Bill C-36 Proposes Overhaul of Canada's Federal Privacy Framework

Overview of the Proposed Privacy Reform

On June 15, 2026, the federal government introduced Bill C-36, an Act to enact the Protecting Privacy and Consumer Data Act (PPCDA). If passed, the PPCDA would replace Part I of the Personal Information Protection and Electronic Documents Act (PIPEDA). This proposal represents the government's third attempt in recent years to modernize federal private-sector privacy legislation. Crucially, because the current government secured a parliamentary majority earlier this year, this iteration of the privacy overhaul faces a much smoother path to becoming law than previous attempts. The bill arrives following the introduction of Bill C-34, the Safe Social Media Act. Bill C-36 expands the mandate of the Digital Safety Commission, renaming it the Digital Safety and Data Protection Commission of Canada, and establishes a new designated Privacy and Consumer Data Commissioner to oversee and enforce the PPCDA. The PPCDA explicitly recognizes privacy as a fundamental right and aims to strengthen enforcement measures.

Enhanced Compliance and Governance Requirements

Bill C-36 introduces several prescriptive operational requirements for organizations handling personal information. These include:

Privacy Management Programs: Organizations would be required to implement and maintain a formal privacy management program. The regulator could require access to the documents within this program upon request.

In practice: organizations would need to maintain documented policies and procedures governing how personal data is collected, stored, and deleted, not simply demonstrate sound practices, but produce records substantiating them.

Consent and Exceptions: While the bill requires express consent by default, it introduces a "legitimate interest" ground that could allow the collection, use, or disclosure of personal information without consent in certain circumstances. This exception requires the organization to demonstrate that its interest outweighs foreseeable adverse effects and aligns with reasonable expectations. The bill also expands "business activity" exceptions for defined operational purposes, such as providing services or system security, provided the information is not used to influence an individual.

In practice: consent would remain the default requirement, but the "legitimate interest" exception would permit processing without consent where an organization could demonstrate that its interest clearly outweighs any adverse effect on the individual and would not be contrary to reasonable expectations. For example, fraud detection using transaction data may qualify, as it primarily benefits and protects the customer. Using the same data to build advertising profiles may not, as this would fall outside the "not used to influence an individual" limitation.

Automated Decision Systems (AI): The PPCDA establishes transparency requirements regarding an organization's use of automated decision systems to make predictions, recommendations, or decisions that could have a legal or similar effect on an individual. Upon request, organizations must provide an explanation of the prediction, recommendation, or decision in plain language.

In practice: where an algorithmic system produces an outcome with meaningful consequences for an individual, a credit decision, an employment screening result, a claims determination, the affected individual could request a plain-language explanation of how that outcome was reached. Organizations would need to ensure such explanations could be generated and would not be limited to a general description of the system's function.

De-identified and Anonymized Data: The bill creates a statutory distinction between de-identified and anonymized data. It confirms that de-identified information remains subject to core compliance obligations. Anonymized data, defined as information modified to ensure no reasonably foreseeable risk of re-identification, does not.

In practice: these terms are frequently used interchangeably but would carry distinct legal consequences under the bill. De-identified data would have direct identifiers removed but could still permit re-identification given sufficient context or auxiliary data, a dataset showing age, city, and purchase details might still be traceable to an individual, and would remain subject to the Act's core obligations. Anonymized data would need to be modified such that re-identification is no longer reasonably foreseeable by any means, and would fall outside the Act's scope entirely. The distinction would determine whether ongoing compliance obligations apply.

Privacy Impact Assessments: Organizations must complete a privacy impact assessment prior to transferring personal information outside of Canada or when relying on the legitimate interest exception, and they must implement measures to mitigate identified risks.

In practice: a formal risk assessment would need to be completed and risk-mitigation measures put in place before, not after, personal information is transferred cross-border or before relying on the legitimate interest exception. This would shift the compliance obligation to a proactive, pre-emptive step rather than a reactive one.

Heightened Standards for Minors: The bill implements higher standards for handling the personal information of children, defining a "child" as an individual under 18 years old.

In practice: organizations processing the personal information of individuals under 18 should anticipate elevated consent requirements and greater constraints on reliance on exceptions such as legitimate interest, consistent with treating children's data as a sensitive category.

Want daily regulatory updates delivered straight to your inbox? Subscribe to the Reg Compliance Hub here.

Expanded Individual Rights

Bill C-36 seeks to enhance the rights of individuals regarding their personal data:

Disposal Rights: Individuals would gain the right to request the "disposal" of their personal information, defined as permanent deletion or anonymization. This applies broadly and includes AI-generated deepfakes. However, organizations are not required to act on disposal requests if the information is already de-identified.

In practice: individuals would gain a right analogous to a right to erasure, they could request permanent deletion or anonymization of their data, and this would extend to requesting removal of AI-generated synthetic media depicting them. The obligation would not extend to information that has already been de-identified, on the basis that it is no longer readily linked to the individual.

Data Mobility: The bill establishes a data mobility framework. Upon request, an organization would be required to disclose collected personal information to another designated organization, provided both are subject to the framework.

In practice: individuals could direct the transfer of their data between organizations, comparable in concept to account-switching mechanisms in other regulated sectors. This obligation would apply only between organizations that fall within the designated framework, meaning its practical reach would depend on which sectors or organizations are ultimately brought into scope.

Enforcement and Penalties

Bill C-36 signals a shift toward a more active and interventionist regulator with formal audit powers and a structured investigation process. The proposed penalties for non-compliance are severe:

Administrative Monetary Penalties: Contravention of certain provisions could result in administrative monetary penalties up to the greater of CAD $10,000,000 or 3% of the organization's gross global revenue in the prior financial year.

In practice: the $10 million floor would apply to smaller organizations, while the 3% revenue-based calculation would become the operative threshold for larger organizations. An organization with $5 billion in global revenue, for example, could face potential exposure of up to $150 million, since 3% of that figure exceeds the flat threshold.

Fines for Serious Offences: Serious offences could result in fines up to the greater of CAD $25,000,000 or 5% of gross global revenue.

In practice: this tier would apply to more serious contraventions and would carry meaningfully higher exposure, again scaling upward for larger organizations based on global revenue rather than Canadian revenue alone.

Private Right of Action: The bill introduces a private right of action for damages following a finding of contravention or a final decision by the federal privacy regulator.

In practice: individuals currently have no direct route to sue over a privacy contravention and must rely on the regulator's process. Under the PPCDA, once the regulator had made a finding of contravention or issued a final decision, affected individuals would gain standing to pursue damages directly through the courts.

Disclaimer: This article does not constitute legal advice. Readers should seek legal or tax advice from their professional advisers regarding their specific regulatory and legal obligations.

Want daily regulatory updates delivered straight to your inbox? Subscribe to the Reg Compliance Hub here.