The Government of Canada is taking action to protect Canadians' privacy, protect children and protect Canadians' personal information-while giving businesses clearer rules to innovate responsibly and build trust in the digital economy.
Canada's current private-sector privacy law is more than 25 years old. It was written before artificial intelligence (AI) at scale, before deepfakes, before algorithmic decision making and before children's data became so widely collected online. The digital world has changed. Canada's privacy law needs to change with it.
Today, the Honourable Evan Solomon, Minister of Artificial Intelligence and Digital Innovation and Minister responsible for the Federal Economic Development Agency for Southern Ontario, announced the tabling of Bill C-36, the Protecting Privacy and Consumer Data Act (PPCDA), to modernize Canada's private-sector privacy law for the digital age.
This proposed legislation is a cornerstone of the recently launched Canada's National Artificial Intelligence Strategy: AI for All. Canadians will not adopt digital services or AI with confidence unless they know their privacy is protected, their children's information is treated responsibly and companies are accountable for how they collect, use and share data.
The PPCDA will implement new requirements to:
- recognize privacy as a fundamental right of all Canadians
- set higher standards for organizations when they manage children's information
- require meaningful consent for the use of personal information and plain-language explanations for how personal information is handled
- ensure that organizations are transparent about their use of automated decision making for significant decisions about individuals
- provide Canadians with the right to request deletion of their personal information to better protect their privacy and reputation
- ensure that personal information is used responsibly, transparently and for appropriate purposes, and prevent unfair or inappropriate uses such as surveillance pricing
- support data mobility, so Canadians can move their personal information securely between organizations where a framework applies
- enhance Canada's digital sovereignty by requiring robust privacy safeguards and risk assessments before personal information is transferred outside Canada
- establish strong enforcement mechanisms, including significant penalties for non-compliance
The PPCDA will be administered by the new arm's-length Digital Safety and Data Protection Commission of Canada, ensuring appropriate regulatory oversight and effective enforcement. The Commission will also have responsibility for the recently announced Digital Safety Act. This dual mandate will support greater coherence and consistency in regulating digital and data-driven technologies, including for complex and cross-cutting issues like age assurance and protecting children's safety online.
The Commission will have the ability to issue binding orders to make sure organizations comply with the law, including meaningful consequences for non-compliant organizations, with penalties of up to $10 million or 3% of global revenue, whichever is greater, and fines of up to $25 million or 5% of global revenue, whichever is greater, for the most serious offences.
The PPCDA and the National AI Strategy together reinforce Canada's commitment to responsible innovation, economic growth and the protection of Canadians' rights in the digital age.
