Canada is moving to overhaul its private-sector privacy framework, introducing legislation designed to strengthen protections for Canadians while establishing clearer rules for businesses operating in an increasingly data-driven economy.
On June 15, the federal government tabled Bill C-36, the Protecting Privacy and Consumer Data Act (PPCDA), marking the most significant update to Canada’s private-sector privacy regime in more than 25 years.
Announced by the Honourable Evan Solomon, Minister of Artificial Intelligence and Digital Innovation and Minister responsible for the Federal Economic Development Agency for Southern Ontario, the legislation aims to address challenges that did not exist when Canada’s current privacy law was written—including artificial intelligence at scale, deepfakes, algorithmic decision-making and the widespread collection of children’s information online.
The proposed legislation forms a key pillar of Canada’s newly launched National Artificial Intelligence Strategy: AI for All. The government says stronger privacy protections are essential to building public trust in digital services and AI technologies.
Among its provisions, the PPCDA would recognize privacy as a fundamental right, establish higher standards for handling children’s information, require meaningful consent and plain-language explanations for data use, and introduce transparency requirements for automated decision-making in significant matters affecting individuals.
The legislation would also grant Canadians the ability to request deletion of their personal information, support secure data mobility between organizations, and strengthen Canada’s digital sovereignty by requiring privacy safeguards and risk assessments before information is transferred outside the country.
The framework is intended to prevent inappropriate uses of personal information, including practices such as surveillance pricing, while providing organizations with clearer rules for responsible innovation.
“Canadians deserve strong privacy protections in a rapidly changing digital world. The Protecting Privacy and Consumer Data Act will give Canadians more control over their personal information, strengthen protections for children and give businesses clearer rules to innovate responsibly. This is how we build trust in new technologies, including AI—by making sure Canadians know their data is protected and companies are accountable,” explained the Honourable Evan Solomon, Minister of Artificial Intelligence and Digital Innovation and Minister responsible for the Federal Economic Development Agency for Southern Ontario.
Oversight of the new framework would fall to the arm’s-length Digital Safety and Data Protection Commission of Canada, which will also administer the recently announced Digital Safety Act. The government says the combined responsibilities will create greater consistency in regulating digital technologies and addressing issues such as age assurance and online child safety.
The Commission would have authority to issue binding orders and impose substantial penalties. Non-compliant organizations could face penalties of up to $10 million or three per cent of global revenue, whichever is greater. For the most serious offences, fines could reach $25 million or five per cent of global revenue.
The new legislation follows the recent introduction of Bill C-34, the Safe Social Media Act.
“As technologies evolve, protecting Canadians’ privacy and ensuring online safety, especially for children, are shared priorities across government. Building on Bill C-34, the Safe Social Media Act, which we recently tabled, today’s new privacy legislation will further create a safer, more trustworthy digital ecosystem for all Canadians,” stated the Honourable Marc Miller, Minister of Canadian Identity and Culture and Minister responsible for Official Languages.
Together, the Protecting Privacy and Consumer Data Act and Canada’s National AI Strategy are intended to support responsible innovation while reinforcing Canadians’ rights and confidence in the digital economy.
