In a significant move aimed at enhancing online safety and privacy, the Canadian government has announced plans to establish a comprehensive digital regulator. This proposed body is set to take over regulatory responsibilities from the privacy commissioner and enforce new rules concerning online interactions. Critics have expressed concerns about the potential for the regulator to become a “super-regulator,” while proponents argue that a robust regulatory framework is essential to address the growing challenges posed by technology.
Overview of the Proposed Legislation
In June 2026, the Liberal government unveiled two pivotal pieces of legislation: Bill C-34, which focuses on digital safety, and Bill C-36, which addresses privacy concerns.
Bill C-34 mandates that social media platforms temporarily restrict access for users under the age of 16 and introduces regulations for AI chatbot developers, imposing a duty of care on these companies. Meanwhile, Bill C-36 aims to enhance standards for managing children’s data, empower Canadians to request the deletion of their personal information, and ensure transparency regarding automated decision-making processes that significantly affect individuals.
Both bills are set to be administered by the newly established Digital Safety and Data Protection Commission of Canada, which will consist of five members appointed by the cabinet. Government officials anticipate that this commission will take approximately 18 months to become operational.
Powers and Responsibilities of the New Regulator
The proposed commission would possess the authority to issue binding orders to businesses and impose substantial fines, reaching up to $10 million or three per cent of an organisation’s global revenue for lesser offences. For severe violations, such as obstructing the commission’s activities, fines could escalate to $25 million or five per cent of global revenue.
This body will play a crucial role in determining the effectiveness and privacy compliance of age-verification methods and will assess whether social media platforms are eligible for exemptions from age restrictions.
University of Ottawa law professor Michael Geist has described the commission as a “digital super-regulator,” highlighting its extensive responsibilities spanning online content regulation and personal data oversight. He suggests that the powers granted to this commission might be unparalleled in the democratic world.
An Unprecedented Approach to Regulation
The dual responsibilities assigned to the new regulator mark a departure from international norms, where privacy and online safety regulators are typically separate entities. Heidi Tworek, a history and public policy professor at the University of British Columbia, noted that Canada’s approach is distinct in that it combines both functions into one commission, unlike countries like Australia, which had an existing safety commission when implementing similar regulations.
The government’s rationale for this integrated approach is to streamline regulatory processes for Canadians interacting with private-sector companies, particularly in areas concerning children’s safety and data practices. Law professor Teresa Scassa suggests that the government perceives synergies in managing overlapping digital regulation issues within a single framework.
Concerns Over Consolidating Powers
While some experts support the establishment of a powerful regulatory body, others express reservations about transferring responsibilities from the privacy commissioner to the new commission. The privacy commissioner will retain authority solely under the Privacy Act, which governs government entities, leaving the private sector under the new commission’s jurisdiction.
Florian Martin-Bariteau, a research chair in technology and society at the University of Ottawa, argues that merging these responsibilities risks undermining the established reputation and effectiveness of the privacy commission. He cautions that the transition to a new regulatory framework could lead to a period of confusion and inadequately protect individuals’ privacy rights.
Scassa underscores the importance of the privacy commission’s independence, suggesting that the government may prefer a more controllable body in the new commission. The transition could jeopardise the extensive expertise and credibility the privacy commissioner has built over the years, potentially diminishing Canadians’ privacy protections during the establishment of the new regulator.
Why it Matters
The creation of a new digital regulator represents a pivotal shift in Canada’s approach to online safety and privacy. As technology continues to evolve at an unprecedented pace, the need for effective regulation becomes increasingly urgent. This proposed commission could either provide the robust oversight necessary to protect Canadians in the digital age or lead to a chaotic transition that undermines existing privacy safeguards. The stakes are high, as the balance between innovation and protection hangs in the balance, making this a crucial development for citizens and businesses alike.
