\n<\/p>\n
The proposed new privacy law On June 15, 2026, the Minister The bill is similar to <\/span>Bill C-27, called the \u201c<\/span>Digital Charter Implementation Act, Unlike its predecessors, and The Bill creates a new Protecting The PPCDA is in a completely The most significant PIPEDA applies to the The PPCDA has an interesting \u201cto <\/p>\n \u00a0<\/p>\n <\/span>Anonymous information is In a number of areas, the PPCDA With respect to consent, One significant change Like PIPEDA, an individual can At a time when \u201cdigital The most notable changes are As with PIPEDA, enforcement An organization can dispute a Appeals from the Commission Possible penalties are huge. The Crown prosecutor can The Bill was tabled (This summary was originally written for the Canadian Technology Law Association’s newsletter.)<\/span><\/p>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":" The proposed new privacy law includes order-making powers, penalties but completely sidelines the existing Privacy Commissioner On June 15, 2026, the Minister of Artificial Intelligence and Digital Innovation Even Solomon tabled in the House of Commons Bill C-36, called \u201cAn Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[97],"tags":[27799,594,89193,1122,196375],"dealstore":[],"offerexpiration":[],"class_list":["post-7033070","post","type-post","status-publish","format-standard","hentry","category-legal","tag-commons","tag-house","tag-pipeda","tag-replacement","tag-tabled"],"yoast_head":"\n
\nincludes order-making powers, penalties but completely sidelines the existing
\nPrivacy Commissioner<\/span><\/span><\/i><\/p>\n
\nof Artificial Intelligence and Digital Innovation Even Solomon tabled in the
\nHouse of Commons <\/span>Bill C-36<\/a><\/span>, called \u201c<\/span>An Act to enact the Protecting Privacy
\nand Consumer Data Act, to amend the Personal Information Protection and
\nElectronic Documents Act and to make amendments to other Acts<\/a><\/span>\u201d. This is the long-awaited
\nprivacy bill that is slated to replace the Personal Information Protection
\nand Electronic Documents Act <\/i>(PIPEDA), which has regulated the collection,
\nuse and disclosure of personal information in the course of commercial activity
\nin Canada since 2001.<\/span><\/span><\/p>\n
\n2022<\/i><\/a><\/span>\u201d
\nand its predecessor, Bill C-11, <\/span>which was tabled in 2019 as the \u201c<\/span>Digital Charter Implementation Act,
\n2019<\/i><\/a><\/span>\u201d<\/span><\/i>. Both of them languished in
\nParliament until the federal government called the last election.<\/span><\/span><\/p>\n
\nPIPEDA before it, the new law does not involve the existing Privacy
\nCommissioner of Canada. Oversight of the new law will be in the hands of the Digital
\nSafety and Data Protection Commission of Canada, first introduced as part of
\nthe \u201cOnline Harms\u201d bill, Bill C-34. And unlike Bill C-27, it does not
\nincorporate comprehensive regulation of artificial intelligence.<\/span><\/p>\n
\nPrivacy and Consumer Data Act<\/i> (PPCDA), which effectively replaces Part 1 of
\nPIPEDA.<\/span><\/p>\n
\ndifferent structure than PIPEDA. PIPEDA included a schedule taken from the
\nCanadian Standards Association Model Code for the Protection of Personal
\nInformation and generally required regulated organizations to follow the Code.
\nSimilar to the Personal Information Protection Act<\/i>s of British Columbia
\nand Alberta, the substance of the Code has largely been translated to statutory
\nlanguage in the Bill itself.<\/span><\/p>\n
\ndifference is what many privacy advocates have been calling for: order-making
\npowers and significant penalties. The Bill also creates a new bureaucracy called
\nthe Digital Safety and Data Protection Commission of Canada (the Commission).
\nThe existing role of the Privacy Commissioner of Canada will be taken over by a
\nnew Privacy and Consumer Data Commissioner, who is a member of the Commission. \u00a0<\/span><\/p>\n
\ncollection, use and disclosure of personal information in the course of
\ncommercial activity and to federally-regulated workplaces. That will not change
\nin the PPCDA, but a new section 6(2) says that the new Act specifically applies
\nto personal information that is collected, used or disclosed interprovincially
\nor internationally. This provision is not expressly limited to commercial
\nactivity, so there\u2019s an argument that could be made that it would apply to
\nnon-commercial or employee personal information that crosses borders.<\/span><\/p>\n
\napproach to anonymous and de-identified data. It officially creates these two
\ncategories. It defines anonymize as:<\/span><\/p>\n
\nirreversibly and permanently modify personal information to ensure that there
\nis no reasonably foreseeable risk in the circumstances that an individual can
\nbe identified from the information, whether directly or indirectly, by any
\nmeans.\u200d\u201d <\/span><\/span><\/p>\n
\ncarved out of the PPCDA\u2019s purview. But de-identified data remains in-scope. To
\nde-identify data means \u201cmodify personal information so that an individual
\ncannot be directly identified from it, although a risk of the individual being
\nidentified remains.\u201d<\/span><\/p>\n
\nprovides more detail about what is required to comply with general principles
\nthat are already in PIPEDA. For example, every regulated organization must have
\na documented privacy management program, and all the supporting documentation
\nfor an organization\u2019s privacy management program must be provided to the Privacy
\nand Consumer Data Commissioner on request.<\/span><\/p>\n
\norganizations expressly have to record and document the purposes for which any
\npersonal information is collected, used or disclosed. This was implied in the
\nCSA Model Code, but is now expressly spelled out in the Act. The PPCDA lays out
\nin detail what is required for consent to be valid. It requires not only
\nidentifying the purposes but also communicating in plain language how
\ninformation will be collected, the reasonably foreseeable consequences of is
\nuse, what types of information and to whom the information may be disclosed. The
\n\u201cpurpose limitation\u201d is scaled back further, from limiting the use of personal
\ninformation to the identified purposes, but under the PPCDA an organization
\ncannot \u201crequire an individual to consent to the collection, use or disclosure
\nof their personal information beyond what is necessary to provide the product
\nor service.\u201d<\/span><\/p>\n
\ncompared to is the circumstances under which an organization can collect and
\nuse personal information without consent<\/b>. Section 18 of the PPCDA allows
\ncollection and use without consent for certain business activities, where it
\nwould reasonably be expected to provide the service, for security purposes, for
\nsafety or other prescribed activities. Notably, this exception cannot be used
\nwhere the personal information is to be collected or used to influence the
\nindividual\u2019s behaviour or decisions. There is also a \u201clegitimate interest\u201d
\nexception, which requires an organization to document any possible adverse
\neffects on the individual, mitigate them and finally weigh whether the
\nlegitimate interest outweighs any adverse effects. It\u2019s unclear how \u201cadverse
\neffects\u201d would be measured.<\/span><\/p>\n
\nwithdraw consent subject to similar limitations that were in PIPEDA. But what\u2019s
\nchanged is that an individual can require that their information be disposed
\nof. Notably, disposal includes deletion and rendering it anonymous.<\/span><\/p>\n
\nsovereignty\u201d is a common buzzword, the new Act will require privacy impact
\nassessments (in a to be prescribed format) prior to disclosing or transferring
\ndata outside of Canada.<\/span><\/p>\n
\nwith respect to oversight and enforcement. The Privacy and Consumer Data
\nCommissioner is not an ombudsman with a focus on nudging companies to
\ncompliance and solving problems for individuals. The new Bill veers strongly
\ntowards enforcement.<\/span><\/p>\n
\nstarts with a complaint by an individual or the Privacy and Consumer Data
\nCommissioner can initiate it on their own accord. After the investigation, the Privacy
\nand Consumer Data Commissioner can issue a notice of contravention, which can
\ninclude proposed penalties or proposed orders. If the organization does not
\ncontest the notice of contravention, they are deemed to have contravened the
\nAct and the proposed penalties and orders, if any, come into effect.<\/span><\/p>\n
\nnotice of contravention before the new Commission, which is the tribunal for
\nthe Act. If a notice of contravention is disputed, the Commission is
\nresponsible for conducting hearings to review the Privacy and Consumer Data
\nCommissioner\u2019s findings. It has the authority to confirm, cancel, or vary the
\nCommissioner’s notice of contravention. It can also issue interim orders in
\nexigent circumstances.<\/span><\/p>\n
\ncan be made to the Federal Court of Canada.<\/span><\/p>\n
\nThe maximum administrative monetary penalty that the tribunal can impose in one
\ncase is the higher of $10,000,000 and 3% of the organization\u2019s gross global
\nrevenue in its financial year before the one in which the penalty is imposed.
\nThe Act also provides for quasi-criminal prosecutions, which can get even
\nhigher.<\/span><\/p>\n
\ndecide whether to proceed as an indictable offence with a fine not exceeding
\nthe higher of $25,000,000 and 5% of the organization\u2019s gross global revenue or
\na summary offence with a fine not exceeding the higher of $20,000,000 and 4% of
\nthe organization\u2019s gross global revenue. If it\u2019s a prosecution, then the usual
\nrules of criminal procedure and fairness apply, like the presumption of
\ninnocence and proof beyond a reasonable doubt.<\/span><\/p>\n
\nimmediately before Parliament rises for the summer break. When Parliament
\nresumes in September, it\u2019s impossible to predict whether the Bill will be
\nfast-tracked or whether it will languish like its predecessors. It is also hard
\nto predict whether the government will be amenable to suggested amendments at
\nthe Committee stage.<\/span><\/p>\n