with the government's introduction Monday of Bill C-36, the Protecting Privacy and Consumer Data Act, to update the nation’s 26-year-old commercial privacy law.
The new legislation, if passed by Parliament, would recognize privacy as a fundamental right of every Canadian, which the existing Personal Information and Electronic Documents Act, or PIPEDA, does not. Bill C-36 (see
here) would create much more powerful enforcement powers and a new enforcement structure consisting of a new five-person Digital Safety and Data Protection Commission of Canada. The commission could assess significant fines of up to C$25 million ($17.75 million) or 5 percent of a company's annual gross global revenue, whichever is greater, for some violations of the PPCDA.
The proposed digital safety commission, which some commentators have labeled a "digital super regulator," was first proposed in Bill C-34, the Safe Social Media Act, which was introduced by the government on June 10 and includes a ban on use of many social media platforms by teens under 16 (see
here).
"This new Commission will be responsible for developing regulations and guidance, assessing compliance, conducting audits and inspections, and enforcing obligations under the Act through compliance orders and administrative monetary penalties," the government said in a background document on the Safe Social Media Act. The new digital commission would also oversee the proposed under-16 social media ban.
"I expect that we will see some debate over the consolidation of these roles, and whether that commission will be sufficiently resourced to appropriately exercise its various proposed functions, particularly given the PPCDA would apply to businesses operating across all industries and not just in the digital sector," Kristen Pennington, a Toronto-based privacy lawyer with the firm McMillan, told MLex.
— Sea change —
Taken together, the PPCDA and the Safe Social Media Act would represent a sea change in the privacy and online safety regulation of digital platforms in Canada.
Under the PIPEDA, the Office the Privacy Commissioner of Canada cannot assess fines and has few other powers other than a bully pulpit to call out privacy violations, as the OPC did recently with xAI's Grok chatbot over its generation of sexualized deepfake images (see
here).
Significantly, PPCDA would also include a private right of action that would allow individual Canadians to sue for certain violations of the act. The legislation also contains an expanded definition of personal data, including data inferred about people and not directly collected from them.
Companies would be mandated to create a privacy management program which the PPCDA would require to include "the policies, practices and procedures the organization has put in place to fulfill its obligations under this Act." The program would have to include details about how it handles requests for information and complaints about personal data about consumers, as well as the training it provides to staff.
There are new special protections for children, defining a child as anyone under the age of 18. And the new law would regulate AI, which PIPEDA, passed in 2000, doesn't. The proposed bill defines automated decision-making systems broadly, as "any technology that assists or replaces the judgment of human decision-makers through the use of a rules-based system."
The new proposals represent a change of lawmaking strategy from privacy and AI regulatory legislation introduced during the government of former Prime Minister Justin Trudeau, when AI and privacy were handled in separate bills and Parliament failed to pass the Artificial Intelligence and Data Act to regulate certain high-impact AI systems. A parallel privacy bill, C-27, also failed to pass before federal elections that replaced the Trudeau government.
"The AIDA proved controversial, in part because it left much of the substance of the legislation up to regulations, and many point to the AIDA as the reason for Bill C-27 stalling until it eventually died when the last federal election was called," Pennington said.
Even though Bill C-36 isn't proposing to introduce AI-specific legislation like the AIDA, Pennington said it would be a mistake to not understand this round of attempted privacy reform as being driven by AI.
"The federal government views the passing of the PPCDA to be a 'key element' in advancing its recently announced national AI strategy — 'AI for All' — which is designed to increase AI innovation and adoption in Canada," she told MLex.
And there are some attractive elements for business, she said, including that the PPCDA would allow companies to collect and use an individual's personal information without their knowledge or consent for certain business activities, internal research, analysis and development purposes, or activities in which the organization has a legitimate interest.
The Office of the Privacy Commissioner would not go away if Bill C-36 is passed, but the legislation would transfer the current private-sector privacy responsibilities from the OPC to the new digital safety commission. The OPC would continue to be responsible for policing privacy violations by the public sector.
"I am pleased to see many of my recommendations reflected in the new Bill," Canada’s Privacy Commissioner, Philippe Dufresne, said in a statement. "In particular, I welcome proposals to recognize privacy as a fundamental right, an explicit recognition of the best interests of children, requirements to conduct privacy impact assessments, and stronger enforcement powers."
Dufresne signaled, however, that he won't necessarily support the whole package, saying he plans to provide "my views and recommendations to Parliament in due course with the goal of making it the best possible legislation to ensure that Canadians' fundamental right to privacy is protected for current and future generations."
Bill C-36 is likely to be controversial, so it's far from certain that the sweeping changes it would bring to privacy enforcement in Canada will come to pass.
"The bill firmly cements the Digital Safety Commission as a new digital super-regulator in Canada, stripping the Privacy Commissioner of authority over private sector privacy law and handing it instead to the same five-member commission the government created a few days ago to police online harms," said Michael Geist, a prominent legal commentator on privacy said in a blog post. "I believe the approach is unprecedented among peer countries and will have negative repercussions for Canada's standing in the privacy world."
Please email editors@mlex.com to contact the editorial staff regarding this story, or to submit the names of lawyers and advisers.
Tags
Sections:
Data Privacy & Security, Artificial Intelligence
Industries:
Computing & Information Technology, Computer Networks, Social Media, Digital Economy, Electronic Commerce
Geographies:
North America, Canada