{"id":357218,"date":"2026-07-10T01:41:42","date_gmt":"2026-07-10T01:41:42","guid":{"rendered":"https:\/\/peraltafinancing.com\/business\/legal\/bill-c-36-the-protecting-privacy-and-consumer-data-act\/"},"modified":"2026-07-10T01:41:42","modified_gmt":"2026-07-10T01:41:42","slug":"bill-c-36-the-protecting-privacy-and-consumer-data-act","status":"publish","type":"post","link":"https:\/\/fivemor.com\/?p=357218","title":{"rendered":"Bill C-36, the Protecting Privacy and Consumer Data Act"},"content":{"rendered":"<p> <br \/>\n<\/p>\n<div id=\"post-body-2845960398592766937\">\n<p><span style=\"font-family: inherit;\"><iframe loading=\"lazy\" title=\"Canada&amp;apos;s proposed new privacy law: Bill C-36, the Protecting Privacy and Consumer Data Act\" width=\"840\" height=\"473\" src=\"https:\/\/www.youtube.com\/embed\/2BaatCD74pI?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe><br \/>\n<\/span><\/p>\n<p><span style=\"font-family: inherit;\"><iframe allowtransparency=\"true\" data-name=\"pb-iframe-player\" height=\"150\" loading=\"lazy\" scrolling=\"no\" src=\"https:\/\/www.podbean.com\/player-v2\/?i=zmvzr-1afbf71-pb&amp;from=pb6admin&amp;share=1&amp;download=1&amp;rtl=0&amp;fonts=Arial&amp;skin=1&amp;font-color=auto&amp;logo_link=episode_page&amp;btn-skin=7\" style=\"border: none; height: 150px; min-width: min(100%, 430px);\" title=\"Canada\u2019s proposed new privacy law: Bill C-36, the Protecting Privacy and Consumer Data Act\" width=\"100%\"><\/iframe><br \/>\n<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">The Personal Information Protection and Electronic Documents Act,<br \/>\nknown as PIPEDA, has been Canada&#8217;s private sector privacy law since 2001.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">It&#8217;s currently the law that governs how businesses collect, use and<br \/>\ndisclose your personal information. It&#8217;s the law that made the Privacy<br \/>\nCommissioner of Canada the federal privacy watchdog. And it&#8217;s the law that most<br \/>\nprivacy professionals in Canada have built their careers around.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">But now, the federal government has tabled <a href=\"https:\/\/www.parl.ca\/LegisInfo\/en\/bill\/45-1\/c-36\" target=\"_blank\">Bill C-36<\/a>, which would<br \/>\nrepeal and replace the privacy portions of PIPEDA with an entirely new<br \/>\nframework.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">And if you&#8217;ve been following federal privacy reform over the last<br \/>\nfew years, a lot of this will look familiar.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">We&#8217;ve seen Bill C-11, the Digital Charter Implementation Act, 2020.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">We&#8217;ve seen Bill C-27, Digital Charter Implementation Act, 2022.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Both died on the Order Paper.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Now we have <a href=\"https:\/\/www.parl.ca\/LegisInfo\/en\/bill\/45-1\/c-36\" target=\"_blank\">Bill C-36 called the Protecting Privacy and ConsumerData Act<\/a>.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">But this bill does something that neither of those previous bills<br \/>\ndid.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">It completely sidelines the existing Privacy Commissioner of Canada<br \/>\nand hands enforcement to an entirely new regulatory structure that seems to be<br \/>\npart of what I expect will be the super-mega digital regulator for Canada.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">In this episode, I&#8217;m going to walk you through what Bill C-36 does,<br \/>\nwhat&#8217;s new, what&#8217;s familiar, what businesses need to know, and what I think are<br \/>\nsome of the most significant changes.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">On June 15, 2026, the Minister of Artificial Intelligence and<br \/>\nDigital Innovation tabled Bill C-36, titled <i>An Act to enact the Protecting<br \/>\nPrivacy and Consumer Data Act, to amend the Personal Information Protection and<br \/>\nElectronic Documents Act and to make amendments to other Acts<\/i>.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">The centrepiece of the bill is a new law called the <b>Protecting<br \/>\nPrivacy and Consumer Data Act<\/b>, or PPCDA.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">If passed, it would replace Part 1 of PIPEDA, which has governed<br \/>\nprivate-sector privacy in Canada since 2001.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">I don\u2019t really like the name of the new law. On one hand, the law<br \/>\nsays that privacy is a fundamental right, but in the title it\u2019s about people as<br \/>\n\u201cconsumers\u201d. If we have a fundamental right, it\u2019s because we\u2019re humans, not<br \/>\njust consumers. I think it puts it all in a bad frame.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">But in any event, let&#8217;s dig in.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">If you&#8217;ve read Bill C-27, much of Bill C-36 will look very familiar.<br \/>\nIn substance, it takes PIPEDA and turns the obligations up to eleven.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Many of the concepts are carried forward:<\/span><\/p>\n<ul style=\"margin-top: 0in;\" type=\"disc\">\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l3 level1 lfo1; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">accountability obligations;<\/span><\/li>\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l3 level1 lfo1; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">privacy management programs;<\/span><\/li>\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l3 level1 lfo1; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">enhanced consent requirements;<\/span><\/li>\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l3 level1 lfo1; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">legitimate interest exceptions;<\/span><\/li>\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l3 level1 lfo1; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">rights to disposal of personal<br \/>\n     information;<\/span><\/li>\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l3 level1 lfo1; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">data mobility provisions;<\/span><\/li>\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l3 level1 lfo1; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">administrative monetary penalties;<br \/>\n     and<\/span><\/li>\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l3 level1 lfo1; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">a much stronger enforcement<br \/>\n     framework.<\/span><\/li>\n<\/ul>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">What&#8217;s missing, however, is the artificial intelligence legislation<br \/>\nthat was bundled into Bill C-27. It\u2019s not really missing since it didn\u2019t belong<br \/>\nin Bill C-27 in the first place.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">This new bill focuses exclusively on private-sector privacy law.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">In my view, the most significant structural change is not about<br \/>\nconsent, de-identification or penalties. We expected that.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">It&#8217;s about who oversees and enforces the law.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Historically, privacy complaints under PIPEDA have been investigated<br \/>\nby the Privacy Commissioner of Canada.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">The Commissioner acts primarily as an ombudsman. Complaints are<br \/>\ninvestigated. Findings are issued. Organizations are encouraged to comply. And<br \/>\nthey can be named and shamed. And if things don&#8217;t get resolved, the matter may<br \/>\nend up in Federal Court, where orders can be issued and damages can be awarded.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Bill C-27 from 2002 would have given the Privacy Commissioner the<br \/>\npower to investigate complaints and recommend orders and penalties. Those<br \/>\norders and penalties had to be levied by a proposed newly created, separate<br \/>\nbody called the Personal Information and Data Protection Tribunal.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Bill C-36 replaces the current PIPEDA model entirely by sidelining<br \/>\nthe current Commissioner.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Instead, oversight would be handled through the <b>Digital Safety<br \/>\nand Data Protection Commission of Canada<\/b>, a new institution that originated<br \/>\nin the government&#8217;s online harms framework. (I covered that in my <a href=\"https:\/\/www.youtube.com\/watch?v=E08XVXwojMw\" target=\"_blank\">last episode<\/a>.) The existing Privacy Commissioner would no longer be the regulator<br \/>\nunder the statute. Instead, there would be a new <b>Privacy and Consumer Data<br \/>\nCommissioner<\/b> operating within this new commission structure.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">This is a big shift.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">For nearly twenty-five years, Canadian privacy regulation has been<br \/>\ncentred on an independent officer of Parliament.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Now, enforcement would be embedded within a broader administrative<br \/>\ncommission.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Whether that&#8217;s a good thing or a bad thing will likely become one of<br \/>\nthe major debates surrounding the bill. The new Commissioner will be less<br \/>\nindependent and more beholden to the government. At this point, I\u2019m not<br \/>\nconvinced that it\u2019s a good idea \u2013 but I look forward to a lot of discussion<br \/>\nabout it over the summer.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Bill C-36 looks very different from PIPEDA.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">PIPEDA has always been a bit unusual. Rather than spelling out all<br \/>\nof the rules directly in legislation, it incorporated the Canadian Standards<br \/>\nAssociation Model Code for the Protection of Personal Information.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">The law largely worked by saying: follow the Code, subject to these<br \/>\nexceptions. Bill C-36 takes a different approach.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Much like the privacy statutes in Alberta and British Columbia, the<br \/>\nprinciples are expressed directly in legislative language. For privacy<br \/>\nprofessionals who work with Canadian federal and provincial laws, this means<br \/>\nthe substance will often feel familiar.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">And because the essence of the principles are embedded directly in<br \/>\nstatute using traditional statutory language, I expect its interpretation will<br \/>\nbecome more rigid and more legalistic than the current PIPEDA framework.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">The government seems to be expanding the scope of the private sector<br \/>\nprivacy law. One new provision, compared to PIPEDA, is particularly notable.<br \/>\nPIPEDA applies to personal information collected, used or disclosed in the<br \/>\ncourse of commercial activities, as well as federally regulated workplaces.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">That basic framework remains. Bill C-36 will apply to personal<br \/>\ninformation collected, used or disclosed in the course of commercial<br \/>\nactivities, as well as federally regulated workplaces.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">But Bill C-36 includes a provision that specifically says that the<br \/>\nlegislation applies to personal information collected, used or disclosed<br \/>\ninterprovincially or internationally.<\/span><\/p>\n<blockquote style=\"border-color: currentcolor; border-image: initial; border-style: none; border-width: medium; margin: 0px 0px 0px 40px; padding: 0px; text-align: left;\">\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><b><span style=\"font-family: inherit;\">For greater certainty<\/span><\/b><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span style=\"font-family: inherit;\">(2)\u2002For greater certainty, this Act applies in respect of personal information<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span style=\"font-family: inherit;\">(a)\u2002that is collected, used or disclosed interprovincially or internationally by an organization; or<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span style=\"font-family: inherit;\">(b)\u2002that is collected, used or disclosed by an organization within a province, to the extent that the organization is not exempt from the application of this Act under an order made under paragraph 139(2)\u200d(b).<\/span><\/p>\n<\/blockquote>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">It\u2019s not limited to data that crosses borders in connection with any<br \/>\ncommercial activity. Does that mean it applies to data that a Nova Scotia-based<br \/>\nnon-profit stores in Ontario? Or what about an Alberta company that is subject<br \/>\nto Alberta privacy law, which collects information from a British Columbian<br \/>\nresident, which is protected by that province\u2019s privacy law. Does the federal<br \/>\nlaw apply once the data crosses the Rocky Mountains?<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">I think this was probably put here to expand our European GDPR<br \/>\nadequacy, so that the new law will explicitly apply to all data transferred<br \/>\nfrom Europe to Canada for processing. But I suspect lawyers and regulators will<br \/>\nspend a fair amount of time debating exactly how far this provision reaches.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Another major feature of the bill is its treatment of anonymous and<br \/>\nde-identified information.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">To date, Canadian privacy law has not directly addressed this<br \/>\nconcept.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Bill C-36 formally distinguishes among personal information,<br \/>\nde-identified personal information and anonymized information.<\/span><\/p>\n<blockquote style=\"border-color: currentcolor; border-image: initial; border-style: none; border-width: medium; margin: 0px 0px 0px 40px; padding: 0px; text-align: left;\">\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span style=\"font-family: inherit;\"><b><i>anonymize\u2002<\/i><\/b>means to irreversibly and permanently modify personal information to ensure that there is no reasonably foreseeable risk in the circumstances that an individual can be identified from the information, whether directly or indirectly, by any means.\u200d\u2002(<i>anonymiser<\/i>)<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><b><span style=\"font-family: inherit;\">For greater certainty<\/span><\/b><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span style=\"font-family: inherit;\">6(5)\u2002For greater certainty, this Act does not apply in respect of anonymized information.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span style=\"font-family: inherit;\"><b><i>de-identify\u2002<\/i><\/b>means to modify personal information so that an individual cannot be directly identified from it, although a risk of the individual being identified remains.\u200d\u2002(<i>d\u00e9personnaliser<\/i>)<\/span><\/p>\n<\/blockquote>\n<p><span style=\"font-family: inherit;\">Anonymous information is information that has been irreversibly and<br \/>\npermanently modified so there is no reasonably foreseeable risk that an<br \/>\nindividual can be identified. Anonymous information falls outside the<br \/>\nlegislation altogether.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">De-identified information is different.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">The information has been modified so an individual cannot be<br \/>\ndirectly identified, but some risk of re-identification remains. That<br \/>\ninformation continues to be regulated under the Act.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">This distinction is important because organizations increasingly<br \/>\nrely on de-identification techniques for analytics, research and product<br \/>\ndevelopment.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">The bill provides a much more detailed framework than PIPEDA<br \/>\ncurrently does.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Essentially, Principle 1 of PIPEDA required all regulated<br \/>\norganizations to have a privacy management program. Bill C-36 makes that<br \/>\nexpectation explicit.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Organizations must establish and maintain a documented privacy<br \/>\nmanagement program. They must also provide supporting documentation to the<br \/>\nregulator upon request.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">In practical terms, this means:<\/span><\/p>\n<ul style=\"margin-top: 0in;\" type=\"disc\">\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l0 level1 lfo2; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">policies;<\/span><\/li>\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l0 level1 lfo2; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">procedures;<\/span><\/li>\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l0 level1 lfo2; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">training materials;<\/span><\/li>\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l0 level1 lfo2; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">risk management documentation; and<\/span><\/li>\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l0 level1 lfo2; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">governance records<\/span><\/li>\n<\/ul>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">All of these become much more important.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">For organizations that have treated privacy compliance as an<br \/>\ninformal exercise, that approach will no longer be sufficient. And very<br \/>\nimportantly, every organization has to provide a copy of their privacy<br \/>\nmanagement program to the regulator upon request.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">The bill retains consent as the principal basis under which personal<br \/>\ninformation can be collected, used or disclosed.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">But the Bill significantly expands what organizations must<br \/>\ncommunicate to the individual in order for consent to be valid.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Organizations will need to explain:<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; margin-left: .5in; margin-right: 0in; margin-top: 0in; margin: 0in 0in 0in 0.5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">(a)\u2002the purposes for the<br \/>\ncollection, use or disclosure of the personal information;<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; margin-left: .5in; margin-right: 0in; margin-top: 0in; margin: 0in 0in 0in 0.5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">(b)\u2002the manner in which<br \/>\nthe personal information is to be collected, used or disclosed;<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; margin-left: .5in; margin-right: 0in; margin-top: 0in; margin: 0in 0in 0in 0.5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">(c)\u2002any reasonably<br \/>\nforeseeable consequences of the collection, use or disclosure of the personal<br \/>\ninformation;<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; margin-left: .5in; margin-right: 0in; margin-top: 0in; margin: 0in 0in 0in 0.5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">(d)\u2002the specific type of<br \/>\npersonal information that is to be collected, used or disclosed; and<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; margin-left: .5in; margin-right: 0in; margin-top: 0in; margin: 0in 0in 0in 0.5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">(e)\u2002the names of any<br \/>\nthird parties or types of third parties to which the organization may disclose<br \/>\nthe personal information.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">And these explanations must be provided in plain language.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">That\u2019s a lot of information. Imagine trying to convey that at a<br \/>\nretail point of sale. Under PIPEDA, conveying the purposes of the collection<br \/>\nwas done outside of a privacy policy or privacy statement, but this is the sort<br \/>\nof information that should be put in a privacy statement. And this is all while<br \/>\nfolks are saying that privacy policies are too long and unreadable. I think it<br \/>\nshould be sufficient to communicate the purposes, clearly and understandably,<br \/>\nand leave the rest for the privacy policy if the individual has any<br \/>\nquestions.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">When it comes to consent, one hand giveth and the other taketh<br \/>\naway.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">One of the most controversial features of Bill C-27 from 2022 was<br \/>\nthe introduction of new exceptions to consent. Those provisions largely survive<br \/>\nunder the proposed Protecting Privacy and Consumer Data Act.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Under Bill C-36, organizations can collect and use personal<br \/>\ninformation without consent for certain business activities where a reasonable<br \/>\nperson would expect it, for security purposes, for safety purposes and for<br \/>\nother prescribed activities.<\/span><\/p>\n<blockquote style=\"border-color: currentcolor; border-image: initial; border-style: none; border-width: medium; margin: 0px 0px 0px 40px; padding: 0px; text-align: left;\">\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><b><span style=\"font-family: inherit;\">Business activities<\/span><\/b><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span style=\"font-family: inherit;\">18\u2002(1)\u2002An organization may collect or use an individual\u2019s personal information without their knowledge or consent if the collection or use is made for the purpose of a business activity described in subsection (2) and<\/span><\/p>\n<\/blockquote>\n<blockquote style=\"border-color: currentcolor; border-image: initial; border-style: none; border-width: medium; margin: 0px 0px 0px 40px; padding: 0px; text-align: left;\">\n<blockquote style=\"border-color: currentcolor; border-image: initial; border-style: none; border-width: medium; margin: 0px 0px 0px 40px; padding: 0px; text-align: left;\">\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span style=\"font-family: inherit;\">(a)\u2002a reasonable person would expect the collection or use for such an activity; and<\/span><\/p>\n<\/blockquote>\n<blockquote style=\"border-color: currentcolor; border-image: initial; border-style: none; border-width: medium; margin: 0px 0px 0px 40px; padding: 0px; text-align: left;\">\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span style=\"font-family: inherit;\">(b)\u2002the personal information is not collected or used for the purpose of influencing the individual\u2019s behaviour or decisions.<\/span><\/p>\n<\/blockquote>\n<\/blockquote>\n<blockquote style=\"border-color: currentcolor; border-image: initial; border-style: none; border-width: medium; margin: 0px 0px 0px 40px; padding: 0px; text-align: left;\">\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><b><span style=\"font-family: inherit;\">List of activities<\/span><\/b><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span style=\"font-family: inherit;\">(2)\u2002Subject to the regulations, the following activities are business activities for the purposes of subsection (1):<\/span><\/p>\n<\/blockquote>\n<blockquote style=\"border-color: currentcolor; border-image: initial; border-style: none; border-width: medium; margin: 0px 0px 0px 40px; padding: 0px; text-align: left;\">\n<blockquote style=\"border-color: currentcolor; border-image: initial; border-style: none; border-width: medium; margin: 0px 0px 0px 40px; padding: 0px; text-align: left;\">\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span style=\"font-family: inherit;\">(a)\u2002an activity that is necessary to provide a product or service that the individual has requested from the organization;<\/span><\/p>\n<\/blockquote>\n<blockquote style=\"border-color: currentcolor; border-image: initial; border-style: none; border-width: medium; margin: 0px 0px 0px 40px; padding: 0px; text-align: left;\">\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span style=\"font-family: inherit;\">(b)\u2002an activity that is necessary for the security of the organization\u2019s information, systems or networks;<\/span><\/p>\n<\/blockquote>\n<blockquote style=\"border-color: currentcolor; border-image: initial; border-style: none; border-width: medium; margin: 0px 0px 0px 40px; padding: 0px; text-align: left;\">\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span style=\"font-family: inherit;\">(c)\u2002an activity that is necessary for the safety of a product or service that the organization provides; and<\/span><\/p>\n<\/blockquote>\n<blockquote style=\"border-color: currentcolor; border-image: initial; border-style: none; border-width: medium; margin: 0px 0px 0px 40px; padding: 0px; text-align: left;\">\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span style=\"font-family: inherit;\">(d)\u2002any other prescribed activity.<\/span><\/p>\n<\/blockquote>\n<\/blockquote>\n<p><span style=\"font-family: inherit;\">However, there is an important limitation.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">These exceptions cannot be used where the information is being<br \/>\ncollected or used to influence an individual&#8217;s behaviour or decisions.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">The bill also includes a legitimate interest exception, which is<br \/>\nsimilar to what is found in Europe\u2019s General Data Protection Regulation.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">To rely on it, an organization must carry out a privacy impact<br \/>\nassessment to:<\/span><\/p>\n<ol start=\"1\" style=\"margin-top: 0in;\" type=\"1\">\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l4 level1 lfo3; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">identify possible adverse effects on<br \/>\n     individuals;<\/span><\/li>\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l4 level1 lfo3; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">take measures to mitigate those<br \/>\n     effects; and<\/span><\/li>\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l4 level1 lfo3; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">determine that its legitimate<br \/>\n     interest outweighs those adverse effects.<\/span><\/li>\n<\/ol>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">This sounds straightforward.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">In practice, it may generate substantial debate.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">What is influencing an individual\u2019s behaviour or decisions? Does<br \/>\nthat include search rankings? What video to suggest next? An advertisement?<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">How do you measure adverse effects?<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">What counts as sufficient mitigation?<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">And how should competing interests be balanced?<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Those questions are likely to become important very quickly.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Notably, consent can still be implied if it\u2019s appropriate taking<br \/>\ninto account the reasonable expectations of the individual and the sensitivity.<br \/>\nBut then section 15(6) says you can\u2019t use implied consent for any activity<br \/>\nlisted in 18(2) or 18(3).\u00a0<\/span><\/p>\n<blockquote style=\"border-color: currentcolor; border-image: initial; border-style: none; border-width: medium; margin: 0px 0px 0px 40px; padding: 0px; text-align: left;\">\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><b><span style=\"font-family: inherit;\">Form of consent<\/span><\/b><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span style=\"font-family: inherit;\">(5)\u2002<span style=\"white-space: pre;\">\t<\/span>Consent must be expressly obtained unless, subject to subsection (6), it is appropriate to rely on an individual\u2019s implied consent, taking into account the reasonable expectations of the individual and the sensitivity of the personal information that is to be collected, used or disclosed.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><b><span style=\"font-family: inherit;\">Business activities<\/span><\/b><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span style=\"font-family: inherit;\">(6)\u2002<span style=\"white-space: pre;\">\t<\/span>It is not appropriate to rely on an individual\u2019s implied consent if their personal information is collected or used for an activity described in subsection 18(2) or if it is collected, used or disclosed for an activity described in subsection 18(3).<\/span><\/p>\n<\/blockquote>\n<p><span style=\"font-family: inherit;\">That includes \u201can activity that is necessary to<br \/>\nprovide a product or service that the individual has requested from the<br \/>\norganization.\u201d Those are exactly the sorts of activities where you should be<br \/>\nable to rely on implied consent. The wording of the statute suggests that this<br \/>\nis excluded from possible \u201cimplied consent\u201d.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">For example, I tap my credit card to pay for a burger. My consent to<br \/>\nprocessing that transaction should be implied without the cashier reciting<br \/>\neverything listed in section 15 (like the reasonably foreseeable consequences<br \/>\nof the collection, use or disclosure of my credit card number), but because<br \/>\nit\u2019s necessary for me to pay for my burger it can\u2019t be implied.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">That\u2019s just dumb. That can\u2019t be right. At a technical briefing on<br \/>\nthe bill, I asked officials with the Industry Department whether this was<br \/>\nintentional or bad drafting and they couldn\u2019t explain it.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">PIPEDA has long allowed individuals to withdraw consent in many<br \/>\ncircumstances.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Bill C-36 goes further or is at least more explicit. Under PIPEDA,<br \/>\nan individual can withdraw consent. Since the organization can only retain<br \/>\npersonal information for as long as is reasonably necessary for the purposes<br \/>\nfor which consent was obtained, it was pretty clear \u2013 but implied \u2013 that the<br \/>\ndata should be deleted.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Under Bill C-36, individuals can explicitly require organizations to<br \/>\ndispose of their personal information.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Importantly, disposal includes both deletion and anonymization.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">This resembles the growing international trend toward stronger<br \/>\ndeletion rights, although it stops short of adopting a full European-style<br \/>\n&#8220;right to be forgotten.&#8221;<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">The Industry Minister, when speaking about this Bill, suggested this<br \/>\nwill allow people to have deepfakes deleted. I\u2019m not sure that\u2019s the case<br \/>\nacross the board.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Another area of note is the treatment of international transfers.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Before personal information is disclosed or transferred outside<br \/>\nCanada, organizations would be required to conduct a privacy impact assessment<br \/>\nin a prescribed format.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">This is noteworthy.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">For years, Canadian law has generally allowed cross-border transfers<br \/>\nprovided appropriate safeguards are in place. The same rules applied to<br \/>\ndomestic transfers, as well as international ones.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Bill C-36 moves toward a more structured assessment model. Exactly<br \/>\nwhat those assessments must contain will depend on future regulations, and<br \/>\nnotably these assessments must be provided to the Commission on request.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">And now we come to what many people will consider the headline<br \/>\nstory.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Enforcement. Lots of enforcement.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Under the bill, investigations may begin following a complaint or on<br \/>\nthe initiative of the Privacy and Consumer Data Commissioner.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">During an investigation, the Commissioner can compel records and<br \/>\ntestimony, receive any evidence regardless of whether it complies with the<br \/>\ntraditional rules of evidence, and enter and search any premises other than a<br \/>\ndwelling.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Following an investigation, the Commissioner may issue a notice of<br \/>\ncontravention. That notice can include proposed orders and proposed penalties.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">If the organization does not challenge the notice, the contravention<br \/>\nis deemed admitted and the proposed order and proposed penalties take effect.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">If the organization disputes the notice, the matter goes before the<br \/>\nCommission, which functions as a tribunal and can confirm, vary or cancel the<br \/>\nfindings. It will have to establish its rules of procedure, but notably is not<br \/>\nbound by any legal or technical rules of evidence but the usual principles of<br \/>\nfairness and natural justice apply.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Appeals can be made to the Federal Court.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">This is a dramatically different model from the current PIPEDA<br \/>\nprocess.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">But a lot of focus will be on penalties. And yes, the penalties can<br \/>\nbe enormous.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Administrative monetary penalties can reach the greater of:<\/span><\/p>\n<ul style=\"margin-top: 0in;\" type=\"disc\">\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l2 level1 lfo4; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">$10 million; or<\/span><\/li>\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l2 level1 lfo4; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">3% of global gross revenue.<\/span><\/li>\n<\/ul>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">For more serious offences prosecuted under the Act, penalties become<br \/>\neven larger.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">An indictable offence can result in fines up to the greater of:<\/span><\/p>\n<ul style=\"margin-top: 0in;\" type=\"disc\">\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l1 level1 lfo5; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">$25 million; or<\/span><\/li>\n<li class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in; mso-list: l1 level1 lfo5; tab-stops: list .5in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">5% of global gross revenue.<\/span><\/li>\n<\/ul>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">There is also directors and officers liability, regardless of<br \/>\nwhether the organization itself is hit with a penalty. For large multinational<br \/>\norganizations, these are numbers that will attract immediate attention from<br \/>\nboards of directors and senior executives.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Bill C-36 will create a private right of action for individuals<br \/>\naffected by a contravention of the Act. This is extremely broad and potentially<br \/>\nproblematic. Currently, under PIPEDA, a person who complains to the Privacy<br \/>\nCommissioner can then go to the Federal Court at the conclusion of the<br \/>\nCommissioner\u2019s investigation to seek damages. It is a de novo process, which<br \/>\nmeans that the complainant has to satisfy the Federal Court that the<br \/>\norganization violated the law, that this violation harmed them and they are<br \/>\nentitled to damages. PIPEDA does not create any sort of broader scheme beyond<br \/>\nthe individual complainant.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Under Bill C-36, it says that any individual who is affected by a<br \/>\ncontravention of the act has \u201ca cause of action against the organization for<br \/>\ndamages for loss or injury that the individual has suffered as a result of the<br \/>\ncontravention.\u201d That tells me that this goes waaaay beyond the complainant<br \/>\nhaving a right to sue the organization, by anyone affected by it.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Presumably you\u2019d have to prove to the court that you\u2019re \u201caffected\u201d<br \/>\nby the contravention. The bill does not say whether liability is assumed or<br \/>\neven deemed. Does a final notice of contravention just result in a blank cheque<br \/>\nfor anyone who can claim to be affected?\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">And section 132(5) says that an action can be brought in the Federal<br \/>\nCourt or any provincial superior court. That\u2019s a recipe for overwhelming our<br \/>\ncourts.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Let\u2019s use a recent privacy commissioner report of findings as an<br \/>\nexample of what could happen. In 2022, the federal commissioner along with his<br \/>\ncounterparts in BC, Alberta and Quebec, issued a report of findings that the<br \/>\nTim Horton\u2019s coffee and donut chain violated the relevant privacy laws in the<br \/>\nway that the company\u2019s mobile app collected location information. The report<br \/>\nfound the App had over 8.6 million Canadian downloads, and as of July 2020,<br \/>\nthere were 1,602,343 active App Users.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">If that were to happen after Bill C-36 comes into effect and the<br \/>\nCommissioner found a \u201ccontravention\u201d, it sounds like 1.6 million people would<br \/>\neach be able to sue Tim Hortons in their local court. Not that that many people<br \/>\nwould do so, but even a small portion of them doing so would overwhelm our<br \/>\nlegal system. And in the case of the Tim Hortons app, the regulators found that<br \/>\nthe company didn\u2019t even use the location information. So you could have a huge<br \/>\nnumber of legal claims, where it really was a \u201cno harm, no foul\u201d situation. I<br \/>\ndo note that there were a few class actions filed over the Tim Hortons app<br \/>\nlocation tracking, which resulted in a settlement worth about 16 million<br \/>\ndollars paid in Tim Hortons gift cards.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">In my view, if they\u2019re going to create a private right of action,<br \/>\nthey should all be heard in the Federal Court of Canada and there should be a<br \/>\nclear process to prevent a multiplicity of proceedings.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">The provincial superior courts are already overwhelmed. That\u2019s where<br \/>\nserious criminal trials take place, and already charges are being thrown out<br \/>\nbecause of delays in getting to trial. I think it\u2019s irresponsible to send an<br \/>\nenormous number of claims into those courts, at the provinces\u2019 expense and at<br \/>\nthe risk to the overall administration of justice. If the federal government is<br \/>\ngoing to create a rush to the courthouses, it should be in the court that the<br \/>\nfederal government pays for.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">I can\u2019t help but notice something missing from the new Protecting<br \/>\nPrivacy and Consumer Data Act.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">While the government\u2019s agenda is so clearly in favour of the<br \/>\nadoption of artificial intelligence across Canada, there\u2019s nothing in the bill<br \/>\nthat expressly permits or authorizes the collection of publicly available<br \/>\npersonal information from the internet for training AI models. Given the<br \/>\ngovernment\u2019s artificial intelligence agenda, I am surprised that it is not<br \/>\nthere.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">But like so many recent bills, a huge amount is left to the<br \/>\nregulations.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">So, in conclusion, where does this leave us?<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Bill C-36 is not a minor update to PIPEDA. It is a wholesale<br \/>\nreplacement of Canada&#8217;s federal private-sector privacy framework.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">It introduces stronger enforcement. It creates significant<br \/>\npenalties. It formalizes privacy management programs.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">It expands rights relating to disposal of personal information.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">And perhaps most significantly, it replaces the traditional Privacy<br \/>\nCommissioner model with an entirely new regulatory structure.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">I\u2019m still thinking this through, and I\u2019m sure I\u2019ll have more to say<br \/>\nabout this new Digital Safety and Data Protection Commission of Canada, which<br \/>\nis taking on the full \u201conline harms\u201d regulation from Bill C-34\u2019s \u201cSafe Social<br \/>\nMedia Act\u201d, and now privacy under this new Bill C-36. A specialized tribunal<br \/>\nmakes some sense, but the Data Protection Commissioner should not be a member<br \/>\nof the tribunal hearing review of his own investigations. In any event, it still<br \/>\nputs the judge, jury, prosecutor and executioner in too cozy a<br \/>\nrelationship. The statute should clearly build in the guardrails and the<br \/>\nfirewalls to keep the investigation function detached from the Commission as a<br \/>\ntribunal. <\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">Anyways, I\u2019m still thinking this through and will certainly have<br \/>\nthoughts to come. In the meantime, both Professor Geist and Professor Scassa,<br \/>\nwho think deeply about these issues, have some preliminary thoughts online on<br \/>\ntheir blogs and substacks. You should check them out.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">So the bill has only just been introduced and Parliament rose<br \/>\nshortly afterward for the summer break. We don&#8217;t yet know whether the<br \/>\ngovernment will fast-track it, whether it will undergo substantial amendments,<br \/>\nor whether it will suffer the same fate as Bills C-11 and C-27. I expect that<br \/>\nin terms of government priority, Online Harms will be higher up the list than<br \/>\nprivacy law reform.\u00a0<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">But one thing is certain.<\/span><\/p>\n<p class=\"MsoNormal\" style=\"line-height: normal; margin-bottom: 0in;\"><span lang=\"EN-CA\" style=\"font-family: inherit;\">If enacted, Bill C-36 would represent the most significant change to<br \/>\nCanadian private-sector privacy law since PIPEDA itself came into force.<\/span><\/p>\n<p><span style=\"font-family: inherit;\">\u00a0\u00a0<\/span><\/p>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>The Personal Information Protection and Electronic Documents Act, known as PIPEDA, has been Canada&#8217;s private sector privacy law since 2001. It&#8217;s currently the law that governs how businesses collect, use and disclose your personal information. It&#8217;s the law that made the Privacy Commissioner of Canada the federal privacy watchdog. And it&#8217;s the law that most [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[97],"tags":[7622,6795,177546,11601,11603,13325,4377],"dealstore":[],"offerexpiration":[],"class_list":["post-357218","post","type-post","status-publish","format-standard","hentry","category-legal","tag-act","tag-bill","tag-c36","tag-consumer","tag-data","tag-privacy","tag-protecting"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Bill C-36, the Protecting Privacy and Consumer Data Act - Som2ny Network<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fivemor.com\/?p=357218\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Bill C-36, the Protecting Privacy and Consumer Data Act - Som2ny Network\" \/>\n<meta property=\"og:description\" content=\"The Personal Information Protection and Electronic Documents Act, known as PIPEDA, has been Canada&#8217;s private sector privacy law since 2001. It&#8217;s currently the law that governs how businesses collect, use and disclose your personal information. It&#8217;s the law that made the Privacy Commissioner of Canada the federal privacy watchdog. And it&#8217;s the law that most [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fivemor.com\/?p=357218\" \/>\n<meta property=\"og:site_name\" content=\"Som2ny Network\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-10T01:41:42+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"19 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fivemor.com\/?p=357218#article\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/?p=357218\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\"},\"headline\":\"Bill C-36, the Protecting Privacy and Consumer Data Act\",\"datePublished\":\"2026-07-10T01:41:42+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fivemor.com\/?p=357218\"},\"wordCount\":3889,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"keywords\":[\"Act\",\"Bill\",\"C36\",\"Consumer\",\"Data\",\"privacy\",\"Protecting\"],\"articleSection\":[\"Legal\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fivemor.com\/?p=357218#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fivemor.com\/?p=357218\",\"url\":\"https:\/\/fivemor.com\/?p=357218\",\"name\":\"Bill C-36, the Protecting Privacy and Consumer Data Act - Som2ny Network\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/#website\"},\"datePublished\":\"2026-07-10T01:41:42+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fivemor.com\/?p=357218#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fivemor.com\/?p=357218\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fivemor.com\/?p=357218#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/fivemor.com\/?bp_activities=1\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Bill C-36, the Protecting Privacy and Consumer Data Act\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fivemor.com\/#website\",\"url\":\"https:\/\/fivemor.com\/\",\"name\":\"Som2ny Network\",\"description\":\"Daily Deals\",\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fivemor.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/fivemor.com\/#organization\",\"name\":\"Som2ny Network\",\"url\":\"https:\/\/fivemor.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"contentUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"width\":300,\"height\":86,\"caption\":\"Som2ny Network\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/fivemor.com\"],\"url\":\"https:\/\/fivemor.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Bill C-36, the Protecting Privacy and Consumer Data Act - Som2ny Network","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fivemor.com\/?p=357218","og_locale":"en_US","og_type":"article","og_title":"Bill C-36, the Protecting Privacy and Consumer Data Act - Som2ny Network","og_description":"The Personal Information Protection and Electronic Documents Act, known as PIPEDA, has been Canada&#8217;s private sector privacy law since 2001. It&#8217;s currently the law that governs how businesses collect, use and disclose your personal information. It&#8217;s the law that made the Privacy Commissioner of Canada the federal privacy watchdog. And it&#8217;s the law that most [&hellip;]","og_url":"https:\/\/fivemor.com\/?p=357218","og_site_name":"Som2ny Network","article_published_time":"2026-07-10T01:41:42+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"19 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fivemor.com\/?p=357218#article","isPartOf":{"@id":"https:\/\/fivemor.com\/?p=357218"},"author":{"name":"admin","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371"},"headline":"Bill C-36, the Protecting Privacy and Consumer Data Act","datePublished":"2026-07-10T01:41:42+00:00","mainEntityOfPage":{"@id":"https:\/\/fivemor.com\/?p=357218"},"wordCount":3889,"commentCount":0,"publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"keywords":["Act","Bill","C36","Consumer","Data","privacy","Protecting"],"articleSection":["Legal"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fivemor.com\/?p=357218#respond"]}]},{"@type":"WebPage","@id":"https:\/\/fivemor.com\/?p=357218","url":"https:\/\/fivemor.com\/?p=357218","name":"Bill C-36, the Protecting Privacy and Consumer Data Act - Som2ny Network","isPartOf":{"@id":"https:\/\/fivemor.com\/#website"},"datePublished":"2026-07-10T01:41:42+00:00","breadcrumb":{"@id":"https:\/\/fivemor.com\/?p=357218#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fivemor.com\/?p=357218"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fivemor.com\/?p=357218#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/fivemor.com\/?bp_activities=1"},{"@type":"ListItem","position":2,"name":"Bill C-36, the Protecting Privacy and Consumer Data Act"}]},{"@type":"WebSite","@id":"https:\/\/fivemor.com\/#website","url":"https:\/\/fivemor.com\/","name":"Som2ny Network","description":"Daily Deals","publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fivemor.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/fivemor.com\/#organization","name":"Som2ny Network","url":"https:\/\/fivemor.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/","url":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","contentUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","width":300,"height":86,"caption":"Som2ny Network"},"image":{"@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","caption":"admin"},"sameAs":["https:\/\/fivemor.com"],"url":"https:\/\/fivemor.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/357218","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=357218"}],"version-history":[{"count":0,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/357218\/revisions"}],"wp:attachment":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=357218"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=357218"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=357218"},{"taxonomy":"dealstore","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fdealstore&post=357218"},{"taxonomy":"offerexpiration","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fofferexpiration&post=357218"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}