The federal government on Monday introduced its long-awaited update to Canada’s private-sector privacy law that promises to give Canadians more control over how their data is used in the modern digital world.
The legislation includes enhanced protections for children’s data, gives Canadians a right to request companies delete their data, cracks down on algorithmic or surveillance pricing and creates transparency measures for how automated or artificial intelligence tools are used.
It would also grant a newly-proposed federal regulator strict enforcement measures, including monetary penalties to be laid against companies that misuse Canadians’ data in violation of the law.
“Canada’s consumer privacy laws are 25 years old. They were written before the iPhone. It was a different time, before AI, before deepfakes,” AI Minister Evan Solomon said after tabling the bill in the House of Commons.
“We’re living in a different world, and our laws need to catch up.”
Solomon said the bill sets out “clear rules of the road” for businesses to follow in handling personal data, with “real consequences” for those who violate them. Yet he also stressed to industry stakeholders listening to his announcment that “protection is not the opposite of innovation.”
The text of the bill says its purpose is to establish rules for protecting personal data that recognize “a fundamental right of privacy” for Canadians.
The legislation builds on the online harms bill introduced last week that seeks to strengthen safety measures for social media and AI platforms.
Both bills were promised in the federal AI strategy announced earlier this month as part of a key pillar focused on safety and building Canadians’ trust in the technology.
Under the privacy bill, all children’s data would be treated as “sensitive,” a defined term for data that has a higher threshold for how it’s collected and shared by companies under Canadian law.
The legislation requires companies to obtain individuals’ explicit consent for collecting, using or disclosing their data by explaining data usage policies in “plain language.”
Get daily National news
Get daily Canada news delivered to your inbox so you’ll never miss the day’s top stories.
Canadians would have the right to request in writing that private sector companies dispose of their personal information if an individual feels it was collected improperly or has withdrawn their consent.
Companies may refuse a request if disposal “would have an undue adverse effect on the organization that outweighs any potential adverse effect on the individual resulting from the retention of the information,” among other exemptions, according to the bill.
Although the bill does not mention the words “artificial intelligence” or “surveillance pricing,” officials said specific regulations would follow the bill’s passage that address those and other issues.
Solomon told reporters that, while consumer data shouldn’t be used to charge unfair prices or “price gouging,” retail companies should be allowed to use that same data for proper things like rewards or points programs to get lower costs on goods.
“If the harms outweigh the benefits, as in the case with surveillance pricing, the regulator could take charge,” he said.
“When this bill passes, I’ll be asking the regulator for guidance, to publish guidance as one of my first acts on surveillance pricing, to clarify exactly what that will be.”
The online harms bill proposes the creation of a new digital safety commission that would be responsible for oversight and enforcement, which the government predicts will be up and running at least 18 months after that bill becomes law.
Under the new privacy reform bill, that new commission’s mandate would be expanded to also cover data protection, and a privacy and consumer data commissioner would be appointed to handle private-sector privacy issues.
Government officials told reporters during a technical briefing that the new regulator’s dual mandate “will ensure greater coherence” and stronger protections across related issues in the digital realm.
“For Canadians, this provides one trusted organization to turn to for help, whether they have concerns about the use of their personal information or their safety online,” officials said.
They added the new regulator would also be able to launch its own investigations into companies’ use of data or safety issues, rather than relying on submitted complaints.
As with the online harms bill, the privacy legislation sets a maximum fine for companies that violate the law at $10 million or three per cent of a company’s most recent annual global revenue, whichever is greater.
The current federal privacy commissioner, meanwhile, would see its duties shrink to only oversee the Privacy Act, which regulates the federal government’s use of private data, such as tax information.
Privacy commissioner Philippe Dufresne — whose office has recently investigated ChatGPT, xAI and multiple social media companies — has repeatedly called for the enhanced enforcement powers granted to the proposed new digital safety and data protection commission.
Officials on Monday didn’t clearly explain why they opted to create a whole new regulatory body instead, other than suggesting the government felt public- and private-sector privacy issues should be treated separately. They also wouldn’t say if expanding the existing watchdog’s mandate and staffing would have been faster than standing up a new independent office.
In an email to Global News, Florian Martin-Bariteau, a law professor at the University of Ottawa, said the creation of a new regulator was “the biggest red flag of the bill,” which he otherwise said is “a great step forward” in protecting Canadians.
“We had a very good privacy regulator,” he wrote. “It was just missing order-making powers and the power to impose fines.
“Now we will need to build first a new regulator, hire people, build the culture … before having something that can work. It will take years in the making.”
This is the Liberal government’s third attempt to update the Personal Information Protection and Electronic Documents Act after introducing bills in 2020 and in 2023 that did not become law.
Parliament is scheduled to break for the summer on Friday, meaning the earliest the privacy and online harms bills could be passed is the fall.
—With files from the Canadian Press
More Stories
Ottawa unveils plan to ban social media for youth — but not AI chatbots – National
The Gordie Howe bridge opening is being delayed over ‘outstanding issues’
Ottawa moves to crack down on forced labour products with new measures – National