In a significant move to modernise its privacy laws, the Canadian government has introduced Bill C-36, which mandates stricter data protection measures for children and empowers Canadians to request the deletion of their personal information. Unveiled in the House of Commons on Monday by Evan Solomon, Minister of Artificial Intelligence and Digital Innovation, the bill aims to tackle issues such as surveillance pricing and enhance transparency regarding how companies handle consumer data.
Key Provisions of Bill C-36
The proposed legislation brings forth an array of responsibilities for companies that manage personal data, particularly concerning minors. Under the new regulations, businesses will be compelled to treat children’s information as sensitive and obtain explicit parental consent before retaining such data. This is a notable shift from current practices, as it acknowledges the rising need for protecting young users in an increasingly digital world.
During the announcement, Solomon emphasised the importance of safeguarding children’s data, stating, “The bill requires companies to treat children’s personal information as sensitive. That means stronger protection when companies collect, use, or share information about children.” The bill seeks to establish shorter retention periods for children’s data compared to adults, reinforcing the notion that younger individuals require enhanced protections.
In addition to child data protection, the bill addresses the contentious issue of surveillance pricing. Although the term “surveillance pricing” is not explicitly mentioned within the legislation, Solomon indicated that the new federal regulator would provide guidance on this practice, which involves retailers charging different prices based on consumer shopping behaviours. He asserted, “It takes aim at surveillance pricing to stop price gouging,” while also clarifying that beneficial uses of data, such as loyalty programmes, should not be adversely affected.
Enhanced Transparency and Consumer Rights
Another critical element of Bill C-36 is its commitment to transparency in data usage. Canadians will gain the right to inquire about the personal information that informs decisions on significant financial matters, such as mortgages and credit ratings. This increased visibility into automated decision-making processes is a response to growing public demand for clarity in how artificial intelligence (AI) impacts their lives.
Solomon expressed that Canadians expect a higher standard of accountability from companies when it comes to personal data, stating, “We know our data is important, we know our kids’ data is important. We want to protect it, we want some controls.” This sentiment reflects a broader societal shift towards prioritising data privacy and security, particularly for vulnerable populations like children.
The Role of the New Regulator
With the introduction of this legislation, the Canadian government will establish a new regulatory body, the Digital Safety and Data Protection Commission of Canada. This entity will replace the previously proposed Digital Safety Commission announced alongside the Safe Social Media bill. The commission will possess the authority to impose hefty fines of up to $10 million or 3 per cent of a company’s global revenue for non-compliance.
Privacy Commissioner Philippe Dufresne welcomed the bill, highlighting its pivotal role in enhancing privacy rights in Canada. He noted the inclusion of vital recommendations, such as recognising privacy as a fundamental right and ensuring that the best interests of children are prioritised. Dufresne remarked, “In particular, I welcome proposals to recognise privacy as a fundamental right… and stronger enforcement powers.”
Modernising Outdated Legislation
Bill C-36 serves as a crucial update to the Personal Information Protection and Electronic Documents Act (PIPEDA), which has been in place for over 25 years and was established before the rise of AI and online data collection from children. The new legislation will not only streamline the process for individuals to transfer their data between businesses but will also mandate clear explanations of how personal information will be used, ensuring that consent is sought in a straightforward manner.
Companies will be required to implement robust privacy safeguards and conduct risk assessments prior to transferring personal data outside of Canada. This is a vital step in bolstering Canadians’ confidence in how their information is handled in an interconnected digital economy.
Why it Matters
The introduction of Bill C-36 represents a transformative leap towards safeguarding personal data in Canada, particularly for children. As the digital landscape continues to evolve, the need for robust legislative frameworks to protect vulnerable users becomes increasingly urgent. By imposing higher standards on data protection and enhancing consumer rights, this bill not only aligns Canada with contemporary privacy expectations but also sets a precedent for other nations grappling with similar challenges. The effectiveness of these new regulations will ultimately hinge on the commitment of both regulators and businesses to uphold these standards in the rapidly changing digital economy.