Canada Bill C-36: Powerful AI Privacy Law Could Transform Data Protection

Canada is moving to modernize its privacy laws with the introduction of Bill C-36, a proposed law that aims to strengthen consumer data protection, regulate AI-driven data practices, and introduce tougher enforcement against privacy violations. Canada Bill C-36

If passed, the legislation would become the biggest overhaul of Canada’s private-sector privacy framework in more than 25 years, replacing outdated rules that were created long before today’s artificial intelligence technologies.

The proposed Protecting Privacy and Consumer Data Act (PPCDA) would establish new obligations for organizations that collect, use, or disclose personal information while giving Canadians stronger rights over how their data is handled.

What is Bill C-36?

Bill C-36 is legislation introduced by the Government of Canada on June 15, 2026.

The bill seeks to:

• Modernize Canada’s privacy laws
• Address AI-related privacy risks
• Improve transparency in automated decision-making
• Strengthen consumer control over personal information
• Introduce tougher penalties for organizations that misuse data

Unlike previous privacy legislation, Bill C-36 directly considers how artificial intelligence can analyze, infer, and re-identify personal information.

Why Canada is Updating Its Privacy Laws

Artificial intelligence has dramatically changed how companies process data.

Modern AI systems can build detailed profiles of individuals using multiple data sources, including information that appears anonymous at first glance.

According to privacy experts, traditional privacy laws were not designed to regulate technologies capable of:

• AI profiling
• Automated decision-making
• Behavioral tracking
• Data inference
• Re-identification of anonymized information

Bill C-36 attempts to close these regulatory gaps.

Key Features of Bill C-36

If enacted, the legislation would introduce several significant changes.

Stronger Consumer Privacy Rights

Individuals would gain more control over their personal information, including:

• Requesting deletion of personal data
• Requesting transfer of personal information
• Better transparency regarding how data is used
• Greater oversight of automated AI decisions

AI Transparency Requirements

Organizations using AI-powered systems would have to provide greater transparency about:

• Automated decision-making
• AI-assisted profiling
• Collection and use of personal information

This is intended to reduce hidden algorithmic decision-making that affects consumers.

New Rules for Sensitive Personal Information

The proposed legislation identifies several categories of highly sensitive information, including:

• Children’s data
• Health information
• Biometric data
• Genetic information
• Political opinions
• Religious beliefs
• Sexual orientation
• Racial and ethnic origin

Organizations handling these categories may face stricter compliance requirements.

Privacy Impact Assessments

Companies transferring data outside Canada would be expected to complete privacy risk assessments before sending personal information across borders.

The proposal aims to improve protection of Canadians’ data regardless of where it is processed.

New Privacy Commission

Bill C-36 proposes creating a new Digital Safety and Data Protection Commission of Canada.

The commission would oversee compliance and replace the current privacy oversight structure with expanded enforcement powers.

Its responsibilities would include:

• Investigating complaints
• Conducting audits
• Reviewing compliance programs
• Issuing binding orders
• Enforcing privacy regulations

Tougher Penalties

One of the biggest changes is the introduction of much larger financial penalties.

Organizations that violate the proposed law could face:

• Administrative penalties of up to CA$10 million or 3% of global revenue, whichever is higher
• Serious violations could result in fines of up to CA$25 million or 5% of global revenue

The bill would also introduce a private right of action, allowing individuals to seek damages through the courts in certain situations.

AI Data Inference Takes Center Stage

A major focus of Bill C-36 is “data inference.”

Unlike traditional data collection, AI systems can infer information that users never explicitly shared.

For example, AI may predict someone’s:

• Health status
• Financial situation
• Shopping behavior
• Political interests
• Lifestyle patterns

The legislation attempts to regulate these AI-generated inferences alongside directly collected personal information.

What Businesses Should Do Now

Although Bill C-36 has only received its first reading in Parliament and is not yet law, organizations are encouraged to begin preparing.

Recommended steps include:

• Mapping personal data collected
• Reviewing consent practices
• Updating privacy policies
• Auditing third-party service providers
• Reviewing AI systems
• Improving privacy management programs
• Preparing for deletion and data portability requests

Early preparation could help organizations comply more quickly if the legislation is passed.

Bill C-36 Is Still a Proposed Law

It is important to note that Bill C-36 has only completed its first reading in Parliament.

The legislation must still proceed through:

1. Second Reading
2. Committee Review
3. Third Reading
4. Senate Approval
5. Royal Assent

Changes may still be made before it becomes law.

A Major Step Toward AI Privacy Regulation

Bill C-36 represents Canada’s most ambitious effort yet to regulate privacy in the era of artificial intelligence.

By introducing stronger consumer rights, increased transparency, tougher enforcement, and specific AI-related safeguards, the proposed legislation aims to create a modern privacy framework that reflects how data is collected and processed today.

If enacted, Bill C-36 could influence future AI privacy laws beyond Canada as governments worldwide continue searching for effective ways to regulate rapidly evolving artificial intelligence technologies.

---

FAQ

What is Canada’s Bill C-36?

Bill C-36 is proposed legislation that would introduce the Protecting Privacy and Consumer Data Act to modernize Canada’s privacy laws and address AI-related data protection challenges.

Is Bill C-36 currently law?

No. Bill C-36 has only received its first reading in Parliament and must complete the legislative process before becoming law.

How does Bill C-36 affect artificial intelligence?

The bill introduces transparency requirements for AI systems, regulates automated decision-making, and addresses AI-powered data inference and profiling.

What penalties does Bill C-36 propose?

Organizations could face penalties of up to CA$10 million or 3% of global revenue, while serious violations could result in fines of up to CA$25 million or 5% of global revenue.

Who will Bill C-36 apply to?

The proposed law would apply to organizations that collect, use, or disclose personal information during commercial activities, including businesses using AI technologies to process personal data.