Canada's proposed new privacy law: Bill C-36, the Protecting Privacy and Consumer Data Act

The Personal Information Protection and Electronic Documents Act, known as PIPEDA, has been Canada's private sector privacy law since 2001.

It's currently the law that governs how businesses collect, use and disclose your personal information. It's the law that made the Privacy Commissioner of Canada the federal privacy watchdog. And it's the law that most privacy professionals in Canada have built their careers around.

But now, the federal government has tabled Bill C-36, which would repeal and replace the privacy portions of PIPEDA with an entirely new framework.

And if you've been following federal privacy reform over the last few years, a lot of this will look familiar.

We've seen Bill C-11, the Digital Charter Implementation Act, 2020.

We've seen Bill C-27, Digital Charter Implementation Act, 2022.

Both died on the Order Paper.

Now we have Bill C-36 called the Protecting Privacy and ConsumerData Act.

But this bill does something that neither of those previous bills did.

It completely sidelines the existing Privacy Commissioner of Canada and hands enforcement to an entirely new regulatory structure that seems to be part of what I expect will be the super-mega digital regulator for Canada.

In this episode, I'm going to walk you through what Bill C-36 does, what's new, what's familiar, what businesses need to know, and what I think are some of the most significant changes.

On June 15, 2026, the Minister of Artificial Intelligence and Digital Innovation tabled Bill C-36, titled An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts.

The centrepiece of the bill is a new law called the Protecting Privacy and Consumer Data Act, or PPCDA.

If passed, it would replace Part 1 of PIPEDA, which has governed private-sector privacy in Canada since 2001.

I don’t really like the name of the new law. On one hand, the law says that privacy is a fundamental right, but in the title it’s about people as “consumers”. If we have a fundamental right, it’s because we’re humans, not just consumers. I think it puts it all in a bad frame.

But in any event, let's dig in.

Déjà Vu All Over Again

If you've read Bill C-27, much of Bill C-36 will look very familiar. In substance, it takes PIPEDA and turns the obligations up to eleven. 

Many of the concepts are carried forward:

• accountability obligations;
• privacy management programs;
• enhanced consent requirements;
• legitimate interest exceptions;
• rights to disposal of personal information;
• data mobility provisions;
• administrative monetary penalties; and
• a much stronger enforcement framework.

What's missing, however, is the artificial intelligence legislation that was bundled into Bill C-27. It’s not really missing since it didn’t belong in Bill C-27 in the first place.

This new bill focuses exclusively on private-sector privacy law.

The Biggest Surprise — Goodbye Privacy Commissioner?

In my view, the most significant structural change is not about consent, de-identification or penalties. We expected that. 

It's about who oversees and enforces the law.

Historically, privacy complaints under PIPEDA have been investigated by the Privacy Commissioner of Canada.

The Commissioner acts primarily as an ombudsman. Complaints are investigated. Findings are issued. Organizations are encouraged to comply. And they can be named and shamed. And if things don't get resolved, the matter may end up in Federal Court, where orders can be issued and damages can be awarded.

Bill C-27 from 2002 would have given the Privacy Commissioner the power to investigate complaints and recommend orders and penalties. Those orders and penalties had to be levied by a proposed newly created, separate body called the Personal Information and Data Protection Tribunal.

Bill C-36 replaces the current PIPEDA model entirely by sidelining the current Commissioner.

Instead, oversight would be handled through the Digital Safety and Data Protection Commission of Canada, a new institution that originated in the government's online harms framework. (I covered that in my last episode.) The existing Privacy Commissioner would no longer be the regulator under the statute. Instead, there would be a new Privacy and Consumer Data Commissioner operating within this new commission structure.

This is a big shift.

For nearly twenty-five years, Canadian privacy regulation has been centred on an independent officer of Parliament.

Now, enforcement would be embedded within a broader administrative commission.

Whether that's a good thing or a bad thing will likely become one of the major debates surrounding the bill. The new Commissioner will be less independent and more beholden to the government. At this point, I’m not convinced that it’s a good idea – but I look forward to a lot of discussion about it over the summer.

A New Structure for the Law

Bill C-36 looks very different from PIPEDA. 

PIPEDA has always been a bit unusual. Rather than spelling out all of the rules directly in legislation, it incorporated the Canadian Standards Association Model Code for the Protection of Personal Information.

The law largely worked by saying: follow the Code, subject to these exceptions. Bill C-36 takes a different approach.

Much like the privacy statutes in Alberta and British Columbia, the principles are expressed directly in legislative language. For privacy professionals who work with Canadian federal and provincial laws, this means the substance will often feel familiar.

And because the essence of the principles are embedded directly in statute using traditional statutory language, I expect its interpretation will become more rigid and more legalistic than the current PIPEDA framework.

Expanded Scope?

The government seems to be expanding the scope of the private sector privacy law. One new provision, compared to PIPEDA, is particularly notable. PIPEDA applies to personal information collected, used or disclosed in the course of commercial activities, as well as federally regulated workplaces.

That basic framework remains. Bill C-36 will apply to personal information collected, used or disclosed in the course of commercial activities, as well as federally regulated workplaces.

But Bill C-36 includes a provision that specifically says that the legislation applies to personal information collected, used or disclosed interprovincially or internationally.

For greater certainty

(2) For greater certainty, this Act applies in respect of personal information

(a) that is collected, used or disclosed interprovincially or internationally by an organization; or

(b) that is collected, used or disclosed by an organization within a province, to the extent that the organization is not exempt from the application of this Act under an order made under paragraph 139(2)‍(b).

It’s not limited to data that crosses borders in connection with any commercial activity. Does that mean it applies to data that a Nova Scotia-based non-profit stores in Ontario? Or what about an Alberta company that is subject to Alberta privacy law, which collects information from a British Columbian resident, which is protected by that province’s privacy law. Does the federal law apply once the data crosses the Rocky Mountains?

I think this was probably put here to expand our European GDPR adequacy, so that the new law will explicitly apply to all data transferred from Europe to Canada for processing. But I suspect lawyers and regulators will spend a fair amount of time debating exactly how far this provision reaches.

Bill C-36 explicitly addresses Anonymous vs. De-Identified Data

Another major feature of the bill is its treatment of anonymous and de-identified information.

To date, Canadian privacy law has not directly addressed this concept.

Bill C-36 formally distinguishes among personal information, de-identified personal information and anonymized information.

anonymize means to irreversibly and permanently modify personal information to ensure that there is no reasonably foreseeable risk in the circumstances that an individual can be identified from the information, whether directly or indirectly, by any means.‍ (anonymiser)

For greater certainty

6(5) For greater certainty, this Act does not apply in respect of anonymized information.

de-identify means to modify personal information so that an individual cannot be directly identified from it, although a risk of the individual being identified remains.‍ (dépersonnaliser)

Anonymous information is information that has been irreversibly and permanently modified so there is no reasonably foreseeable risk that an individual can be identified. Anonymous information falls outside the legislation altogether.

De-identified information is different.

The information has been modified so an individual cannot be directly identified, but some risk of re-identification remains. That information continues to be regulated under the Act.

This distinction is important because organizations increasingly rely on de-identification techniques for analytics, research and product development.

The bill provides a much more detailed framework than PIPEDA currently does.

Under Bill C-36, Privacy Management Programs Become Mandatory

Essentially, Principle 1 of PIPEDA required all regulated organizations to have a privacy management program. Bill C-36 makes that expectation explicit.

Organizations must establish and maintain a documented privacy management program. They must also provide supporting documentation to the regulator upon request.

In practical terms, this means:

• policies;
• procedures;
• training materials;
• risk management documentation; and
• governance records

All of these become much more important.

For organizations that have treated privacy compliance as an informal exercise, that approach will no longer be sufficient. And very importantly, every organization has to provide a copy of their privacy management program to the regulator upon request. 

Consent Gets More Detailed

The bill retains consent as the principal basis under which personal information can be collected, used or disclosed.

But the Bill significantly expands what organizations must communicate to the individual in order for consent to be valid.

Organizations will need to explain:

(a) the purposes for the collection, use or disclosure of the personal information;

(b) the manner in which the personal information is to be collected, used or disclosed;

(c) any reasonably foreseeable consequences of the collection, use or disclosure of the personal information;

(d) the specific type of personal information that is to be collected, used or disclosed; and

(e) the names of any third parties or types of third parties to which the organization may disclose the personal information.

And these explanations must be provided in plain language.

That’s a lot of information. Imagine trying to convey that at a retail point of sale. Under PIPEDA, conveying the purposes of the collection was done outside of a privacy policy or privacy statement, but this is the sort of information that should be put in a privacy statement. And this is all while folks are saying that privacy policies are too long and unreadable. I think it should be sufficient to communicate the purposes, clearly and understandably, and leave the rest for the privacy policy if the individual has any questions. 

Legitimate Interests and Business Activities

When it comes to consent, one hand giveth and the other taketh away. 

One of the most controversial features of Bill C-27 from 2022 was the introduction of new exceptions to consent. Those provisions largely survive under the proposed Protecting Privacy and Consumer Data Act.

Under Bill C-36, organizations can collect and use personal information without consent for certain business activities where a reasonable person would expect it, for security purposes, for safety purposes and for other prescribed activities.

Business activities

18 (1) An organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for the purpose of a business activity described in subsection (2) and

(a) a reasonable person would expect the collection or use for such an activity; and

(b) the personal information is not collected or used for the purpose of influencing the individual’s behaviour or decisions.

List of activities

(2) Subject to the regulations, the following activities are business activities for the purposes of subsection (1):

(a) an activity that is necessary to provide a product or service that the individual has requested from the organization;

(b) an activity that is necessary for the security of the organization’s information, systems or networks;

(c) an activity that is necessary for the safety of a product or service that the organization provides; and

(d) any other prescribed activity.

However, there is an important limitation.

These exceptions cannot be used where the information is being collected or used to influence an individual's behaviour or decisions.

The bill also includes a legitimate interest exception, which is similar to what is found in Europe’s General Data Protection Regulation.

To rely on it, an organization must carry out a privacy impact assessment to:

1. identify possible adverse effects on individuals;
2. take measures to mitigate those effects; and
3. determine that its legitimate interest outweighs those adverse effects.

This sounds straightforward.

In practice, it may generate substantial debate.

What is influencing an individual’s behaviour or decisions? Does that include search rankings? What video to suggest next? An advertisement?

How do you measure adverse effects?

What counts as sufficient mitigation?

And how should competing interests be balanced?

Those questions are likely to become important very quickly. 

Notably, consent can still be implied if it’s appropriate taking into account the reasonable expectations of the individual and the sensitivity. But then section 15(6) says you can’t use implied consent for any activity listed in 18(2) or 18(3). 

Form of consent

(5)  Consent must be expressly obtained unless, subject to subsection (6), it is appropriate to rely on an individual’s implied consent, taking into account the reasonable expectations of the individual and the sensitivity of the personal information that is to be collected, used or disclosed.

Business activities

(6)  It is not appropriate to rely on an individual’s implied consent if their personal information is collected or used for an activity described in subsection 18(2) or if it is collected, used or disclosed for an activity described in subsection 18(3).

That includes “an activity that is necessary to provide a product or service that the individual has requested from the organization.” Those are exactly the sorts of activities where you should be able to rely on implied consent. The wording of the statute suggests that this is excluded from possible “implied consent”. 

For example, I tap my credit card to pay for a burger. My consent to processing that transaction should be implied without the cashier reciting everything listed in section 15 (like the reasonably foreseeable consequences of the collection, use or disclosure of my credit card number), but because it’s necessary for me to pay for my burger it can’t be implied.

That’s just dumb. That can’t be right. At a technical briefing on the bill, I asked officials with the Industry Department whether this was intentional or bad drafting and they couldn’t explain it. 

Bill C-36 includes a “Right to Disposal”

PIPEDA has long allowed individuals to withdraw consent in many circumstances.

Bill C-36 goes further or is at least more explicit. Under PIPEDA, an individual can withdraw consent. Since the organization can only retain personal information for as long as is reasonably necessary for the purposes for which consent was obtained, it was pretty clear – but implied – that the data should be deleted.

Under Bill C-36, individuals can explicitly require organizations to dispose of their personal information.

Importantly, disposal includes both deletion and anonymization.

This resembles the growing international trend toward stronger deletion rights, although it stops short of adopting a full European-style "right to be forgotten."

The Industry Minister, when speaking about this Bill, suggested this will allow people to have deepfakes deleted. I’m not sure that’s the case across the board. 

Cross-Border Transfers and Privacy Impact Assessments

Another area of note is the treatment of international transfers.

Before personal information is disclosed or transferred outside Canada, organizations would be required to conduct a privacy impact assessment in a prescribed format.

This is noteworthy.

For years, Canadian law has generally allowed cross-border transfers provided appropriate safeguards are in place. The same rules applied to domestic transfers, as well as international ones.

Bill C-36 moves toward a more structured assessment model. Exactly what those assessments must contain will depend on future regulations, and notably these assessments must be provided to the Commission on request. 

Enforcement Gets Serious

And now we come to what many people will consider the headline story.

Enforcement. Lots of enforcement.

Under the bill, investigations may begin following a complaint or on the initiative of the Privacy and Consumer Data Commissioner.

During an investigation, the Commissioner can compel records and testimony, receive any evidence regardless of whether it complies with the traditional rules of evidence, and enter and search any premises other than a dwelling. 

Following an investigation, the Commissioner may issue a notice of contravention. That notice can include proposed orders and proposed penalties.

If the organization does not challenge the notice, the contravention is deemed admitted and the proposed order and proposed penalties take effect.

If the organization disputes the notice, the matter goes before the Commission, which functions as a tribunal and can confirm, vary or cancel the findings. It will have to establish its rules of procedure, but notably is not bound by any legal or technical rules of evidence but the usual principles of fairness and natural justice apply.

Appeals can be made to the Federal Court.

This is a dramatically different model from the current PIPEDA process.

The Penalties

But a lot of focus will be on penalties. And yes, the penalties can be enormous.

Administrative monetary penalties can reach the greater of:

• $10 million; or
• 3% of global gross revenue.

For more serious offences prosecuted under the Act, penalties become even larger.

An indictable offence can result in fines up to the greater of:

• $25 million; or
• 5% of global gross revenue.

There is also directors and officers liability, regardless of whether the organization itself is hit with a penalty. For large multinational organizations, these are numbers that will attract immediate attention from boards of directors and senior executives.

The Private Right of Action

Bill C-36 will create a private right of action for individuals affected by a contravention of the Act. This is extremely broad and potentially problematic. Currently, under PIPEDA, a person who complains to the Privacy Commissioner can then go to the Federal Court at the conclusion of the Commissioner’s investigation to seek damages. It is a de novo process, which means that the complainant has to satisfy the Federal Court that the organization violated the law, that this violation harmed them and they are entitled to damages. PIPEDA does not create any sort of broader scheme beyond the individual complainant. 

Under Bill C-36, it says that any individual who is affected by a contravention of the act has “a cause of action against the organization for damages for loss or injury that the individual has suffered as a result of the contravention.” That tells me that this goes waaaay beyond the complainant having a right to sue the organization, by anyone affected by it. 

Presumably you’d have to prove to the court that you’re “affected” by the contravention. The bill does not say whether liability is assumed or even deemed. Does a final notice of contravention just result in a blank cheque for anyone who can claim to be affected? 

And section 132(5) says that an action can be brought in the Federal Court or any provincial superior court. That’s a recipe for overwhelming our courts. 

Let’s use a recent privacy commissioner report of findings as an example of what could happen. In 2022, the federal commissioner along with his counterparts in BC, Alberta and Quebec, issued a report of findings that the Tim Horton’s coffee and donut chain violated the relevant privacy laws in the way that the company’s mobile app collected location information. The report found the App had over 8.6 million Canadian downloads, and as of July 2020, there were 1,602,343 active App Users. 

If that were to happen after Bill C-36 comes into effect and the Commissioner found a “contravention”, it sounds like 1.6 million people would each be able to sue Tim Hortons in their local court. Not that that many people would do so, but even a small portion of them doing so would overwhelm our legal system. And in the case of the Tim Hortons app, the regulators found that the company didn’t even use the location information. So you could have a huge number of legal claims, where it really was a “no harm, no foul” situation. I do note that there were a few class actions filed over the Tim Hortons app location tracking, which resulted in a settlement worth about 16 million dollars paid in Tim Hortons gift cards. 

In my view, if they’re going to create a private right of action, they should all be heard in the Federal Court of Canada and there should be a clear process to prevent a multiplicity of proceedings. 

The provincial superior courts are already overwhelmed. That’s where serious criminal trials take place, and already charges are being thrown out because of delays in getting to trial. I think it’s irresponsible to send an enormous number of claims into those courts, at the provinces’ expense and at the risk to the overall administration of justice. If the federal government is going to create a rush to the courthouses, it should be in the court that the federal government pays for.

What’s missing

I can’t help but notice something missing from the new Protecting Privacy and Consumer Data Act. 

While the government’s agenda is so clearly in favour of the adoption of artificial intelligence across Canada, there’s nothing in the bill that expressly permits or authorizes the collection of publicly available personal information from the internet for training AI models. Given the government’s artificial intelligence agenda, I am surprised that it is not there. 

But like so many recent bills, a huge amount is left to the regulations.

Conclusion

So, in conclusion, where does this leave us?

Bill C-36 is not a minor update to PIPEDA. It is a wholesale replacement of Canada's federal private-sector privacy framework. 

It introduces stronger enforcement. It creates significant penalties. It formalizes privacy management programs.

It expands rights relating to disposal of personal information.

And perhaps most significantly, it replaces the traditional Privacy Commissioner model with an entirely new regulatory structure.

I’m still thinking this through, and I’m sure I’ll have more to say about this new Digital Safety and Data Protection Commission of Canada, which is taking on the full “online harms” regulation from Bill C-34’s “Safe Social Media Act”, and now privacy under this new Bill C-36. A specialized tribunal makes some sense, but the Data Protection Commissioner should not be a member of the tribunal hearing review of his own investigations. In any event, it still puts the judge, jury, prosecutor and executioner in too cozy a relationship. The statute should clearly build in the guardrails and the firewalls to keep the investigation function detached from the Commission as a tribunal.

Anyways, I’m still thinking this through and will certainly have thoughts to come. In the meantime, both Professor Geist and Professor Scassa, who think deeply about these issues, have some preliminary thoughts online on their blogs and substacks. You should check them out. 

So the bill has only just been introduced and Parliament rose shortly afterward for the summer break. We don't yet know whether the government will fast-track it, whether it will undergo substantial amendments, or whether it will suffer the same fate as Bills C-11 and C-27. I expect that in terms of government priority, Online Harms will be higher up the list than privacy law reform. 

But one thing is certain.

If enacted, Bill C-36 would represent the most significant change to Canadian private-sector privacy law since PIPEDA itself came into force.

  

PIPEDA Replacement Tabled in House of Commons

The proposed new privacy law includes order-making powers, penalties but completely sidelines the existing Privacy Commissioner

On June 15, 2026, the Minister of Artificial Intelligence and Digital Innovation Even Solomon tabled in the House of Commons Bill C-36, called “An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts”. This is the long-awaited privacy bill that is slated to replace the Personal Information Protection and Electronic Documents Act (PIPEDA), which has regulated the collection, use and disclosure of personal information in the course of commercial activity in Canada since 2001.

The bill is similar to Bill C-27, called the “Digital Charter Implementation Act, 2022” and its predecessor, Bill C-11, which was tabled in 2019 as the “Digital Charter Implementation Act, 2019”. Both of them languished in Parliament until the federal government called the last election.

Unlike its predecessors, and PIPEDA before it, the new law does not involve the existing Privacy Commissioner of Canada. Oversight of the new law will be in the hands of the Digital Safety and Data Protection Commission of Canada, first introduced as part of the “Online Harms” bill, Bill C-34. And unlike Bill C-27, it does not incorporate comprehensive regulation of artificial intelligence.

The Bill creates a new Protecting Privacy and Consumer Data Act (PPCDA), which effectively replaces Part 1 of PIPEDA.

The PPCDA is in a completely different structure than PIPEDA. PIPEDA included a schedule taken from the Canadian Standards Association Model Code for the Protection of Personal Information and generally required regulated organizations to follow the Code. Similar to the Personal Information Protection Acts of British Columbia and Alberta, the substance of the Code has largely been translated to statutory language in the Bill itself.

The most significant difference is what many privacy advocates have been calling for: order-making powers and significant penalties. The Bill also creates a new bureaucracy called the Digital Safety and Data Protection Commission of Canada (the Commission). The existing role of the Privacy Commissioner of Canada will be taken over by a new Privacy and Consumer Data Commissioner, who is a member of the Commission.  

PIPEDA applies to the collection, use and disclosure of personal information in the course of commercial activity and to federally-regulated workplaces. That will not change in the PPCDA, but a new section 6(2) says that the new Act specifically applies to personal information that is collected, used or disclosed interprovincially or internationally. This provision is not expressly limited to commercial activity, so there’s an argument that could be made that it would apply to non-commercial or employee personal information that crosses borders.

The PPCDA has an interesting approach to anonymous and de-identified data. It officially creates these two categories. It defines anonymize as:

“to irreversibly and permanently modify personal information to ensure that there is no reasonably foreseeable risk in the circumstances that an individual can be identified from the information, whether directly or indirectly, by any means.‍”

 Anonymous information is carved out of the PPCDA’s purview. But de-identified data remains in-scope. To de-identify data means “modify personal information so that an individual cannot be directly identified from it, although a risk of the individual being identified remains.”

In a number of areas, the PPCDA provides more detail about what is required to comply with general principles that are already in PIPEDA. For example, every regulated organization must have a documented privacy management program, and all the supporting documentation for an organization’s privacy management program must be provided to the Privacy and Consumer Data Commissioner on request.

With respect to consent, organizations expressly have to record and document the purposes for which any personal information is collected, used or disclosed. This was implied in the CSA Model Code, but is now expressly spelled out in the Act. The PPCDA lays out in detail what is required for consent to be valid. It requires not only identifying the purposes but also communicating in plain language how information will be collected, the reasonably foreseeable consequences of is use, what types of information and to whom the information may be disclosed. The “purpose limitation” is scaled back further, from limiting the use of personal information to the identified purposes, but under the PPCDA an organization cannot “require an individual to consent to the collection, use or disclosure of their personal information beyond what is necessary to provide the product or service.”

One significant change compared to is the circumstances under which an organization can collect and use personal information without consent. Section 18 of the PPCDA allows collection and use without consent for certain business activities, where it would reasonably be expected to provide the service, for security purposes, for safety or other prescribed activities. Notably, this exception cannot be used where the personal information is to be collected or used to influence the individual’s behaviour or decisions. There is also a “legitimate interest” exception, which requires an organization to document any possible adverse effects on the individual, mitigate them and finally weigh whether the legitimate interest outweighs any adverse effects. It’s unclear how “adverse effects” would be measured.

Like PIPEDA, an individual can withdraw consent subject to similar limitations that were in PIPEDA. But what’s changed is that an individual can require that their information be disposed of. Notably, disposal includes deletion and rendering it anonymous.

At a time when “digital sovereignty” is a common buzzword, the new Act will require privacy impact assessments (in a to be prescribed format) prior to disclosing or transferring data outside of Canada.

The most notable changes are with respect to oversight and enforcement. The Privacy and Consumer Data Commissioner is not an ombudsman with a focus on nudging companies to compliance and solving problems for individuals. The new Bill veers strongly towards enforcement.

As with PIPEDA, enforcement starts with a complaint by an individual or the Privacy and Consumer Data Commissioner can initiate it on their own accord. After the investigation, the Privacy and Consumer Data Commissioner can issue a notice of contravention, which can include proposed penalties or proposed orders. If the organization does not contest the notice of contravention, they are deemed to have contravened the Act and the proposed penalties and orders, if any, come into effect.

An organization can dispute a notice of contravention before the new Commission, which is the tribunal for the Act. If a notice of contravention is disputed, the Commission is responsible for conducting hearings to review the Privacy and Consumer Data Commissioner’s findings. It has the authority to confirm, cancel, or vary the Commissioner's notice of contravention. It can also issue interim orders in exigent circumstances.

Appeals from the Commission can be made to the Federal Court of Canada.

Possible penalties are huge. The maximum administrative monetary penalty that the tribunal can impose in one case is the higher of $10,000,000 and 3% of the organization’s gross global revenue in its financial year before the one in which the penalty is imposed. The Act also provides for quasi-criminal prosecutions, which can get even higher.

The Crown prosecutor can decide whether to proceed as an indictable offence with a fine not exceeding the higher of $25,000,000 and 5% of the organization’s gross global revenue or a summary offence with a fine not exceeding the higher of $20,000,000 and 4% of the organization’s gross global revenue. If it’s a prosecution, then the usual rules of criminal procedure and fairness apply, like the presumption of innocence and proof beyond a reasonable doubt.

The Bill was tabled immediately before Parliament rises for the summer break. When Parliament resumes in September, it’s impossible to predict whether the Bill will be fast-tracked or whether it will languish like its predecessors. It is also hard to predict whether the government will be amenable to suggested amendments at the Committee stage.

(This summary was originally written for the Canadian Technology Law Association's newsletter.)

"Online Harms" is back: An overview of Bill C-34 The Safe Social Media Act

 

The proposed new online safety law expands its scope to AI chatbots, introduces strict age limits, and places regulatory oversight under a single Commission.

On June 10, 2026 the Minister of Canadian Identity and Culture Marc Miller tabled Bill C-34 in Parliament, called the “Safe Social Media Act”. This legislation follows Bill C-63 (called the “Online Harms Act”). While the stated purpose of promoting online safety and protecting children remains the same, the new bill introduces highly prescriptive regulatory changes and broadens the scope of the digital services it targets.

The new bill significantly expands the scope of regulated entities beyond traditional platforms. While it continues to apply to “regulated social media services”, it introduces two entirely new categories: “regulated chatbot services” (conversational AI systems) and “regulated online services” (interactive websites or applications deemed to pose a significant risk to children).

The most significant difference is the bill’s aggressive stance on age restrictions and verification. Unlike its predecessor, Bill C-34 explicitly imposes a strict minimum age of 16 to register or hold an account with a regulated social media service. Operators are required to implement adequate age-verification or age-estimation measures to enforce this ban. Furthermore, any regulated service that provides access to pornographic content is mandated to implement age-verification measures (over 18). To try to placate privacy concerns, the legislation includes parameters requiring that any personal information collected for age verification be destroyed once the verification is complete. However, it is clear that all users of regulated social media services in Canada will have to have their ages verified as a condition of having an account.

With respect to artificial intelligence, the bill introduces targeted obligations. Operators of regulated social media services have a specific duty to label synthetic content”—defined as AI-generated or mechanically altered audio or visual data that could be mistaken for authentic content. Chatbot operators are subject to new behavioral guardrails, requiring them to implement measures that prevent the AI from posing as a human being, masquerading as a licensed professional (such as a medical or legal expert), or encouraging self-harm.

One of the most notable changes to content moderation is the 24-hour fast-track takedown rule. If an operator discovers or is flagged about content that sexually victimizes a child or constitutes “intimate content communicated without consent” (which explicitly includes deepfakes), they must make that content completely inaccessible to all persons in Canada within 24 hours. (There is a limited ability for users to dispute these takedowns.) Operators are also required to be transparent about their operations by submitting comprehensive “digital safety plans” to the Commission and making redacted versions publicly available on their services.

The regulatory bureaucracy proposed under Bill C-63 has been streamlined, compared to the previous bill but its powers are immense. The independent Digital Safety Ombudsperson and the Digital Safety Office have been removed, leaving a centralized, highly powerful Digital Safety Commission of Canada to oversee and enforce the Act. (The role of the Commission will be expanded under the new privacy law to become the Digital Safety and Data Protection Commission of Canada.)

User complaint mechanisms have also shifted to an “exhaustion of recourse” model. A person in Canada cannot lodge a formal complaint regarding harmful content directly with the Commission unless they have first used their best efforts to seek recourse from the operator using the platform’s internal tools and reconsideration processes.

Possible penalties under the new regime are massive. If an operator contravenes the Act, fails to follow compliance orders, or makes false statements to an inspector, the Commission can issue notices of violation and severe administrative monetary penalties. The maximum penalty can reach the higher of $20,000,000 or 5% of the operator’s gross global revenue in the preceding financial year. Gross global revenue calculations will legally encompass all corporate affiliates within a consolidated group.

How all of this will play out in practice remains to be seen, as a massive amount of the substance of its application is left to regulations made by the government, and rules to be made by the new Digital Safety Commission.

(This summary was originally written for the Canadian Technology Law Association's newsletter.)

Discussion with Rob Breakenridge: "Protecting kids or deputizing censors? The risks posed by social media ban"

My discussion with Senator Pamela Wallin: "Privacy in Peril? Social Media Bans & Citizen Surveillance with David Fraser"

My testimony on Bill C-22, the Lawful Access Act of 2026, to the House of Commons Standing Committee on Public Safety and National Security

(The full stream of the four hour meeting is here and the Notice of Meeting with the roster of witnesses is here. I was on the second panel in the second hour.)

Here is my opening statement: 

Mr. Chairman, honourable members. Thank you very much for your kind invitation to share my views on Bill C-22. I am a partner with the law firm McInnes Cooper in Halifax, where among other things, I advise clients who are on the receiving end of orders for customer information. I also teach at Dalhousie law school.

I am appearing in my personal capacity. These are my own views, and I am not speaking on behalf of any of my clients. 

I have to commend the government for its comprehensive consultation with stakeholders since Bill C-2, to which I contributed. 

I have a number of concerns and recommendations. I will note that Part 2 of Bill C-22 is VERY problematic. I can’t adequately cover all my concerns in five minutes, so I look forward to the rest of our discussion.

First, narrow the scope or raise the bar for subscriber information production orders.

The bill lowers the threshold for police to obtain a production order for subscriber information from "reasonable grounds to believe" to merely "reasonable grounds to suspect”. 

The new production orders can be directed at anyone who provides services to the public. This means police could demand records from doctors' offices, hotels, banks, and grocery stores.

Even though the definition was narrowed from previous bills, police can still demand "all the subscriber information" a service provider holds. This goes beyond a name and address and includes the "types of services provided" and all "device identifiers". This could force a medical clinic to provide info about a patient's CPAP machine, or compel Apple to hand over the digital IDs for every device a person owns, including AirTags and iPads.

Narrow the scope of these orders, or raise the bar to reasonable belief. Or it'll be found to violate the charter. 

Part 2 - the Supporting Authorized Access to Information Act (SAAIA) Generally

Nobody has made a persuasive argument that anything in Part 2 of Bill C-22 is really necessary. The Government has had 20+ years to build their case, but as NSICOP observed they only have anecdotes. We should not be undermining the privacy and safety of every single Canadian based on anecdotes. 

Part 2 of the bill targets "electronic service providers" (ESPs), but the definition is so broad it likely includes most businesses in Canada. 

If it proceeds, the Bill should include necessary guardrails: Under no circumstances should the government  be allowed to require an electronic service provider to  

(i) make changes to products or services that a business provides in the ordinary course, 

(ii) collect and retain any data beyond what the business requires for its own purposes, and 

(iii) make any changes that would affect the functionality (including ordering additional functionality) for any products or services offered by the business. 

As written, the Minister could issue a secret order to turn your Amazon Alexa into a listening device. CSIS has explicitly said they want to be able to track every single phone in Canada in real time, and telcos must make every cell phone trackable. That’s absurd. 

The Government says “we don’t plan to undermine encryption” and there are “no backdoors”. You just have to read the words in the Bill and there’s nothing to prevent that. Government officials said at this committee the Bill is “encryption neutral.” Canadians are not “encryption neutral”. 

The words of the bill clearly permit – and certainly do not prohibit – backdoors and mandatory decryption. In secret with no transparency to Canadians and little accountability. 

What the government “intends” is not relevant. What is relevant is what words end up in a statute. 

The Bill should expressly prohibit undermining or circumvention of encryption. 

Next, ministerial orders have to go 

Under Part 2, the Minister of Public Safety can issue orders to service providers that come with mandatory, permanent secrecy. 

Currently, the police and CSIS can apply to a judge for an “assistance order”, to order a service provider to provide all reasonable assistance to give effect to a warrant. This can be accompanied by a gag order if appropriate. This is judicial control. Nobody from law enforcement has offered evidence that assistance orders are inadequate and should be replaced by secret Ministerial Orders. 

The UK equivalent of a Ministerial Order was used by the UK government to secretly order Apple to remove encryption on iCloud globally. Part 2 of Bill C-22 does not contain any guardrails that would prevent that overreach. 

Secret ministerial orders have to go.

Massive Cybersecurity Risks from "Backdoors"

As legions of cybersecurity experts have said, forcing companies to build surveillance capabilities into their networks creates inherent vulnerabilities. Use your favourite search engine to look up “Salt Typhoon” or “Vodafone Greece scandal” to see examples of lawful access capabilities being exploited for widespread illicit wiretapping. 

This makes Canadian infrastructure a massive target for cybercriminals.

Metadata Retention 

The Bill permits the government to require ESPs to retain metadata, which includes your location history. The government will require everyone’s cellphone to become a retrospective tracking device without any suspicion of wrongdoing. This will almost certainly be found to violate the Charter. 

Collected metadata will be sought by Canadian and non-Canadian authorities based on mere suspicion. That’s a record of everyone who sought reproductive health care in Canada, which might be of interest to law enforcement from a Five Eyes partner. 

Part 2’s authorities to access data

The government says that Part 2 does not create any new authorities to access data. That’s simply not true. Take a look at section 20. Persons designated by the Minister can enter any premises without a warrant and without notice, and can examine, copy and remove any information found in that place. They can order anyone in that place to provide any data they ask for. That’s a new authority, and if the premises are an ESP’s offices, that includes access to information about their customers. There are simply no guardrails. 

I look forward to a productive discussion. 

The government's misleading and incomplete Charter Statement for Bill C-22, the Lawful Access Act

[Note: I have 55 exams to mark, so the video and podcast versions of this will unfortunately have to wait.]

Finally, the federal government has released the so-called “Charter Statement” for Bill C-22, the Lawful Access Act of 2026. Forty three days after the bill was tabled in Parliament. I don’t know why it took so long, since they just took the Charter Statement for Bill C-2 and did some editing.

In the Charter Statement, the Minister of Justice significantly mischaracterizes his own bill in a manner that makes it appear more Charter-compliant. Given how the government has spoken about this bill, I’m NOT going to say these are honest mistakes. And the Charter Statement doesn’t even address one of the MOST problematic elements of the revised bill: mandatory metadata retention. 

As it is, I do not think that Bill C-22 is Charter compliant, but with some changes, I think that it can be made Charter-compliant. 

Some background on what Charter Statements are about can be found in the Charter Statement itself:

Section 4.2 of the Department of Justice Act requires the Minister of Justice to prepare a Charter Statement for every government bill to help inform public and Parliamentary debate on government bills. One of the Minister of Justice’s most important responsibilities is to examine legislation for inconsistency with the Canadian Charter of Rights and Freedoms. By tabling a Charter Statement, the Minister is sharing some of the key considerations that informed the review of a bill for inconsistency with the Charter. A Statement identifies Charter rights and freedoms that may potentially be engaged by a bill and provides a brief explanation of the nature of any engagement, in light of the measures being proposed.

Essentially, this is a half-hearted attempt to say this is how the government thinks this can be called Charter compliant, rather than being an honest assessment of the Charter compliance of Bill C-22. If a student handed this to me as an assessment of the Bill, it would be a bad day for that student. 

So let’s dig into it.

It starts by saying “What follows is a non-exhaustive discussion of the ways in which Bill C-22 potentially engages the rights and freedoms guaranteed by the Charter.” As you’ll see, it’s far from “exhaustive.” That said, this essay will not be exhaustive since I’m only going to focus on the deficiencies in the Charter Statement. 

With respect to the Production Order for Subscriber Information, they simply misstate what the Bill actually says.  The Charter Statement says:

The following considerations support the consistency of the amendments with section 8. The subscriber information sought does not by itself constitute particularly sensitive information, since it is limited to information that identifies clients and services, and does not include the contents of communications. The judge would have discretion as to whether to issue an order, and if they choose to issue an order, the judge would have discretion as to what information is specified in it. [emphasis added]

This last part is not true. It is simply false. The way the Bill is currently written, the judge has NO discretion. Here’s what it says in the proposed new section 487.0142 of the Criminal Code:

487.‍0142 (1) On ex parte application made by a peace officer or public officer, a justice or judge may order a person who provides services to the public to prepare and produce a document containing all the subscriber information that relates to any information, including transmission data, that is specified in the order and that is in their possession or control when they receive the order.

It says “all the subscriber information”. The words “that is specified in the order” refers to the “that relates to any information, including transmission data” part. The judge has no discretion to order the production of a subset of Subscriber Information. It is all or nothing. And what is “all” is also a problem. 

The Charter Statement also says:

The subscriber information sought does not by itself constitute particularly sensitive information, since it is limited to information that identifies clients and services, and does not include the contents of communications.

Subscriber information is actually more than that, and can be much more sensitive than they suggest.

subscriber information, in relation to any client of a person who provides services to the public or any subscriber to the services of such a person, means

(a) information that may be used to identify the subscriber or client, including their name, pseudonym, address, telephone number and email address;

(b) identifiers assigned to the subscriber or client by the person, including account numbers; and

(c) information relating to the services provided to the subscriber or client, including

(i) the types of services provided,

(ii) the period during which the services were provided, and

(iii) information that identifies the devices, equipment or things used by the subscriber or client in relation to the services.

(a) and (b) in the definition mostly do that, but paragraph (c) goes much further than that. It refers to the “types of services provided” and “devices, equipment or things” used by the customer. Remember, this order can be directed to anyone who provides services to the public, which can be a medical clinic. What sort of services you get from a medical clinic is certainly sensitive information in which there is a very high privacy interest. Those devices can include things like pace-makers, CPAP machines and insulin pumps. Again, a very high privacy interest. 

If your internet service provider is also your cable company and your cellphone provider, asking for subscriber information based on an IP address can result in information about your cable packages, your cell number, your cell’s IMEI and IMSI numbers, and the serial number of your cable modem. That is way more information than is necessary to simply connect an IP address to a person.

But of course, the government shrugs that off.

Next up is the provision regarding “publicly available information.” This provision says:

(4) For greater certainty, no production order or warrant, or confirmation of service demand made under section 487.‍0121, is necessary for a peace officer or public officer to receive, obtain and act on any information that is available to the public.

The Charter statement says “Where information is available to the public, a person will usually have no reasonable expectation of privacy in it.” I think that’s generally right. But notice the use of the words “usually”. Some critics of Bill C-2 and now Bill C-22 are concerned that this appears to authorize the cops to use information that was hacked by a third party and leaked on the internet. These hacks and leaks take place all the time. I am also concerned about the police buying location data from companies in the advertising ecosystem. That’s “available to the public”, but I’d argue that the individuals retain a significant privacy interest in that data when it’s associated with them. 

The Citizenlab recently reported that US law enforcement, like ICE and the Department of Homeland Security, have been buying this location information for use in their surveillance operations. 

I’m not sure that would survive Charter scrutiny in Canada. 

Let’s move onto Part 2, which will create the “Supporting Authorized Access to Information Act.” I have said, in general terms, that Part 1 is about new ‘authorities’ to obtain information and Part 2 is generally about new mandatory ‘capabilities’ to obtain information. That’s true in general terms, but Part 2 actually does create new authorities. 

At the beginning of the Charter Statement, it largely says “all good" …

The provisions would not grant any new authorities to lawfully access information and data or expand or derogate from any existing authorities for such access.

Now, that’s not entirely true. Part 2 does create two new authorities for accessing data. While they seem intended to allow access to information about “electronic service providers”, the guardrails are lacking. 

First of all, we have section 14 which requires electronic service providers to allow the Minister’s designates to assess and test any device, equipment or other thing that may enable an authorized person to access information.

Obligation to assist

14 (1) On request made by the Minister, an electronic service provider must provide all reasonable assistance to a person or class of persons specified in the request to permit the assessment or testing of any device, equipment or other thing that may enable an authorized person to access information.

…

For greater certainty

(4) For greater certainty, the assessment or testing must not have the effect of granting access to personal information.

They’ve sensibly added a bit of a guardrail in subsection (4) that says they can’t use this authority to get access to personal information. That is a new authority to obtain information. 

More troubling is section 20, which creates a search authority on the part of the Minister’s designates to enter any premises other than a dwelling, without a warrant and without notice. They don’t even need to suspect any sort of infraction. It just has to be related to an activity regulated by the Act. Once they’re in, they can examine anything, make copies of it, remove documents, use computers found there, and more:

Authority to enter place
20 (1) Subject to subsection 21(1), a designated person may, for the purpose of verifying compliance or preventing non-compliance with this Act, at any reasonable time enter any place if they have reasonable grounds to believe that anything relevant to that purpose, including any document or electronic data, is located in that place or that an activity regulated by this Act is conducted in that place.
…
Powers on entry
(3) The designated person may, for a purpose referred to in subsection (1),

(a) examine anything found in the place, including any document or electronic data;

(b) make copies of any document or electronic data that is found in the place or take extracts from the document or electronic data;

(c) remove any document found in the place for examination or copying;

(d) use or cause to be used any computer or data processing system at the place to examine or copy electronic data; and

(e) use or cause to be used any copying equipment at the place to make copies of any document. 

 

The Charter Statement says not to worry about it. First they say “Privacy interests are diminished in the regulatory and administrative contexts.” That’s largely correct. Then it says:

“Further, information gathered in this context would generally relate to technical capabilities of ESPs, which would not attract a heightened privacy interest. In addition, the powers would not be available for the purpose of advancing a criminal investigation.” [emphasis added]

The word “generally” is doing a lot of work there. It then says: “The proposed powers are similar to regulatory inspection powers that have been upheld in other contexts.”

Yes, it is true that warrantless inspection powers have been upheld in other regulatory contexts. However, this is unlike other regulatory contexts. For example, inspectors from the Department of Fisheries can – without a warrant – enter a fish plant or a fishing boat, and review all the records of the company’s activities. They can go in and count the halibut.

This context is qualitatively different from that. By definition, an electronic service provider is the custodian of very sensitive information of its customers and all of those customers, whether they're good guys or bad guys – and the majority will be good guys – have a Charter protected right to be free from unreasonable search and seizure. The records of your internet service provider are very different from the records of a fish plant, and the government has not included any guardrails. 

The most problematic part of this Charter Statement is what is not said. Perhaps the most problematic part of Bill C-22 – mandatory metadata retention – is not even mentioned. Just because it is one subsection among many is not an excuse.

Core providers — obligations

(2) The Governor in Council may make regulations respecting the obligations of core providers, including regulations respecting ...

(d) the retention of categories of metadata — including transmission data, as defined in section 487.‍011 of the Criminal Code — for reasonable periods of time not exceeding one year.

The loudest and most credible commentators on Bill C-22 have pointed to this and have said it will likely violate the Charter. (Michael Geist: The Lawful Access Privacy Risks: Unpacking Bill C-22’s Expansive Metadata Retention Requirements and Robert Diab: Is the Power to Preserve Everyone’s Metadata Constitutional?)

In the European Union, the Court of Justice struck down the EU Data Retention Directive in 2014 because the general and indiscriminate retention of all users’ telecommunications metadata was a disproportionate interference with the fundamental right to privacy. The Courts there have held that specific metadata retention associated with specific threats or targets can be justified, but blanket metadata retention cannot. It is simply incompatible with EU fundamental rights. 

Currently in Canada, in some circumstances, the police can simply order the retention of information or can get a court order requiring it to be done. Mandatory, blanket metadata retention is wildly problematic and the Charter Statement doesn’t even mention it. 

Finally, we have the blanket confidentiality that makes it an offence for anyone to disclose the contents of a ministerial order, the facts that it exists, what information the Minister used to make the order, any communications between the Minister and the electronic service provider and any “prescribed information”, meaning information that is prescribed in the regulations. 

Prohibition on disclosure

15 An electronic service provider and any person acting on its behalf must not disclose any of the following information except as permitted under this Act or the Canada Evidence Act:

(a) information contained in an order made under subsection 6(1) [temporary exception for a core provider] or 7(1) [ministerial order];

(b) information on which the Minister relied in making the order;

(c) the fact that the electronic service provider is subject to the order;

(d) information provided in the course of representations made under section 8 or in any response given by the Minister and the fact that the Minister has invited the representations;

(e) information contained in an application referred to in subsection 6(1) or in a decision made under subsection 6(4);

(f) information submitted under subsection 11(2) and any information received from the Minister in response;

(g) any prescribed information.

I have previously shared my view that this is over the top and the Minister should have to justify any confidentiality orders on a case-by-case basis. 

The Charter Statement says:

To achieve this objective, the provisions would place limits on communication about the technical capabilities of ESPs, which are commercial entities. While restrictions on commercial speech can engage the right to freedom of expression, they usually do not implicate the core values of the right. These include the search for political, artistic and scientific truth, the protection of individual autonomy and self-development, and the promotion of public participation in the democratic process. Rather, the restrictions would be narrowly focused on the existence and contents of orders and exemptions, all linked to the objective of protecting sensitive information. Limits on expression that do not engage the core values of the right are more easily justified. [emphasis added]

That may be generally true, but public discussion about massive surveillance of Canadians and potential government overreach and abuse is actually very, very close to the core of “Charter values” – it’s about the protection of individual autonomy and public participation in the democratic process. They’re missing the mark here, widely. 

And then there’s the cumulative effect of all of this. The government can require an ESP to retain a  year of metadata, which can include the minute-by-minute location of every phone in Canada. And then they can send in inspectors to say “hey, we’re here to inspect your metadata databases.” And by the way we’re making a copy for easier inspection back at the office. That amounts to a HUGE invasion of privacy.

The Charter Statement, not surprisingly says: “it’s fine.” 

It’s not fine.