The Canadian government has unveiled a significant overhaul of its privacy laws, introducing Bill C-36 in the House of Commons. This legislation seeks to enhance protections for children’s data and grant Canadians greater control over their personal information, including the ability to request its deletion.
New Responsibilities for Companies
Under the proposed bill, businesses will face stricter obligations to safeguard children’s personal data. This will likely necessitate obtaining explicit consent from parents before retaining such information, along with limiting the retention period compared to adult data. Evan Solomon, Minister of Artificial Intelligence and Digital Innovation, emphasised the importance of treating children’s data with heightened sensitivity, stating, “The bill requires companies to treat children’s personal information as sensitive. That means stronger protection when companies collect, use or share information about children.”
Moreover, Canadians will be empowered to request the removal of their personal information from company databases, including instances of deepfake technology where individuals’ likenesses are misused. Solomon noted that while there are exceptions to this deletion rule—such as when data is anonymised or used for law enforcement purposes—the overarching aim is to bolster transparency in how companies utilise personal data.
Tackling Surveillance Pricing
A notable aspect of the bill is its focus on combating the practice of surveillance pricing, where retailers exploit customer data to charge varying prices for the same product based on individual shopping habits. Although the term “surveillance pricing” is not explicitly mentioned in the legislation, Solomon has indicated that he will instruct the newly established regulatory body to provide guidance on this issue once operational. “We want to stop price gouging,” he asserted, while also acknowledging the necessity for data to be used beneficially, such as in loyalty programmes.
Strengthened Regulatory Oversight
The new legislation will introduce a federal regulator tasked with overseeing the expanded privacy framework, a body that will be known as the Digital Safety and Data Protection Commission of Canada. This regulator will wield the authority to impose substantial penalties—up to CA$10 million or 3% of a company’s global revenue, whichever is higher—on those failing to comply with the new regulations. Philippe Dufresne, the Privacy Commissioner of Canada, hailed the bill as a milestone for privacy in the country, expressing satisfaction that many of his recommendations were integrated into the final draft.
This legislative update will replace the outdated Personal Information Protection and Electronic Documents Act (PIPEDA), originally enacted over 25 years ago, prior to the rise of AI technologies and the widespread collection of children’s data online. The new bill aims to facilitate the transfer of personal data between businesses while ensuring that consent is sought in a clear and comprehensible manner.
A New Era of Data Control
The bill mandates that companies can only collect, use, or disclose personal information for purposes deemed appropriate by a reasonable person. Factors such as the sensitivity of the data and the existence of less intrusive methods of achieving a business goal will be considered. Notably, there are exceptions to the consent requirement in cases where data collection serves the individual’s clear interests or in emergency situations.
Furthermore, the legislation introduces robust safeguards and risk assessments for the transfer of personal data outside of Canada, aiming to protect Canadians’ information in a global digital landscape. Vass Bednar, managing director of the Canadian Shield Institute, remarked that while the bill represents a promising start, its ultimate success will hinge on whether it provides meaningful protection for Canadians in the digital economy.
Why it Matters
This legislative shift is not merely a matter of regulatory compliance; it reflects a growing recognition of the importance of data privacy in a digital age. As Canadians increasingly demand accountability from companies regarding their personal information, Bill C-36 positions the country at the forefront of privacy protection. By prioritising children’s data and enhancing consumer rights, Canada is signalling its commitment to fostering a safer digital environment, ultimately strengthening public trust in the evolving landscape of data management and technology.