Introduced on June 15, 2026, Bill C-36[1]<\/a> would enact the Protecting Privacy and Consumer Data Act<\/em><\/a> (“PPCDA<\/strong>“). PPCDA is the federal government’s latest attempt to modernize Canadian privacy law for today’s “data-driven economy.” It is the third major effort to reform the Personal Information Protection and Electronic Documents Act <\/em>(\u201cPIPEDA<\/strong>\u201d), following the unsuccessful Bill C-11 in 2020 and Bill C-27 in 2022. Unlike Bill C-27, which combined privacy reform with a comprehensive AI regulatory framework, Bill C-36 is primarily focused on modernizing Canada’s privacy laws. Several of its provisions, including those relating to automated decision systems, will have important implications for organizations deploying AI technologies.<\/p>\n\n\n\n Like its predecessors, Bill C-36 seeks to move beyond broad privacy principles and establish a more detailed framework governing how organizations collect, use, disclose, and manage personal information.<\/p>\n\n\n\n Bill C-36 was introduced as part of a broader federal push to regulate Canada\u2019s digital environment, alongside Bill C-34 and Bill C-22. Bill C-34 would enact the Safe Social Media Act<\/em>, establishing new safety requirements for social media services and AI chatbot services, and would create the Digital Safety Commission of Canada to administer the new framework. Bill C-22 (An Act respecting lawful access) would amend various statutes, including the Criminal Code and the Canadian Security Intelligence Service Act, to establish a modernized lawful access regime for electronic information. See our recent article for a broader view of Canada\u2019s new AI and data strategy<\/a>.<\/p>\n\n\n\n While the structural changes are significant, including the introduction of a new regulator, the Digital Safety and Data Protection Commission of Canada (the \u201cCommission<\/strong>\u201d), Bill C-36\u2019s real impact lies in a move toward a more formal, documented, and regulated model of privacy compliance.<\/p>\n\n\n\n Under PIPEDA, organizations have had the flexibility to interpret broad privacy principles and apply them through internal policies and judgement. Bill C-36 reduces this flexibility by imposing explicit statutory requirements around governance, documentation, and transparency.<\/p>\n\n\n\n In practice, compliance becomes more structured, prescribed, and visible. Organizations would need to comply with the rules and demonstrate through documentation how that compliance is achieved. This represents a meaningful change in expectations for organizations that have relied on PIPEDA\u2019s flexible approach.<\/p>\n\n\n\n Bill C-36 is specific about privacy governance. Organizations would be required to:<\/p>\n\n\n\n Bill C-36 also places clearer limits on how personal information can be used. Organizations will be required to provide clear plain language explanations in obtaining consent, and express consent will be the default unless implied consent is deemed appropriate in the particular circumstance.<\/p>\n\n\n\n While these concepts are not entirely new, Bill C-36 requires organizations to document how decisions are reached. Informal judgement alone may no longer be sufficient.<\/p>\n\n\n\n The same approach carries through the rest of the bill, which requires:<\/p>\n\n\n\n These requirements reinforce that documentation and process are now central to compliance.<\/p>\n\n\n\n Bill C-36 introduces several concepts that reflect the realities of the modern data environment and expands the regulatory framework to address evolving data practices and technologies.<\/p>\n\n\n\n Similar to Bill C-27, PPCDA distinguishes between anonymized and de-identified information. While anonymized information falls outside the scope of the legislation, de-identified information remains personal information which is subject to PPCDA and is accompanied by specific rules governing its use, including restrictions on re-identification.<\/p>\n\n\n\n Organizations using such systems would be subject to PPCDA’s transparency and access requirements, including an obligation, on request, to provide individuals with an explanation of automated decisions that have significant effects on them.<\/p>\n\n\n\n Children’s personal information is expressly recognized as particularly sensitive and deserving of enhanced protection.<\/p>\n\n\n\n Individuals would have the right to request deletion of personal information in certain circumstances, exercise access and correction rights, and request the transfer of their personal information to another organization, with data mobility requirements to be further prescribed by regulation.<\/p>\n\n\n\n Bill C-36 draws a clearer distinction between organizations that control personal information and service providers that process information on their behalf. PPCDA expressly defines a “service provider” and permits organizations to transfer personal information to service providers without obtaining additional consent from individuals. While organizations remain accountable for personal information transferred to service providers, service providers are expressly recognized as separate actors under the legislation and are subject to direct statutory obligations, including obligations relating to security safeguards and breach reporting.<\/p>\n\n\n\n Importantly, if a service provider collects, uses, or discloses transferred personal information for a purpose other than that for which the information was transferred, it becomes fully subject to the obligations imposed under PPCDA in respect of that information.<\/p>\n\n\n\n While consent remains the default, Bill C-36 recognizes that organizations may sometimes use personal information without consent. This reflects a shift towards a model that accommodates certain routine business activities without relying exclusively on consent.<\/p>\n\n\n\n The most important of these is the \u201clegitimate interest,\u201d exception. Organizations would be able to collect, use and disclose personal information without consent if their legitimate interest outweighs any reasonably foreseeable adverse effect on the individual.<\/p>\n\n\n\n This flexibility comes with conditions. Prior to using information without consent, organizations need to ensure that:<\/p>\n\n\n\n Critically, organizations relying on this exception would be expected to conduct a privacy impact assessment, identify and mitigate risks, document their analysis for relying on the exception, and include in their publicly available privacy policies a description of any activities undertaken in reliance on the legitimate interest exception.<\/p>\n\n\n\n In practice, decisions made in reliance on this exception would need to be carefully analyzed and documented.<\/p>\n\n\n\n Bill C-36 also creates further consent exceptions for specified business activities, as well as for matters such as fraud prevention, research, employment relationships, business transactions and emergencies.<\/p>\n\n\n\n The Commission will be responsible for administering and enforcing the PPCDA and the Digital Safety Act, with a designated Privacy and Consumer Data Commissioner appointed to lead enforcement. This represents a significant restructuring of Canada\u2019s privacy enforcement model, as responsibility for private-sector privacy oversight is removed from the Office of the Privacy Commissioner of Canada (the \u201cOPC<\/strong>\u201d) and transferred to the new Commission. The OPC would continue to exist but would shift its focus primarily to public-sector privacy.<\/p>\n\n\n\n This institutional redesign reflects Parliament\u2019s intention to integrate privacy enforcement with broader digital safety regulation under a single regulatory authority. It also marks a departure from Canada\u2019s traditional PIPEDA model, under which the OPC functioned as an independent agent of Parliament responsible for investigating private-sector privacy complaints and issuing non-binding findings.<\/p>\n\n\n\n The proposed enforcement provisions under PPCDA represent a material increase in businesses\u2019 liability exposure for non-compliance. The Commission will have the power to issue binding compliance orders and impose significant administrative monetary penalties:<\/p>\n\n\n\n PPCDA also introduces a private right of action, allowing individuals to seek damages directly in court for breaches of the Act. This is a material departure from PIPEDA, under which individuals could not sue organizations directly for privacy breaches.<\/p>\n\n\n\n Although Bill C-36 has a long legislative journey ahead, its direction is clear. A formal and regulated privacy regime may be coming. Organizations should consider preparing by reviewing the following.<\/p>\n\n\n\n Assess who within the organization is responsible for privacy compliance, oversight, and reporting. Roles for internal accountability should be clearly established.<\/p>\n\n\n\n Review whether current privacy management programs meet Bill C-36\u2019s requirements, including assigned accountability, documented processes, compliant handling procedures, and regulator-ready records.<\/p>\n\n\n\n Review whether existing consent wording is clear, plain-language, and appropriate for the personal information being collected, used, or disclosed. Organizations should also consider whether any activities may require a documented legitimate interest analysis.<\/p>\n\n\n\n Review existing agreements with service providers to ensure that protection obligations are in place and are clearly limited in how they use personal information.<\/p>\n\n\n\n Organizations using AI or algorithmic tools should identify where significant automated decisions are being made and assess whether they can provide meaningful explanations if required.<\/p>\n\n\n\n Organizations should also assess operational areas likely to be scrutinized, such as cross-border data transfers, breach response, and transparency around data use.<\/p>\n\n\n\n Bill C-36 moves beyond the flexible regime under PIPEDA to a more structured and enforceable system. While some flexibility is preserved, it\u2019s conditional on organizations having clearly and justifiably documented their decisions.<\/p>\n\n\n\n The key takeaway is simple: under Bill C-36, compliance will need to be demonstrated, not merely asserted. Organizations should focus not only on whether their practices are defensible, but also on whether those practices are documented, structured, and capable of withstanding regulatory scrutiny.<\/p>\n\n\n\n Miller Thomson will continue to monitor Bill C-36 as it moves through Parliament and will continue to provide updates on any significant changes. If you have any questions about the proposed legislation or would like assistance in reviewing your current privacy practices, please contact a lawyer from our Privacy and Cybersecurity team<\/a>.<\/p>\n\n\n\nWhy this matters<\/h2>\n\n\n\n
Flexible principles to clear rules<\/h2>\n\n\n\n
\n
\n
Expanding scope \u2013 data practices and emerging technologies<\/h2>\n\n\n\n
Anonymized vs. de-identified information<\/h3>\n\n\n\n
Automated decision systems<\/h3>\n\n\n\n
Children\u2019s personal information<\/h3>\n\n\n\n
Individual rights<\/h3>\n\n\n\n
Service providers<\/h3>\n\n\n\n
Legitimate interest and processing without consent<\/h2>\n\n\n\n
\n
The Commission\u2019s new enforcement powers and private right of action<\/h2>\n\n\n\n
\n
What organizations should do now<\/h2>\n\n\n\n
Governance structures<\/h3>\n\n\n\n
Privacy management programs<\/h3>\n\n\n\n
Consent language<\/h3>\n\n\n\n
Service provider contracts<\/h3>\n\n\n\n
Automated decision systems<\/h3>\n\n\n\n
Cross-border transfers, breach response and transparency<\/h3>\n\n\n\n
Conclusion<\/h2>\n\n\n\n
\n\n\n\n