In a significant stride towards modernising Canada’s privacy framework, the federal government has introduced Bill C-36, which mandates enhanced protections for personal data, particularly concerning children. Unveiled in the House of Commons by Evan Solomon, Minister of Artificial Intelligence and Digital Innovation, the bill seeks to hold companies accountable for data handling practices while also establishing a new regulatory body tasked with overseeing these changes.
Key Provisions of Bill C-36
Under the proposed legislation, businesses will face stricter obligations to safeguard the personal information of children. The bill stipulates that companies must obtain explicit consent from parents to collect or retain data related to minors and will be required to manage this information with heightened sensitivity. “The bill requires companies to treat children’s personal information as sensitive,” Solomon explained, emphasising the need for robust protections in the digital landscape.
Additionally, Canadians will gain the right to request the deletion of their personal data, including instances of deepfakes—where artificial intelligence generates synthetic representations of individuals without their consent. However, there will be exceptions, such as when the data does not directly identify an individual or when it is needed for law enforcement purposes.
Enhanced Transparency and Accountability
The legislation is designed to foster greater transparency in how companies utilise consumer data. Canadians will have the ability to inquire about the personal data that informs decisions such as mortgage approvals or credit ratings. Solomon highlighted that the public is demanding “visibility inside how decisions are made by AI,” reflecting a broader societal need for clarity and accountability in automated processes.
Moreover, the new bill addresses the contentious issue of “surveillance pricing,” where retailers exploit consumer data to set different prices for the same products. While the term is not explicitly mentioned in the legislation, Solomon intends for the forthcoming regulatory body to provide guidelines to mitigate this practice.
Establishing a New Regulatory Framework
The introduction of Bill C-36 also heralds the establishment of the Digital Safety and Data Protection Commission of Canada, a body with the authority to enforce compliance with the new privacy regulations. This commission, a rebranded version of the previously proposed Digital Safety Commission, will have the capacity to impose fines of up to $10 million or 3% of a company’s global revenue—the greater amount being applicable in instances of non-compliance.
Philippe Dufresne, Canada’s Privacy Commissioner, welcomed the bill as a “pivotal step for privacy in Canada,” noting that many of his recommendations had been incorporated. He particularly praised the recognition of privacy as a fundamental right, the emphasis on the best interests of children, and the strengthened enforcement powers intended to protect citizens in the digital age.
Updating Outdated Legislation
At its core, Bill C-36 seeks to amend the Personal Information Protection and Electronic Documents Act (PIPEDA), a framework that has remained largely unchanged for over 25 years. This legislation, originally crafted before the rise of artificial intelligence and deepfake technology, is now considered outdated in the context of contemporary data practices. The new bill aims to simplify the process for individuals wishing to transfer their personal data between businesses and mandates that consent for data usage be sought in clear, understandable language.
Businesses will be constrained to collect and use personal information only for purposes deemed appropriate by reasonable standards, taking into account the sensitivity of the data. Exceptions exist, however, allowing for certain data uses without prior consent in emergencies or situations where obtaining consent is impractical.
Why it Matters
The introduction of Bill C-36 marks a transformative moment for privacy rights in Canada, responding to growing public demand for stronger safeguards in a digital landscape increasingly characterised by data exploitation. This legislation not only seeks to protect vulnerable populations, such as children, but also aims to restore trust between consumers and corporations by ensuring accountability in data practices. As the digital economy evolves, the effectiveness of these new regulations will be critical in establishing a secure and equitable environment for all Canadians.
