Bill C-36: Third Attempt At Revamping Canada’s Privacy Law

On June 15, 2026 the federal government tabled Bill C-36: An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts (the “PPCDA” or “Bill C-36”). This marks the government’s third attempt at updating the current federal private sector privacy legislation. Predecessors, such as Bill C-11: Digital Charter Implementation Act, 2020,and Bill C-27: Digital Charter Implementation Act, 2022, died on the order paper due to either the dissolution or prorogation of the federal government. 

The PPCDA proposes to replace Part I of the current Personal Information Protection and Electronic Documents Act (“PIPEDA”), representing one of the most significant changes to Canada’s federal privacy law in over 25 years.

Bill C-36 aims to enhance privacy protections for inpiduals while fostering innovation and strengthening enforcement measures and maintains some of the prior bill provisions while revising others. At a glance, the following are a few of the notable changes the bill proposes to enact.

• Recognizes privacy as a fundamental right.

• Provides a statutory definition of “sensitive information” and defines “personal information” to expressly capture information that is inferred about an inpidual. 

• Requires express consent by default, but also creates new exceptions to the consent requirement, wherein an organization may collect, use or disclose an inpidual’s personal information for the purposes of a business activity or legitimate interest without the knowledge or consent of the inpidual.

• Implements higher standards when handling children’s personal information; a “child” being defined as an inpidual under 18 years old.

• Establishes a data mobility framework, wherein upon request, organizations are required to disclose the personal information they have collected from the inpidual to a designated organization, as long as both organizations are subject to a data mobility framework.

• Like Bill C-27, creates a distinction between de-identified and anonymized data, further clarifying that while de-identified information continues to be considered “personal information”, anonymized data does not. Despite this, an organization is not required to act on requests for access to personal information, requests for amending personal information, requests regarding data mobility, or requests for disposal of personal information following a written request, if the information is de-identified.

• Creates a requirement for completing a privacy impact assessment prior to disclosing or transferring personal information outside of Canada and when relying on the legitimate interest exception to consent, and implementing measures to mitigate any risks identified.

• Establishes transparency and other requirements (i.e., right to seek human review) regarding an organization’s use of any automated decision system for making predictions, recommendations or decisions about an inpidual that could have a legal or similar effect on them.

• Establishes the creation of the Canadian Digital Safety and Data Protection Commission for administering the PPCDA, a new designated Privacy and Consumer Data Commissioner for overseeing and enforcing the PPCDA, along with the Privacy and Consumer Data pision. The Commission will have the power to issue binding orders. This would replace the current Office of the Privacy Commissioner, which was established in 1983 and has been overseeing PIPEDA compliance since 2001.

• Imposes significant financial consequences for non-compliance. Contravention of certain provisions can result in administrative monetary penalties up to the greater of $10,000,000 or 3% of the organization’s gross global revenue. Serious offences can result in fines up to the greater of $25,000,000 or 5% of the organization’s gross global revenue. 

Unlike its predecessors, Bill C-36 does not include standalone artificial intelligence legislation.

At the time of writing, the first reading of Bill C-36 at the House of Commons has been completed and the bill still must make its way through further readings at the House of Commons, the Senate and committee study. The Government is eager to move this along, given its announcement of its AI for All Strategy and the importance of personal information to AI. The practical implications of this new bill will become clearer as it moves through these stages, and we will provide you with more comprehensive updates as the bill progresses.