The Canadian government has unveiled a significant reform to its privacy framework with the introduction of a new bill aimed at bolstering protections for personal data, particularly concerning children. Announced on Monday by Evan Solomon, Minister of Artificial Intelligence and Digital Innovation, the proposed legislation seeks to establish stricter responsibilities for companies regarding the management of Canadians’ personal information.
Key Provisions of the New Bill
The recently introduced Bill C-36 mandates that businesses implement heightened safeguards when handling data pertaining to minors. It is anticipated that this will involve obtaining explicit parental consent before retaining any information about children. “The bill requires companies to treat children’s personal information as sensitive,” Solomon stated, emphasising the need for robust protections in the collection, use, or sharing of such data.
In addition to child data protection, the bill aims to enhance transparency in how companies utilise personal data. Canadians will have the right to request the deletion of their information, including instances where AI-generated content, such as deepfakes, misuses their likeness. However, certain exceptions will apply, particularly for data that does not identify individuals or for information used by law enforcement.
Addressing Surveillance Pricing and AI Transparency
The legislation also introduces measures to combat “surveillance pricing”, a controversial practice where businesses charge different prices based on consumer data and shopping behaviour. Solomon noted that while the bill does not explicitly mention surveillance pricing, he intends for the newly established regulator to provide guidance on this issue once operational.
He remarked, “People want visibility inside how decisions are made by AI,” underscoring the demand for clearer insights into how personal data influences significant decisions, such as credit ratings or mortgage approvals.
The bill also requires companies to disclose their use of automated decision-making processes, ensuring that consumers are informed about decisions made without human involvement. This move aligns with growing public expectations for accountability in how personal data is handled.
Establishing a New Regulatory Authority
To enforce these new regulations, the bill proposes the creation of the Digital Safety and Data Protection Commission of Canada, an evolution from the previously announced Digital Safety Commission. This body will possess the authority to impose substantial penalties—up to CAD 10 million or 3% of a company’s global revenue—on organisations that fail to comply with the stipulated responsibilities.
Philippe Dufresne, Canada’s Privacy Commissioner, expressed his endorsement of the bill, describing it as a pivotal advancement for privacy rights in Canada. He welcomed the recognition of privacy as a fundamental right and the explicit commitment to safeguarding children’s best interests, alongside enhanced enforcement capabilities.
Revamping Canada’s Outdated Privacy Laws
The proposed legislation will update the existing Personal Information Protection and Electronic Documents Act (PIPEDA), which has been in place for over 25 years and predates the rise of AI and extensive online data collection practices. Notably, the new bill will streamline the process for individuals wishing to transfer their data between businesses, ensuring that requests are fulfilled promptly.
The legislation will also mandate that companies seek clear consent for data usage, providing individuals with straightforward explanations of how their information will be processed. Furthermore, businesses will only be permitted to collect personal information for purposes deemed reasonable and appropriate, taking into account the sensitivity of the data involved.
While the bill does incorporate several exceptions for data collection without prior consent—such as in emergency situations—it firmly establishes the need for comprehensive privacy safeguards and risk assessments before any personal information is transferred outside Canada.
Vass Bednar, managing director of the Canadian Shield Institute, acknowledged the bill as a necessary restart in privacy legislation, though he cautioned that its effectiveness will ultimately depend on whether it delivers meaningful protections for Canadians in the digital landscape.
Why it Matters
This legislative initiative marks a critical shift in Canada’s approach to data privacy, reflecting a growing recognition of the importance of safeguarding personal information in an increasingly digital world. By placing greater emphasis on the protection of children’s data and enhancing consumer rights, the government aims to foster an environment of trust and accountability among businesses that handle personal information. As technology continues to evolve, the success of these reforms will be pivotal in ensuring that Canadians can navigate the digital economy with confidence, knowing that their privacy is being respected and protected.