Tag

children's data

1 article

AccountabilityJuly 3, 20266 min read
Canada's New Privacy Bill Carries the Biggest Penalties in Its History. It Isn't Expected to Take Effect Until About 2030 — and the Independent Privacy Watchdog Won't Be the One Enforcing It.
On June 15, 2026, Minister of Artificial Intelligence and Digital Innovation Evan Solomon tabled Bill C-36, an Act to enact the Protecting Privacy and Consumer Data Act (PPCDA) — the most significant rewrite of Canada's private-sector privacy law since PIPEDA took effect in 2001. The bill's substance is real: a single definition of children (under 18) with children's data classified as sensitive, personal information extended to cover inferred data, a right to human review of automated decisions with significant effects, binding order-making powers, administrative penalties up to $10 million or 3% of global revenue, and fines up to $25 million or 5% of global revenue for the most serious offences. Several provisions — the right to deletion, data mobility, algorithmic transparency, a conditional private right of action — return from Bills C-11 (2020) and C-27 (2022), both of which died without passing. The structural choices are where the debate lives. Enforcement of the new law moves from the Privacy Commissioner of Canada, an independent Agent of Parliament, to a new Digital Safety and Data Protection Commission — a Cabinet-appointed body that also administers online-harms regulation, with a designated Privacy and Consumer Data Commissioner inside it. University of Ottawa law professor Michael Geist calls the design unprecedented among peer countries, argues the commission's internal separation between investigators and adjudicators is more formal than real, and estimates the full regime will not be operational until roughly 2030-31 — a year for passage, eighteen months to stand up the commission, and two more years for it to build privacy expertise. He also notes that anonymized data falls outside the Act entirely while the anonymization standards are left to regulations not yet written. Bill C-36 received first reading June 15 and awaits second reading in the fall. This article documents what the bill does, what it delays, and how its timeline compares with the Lawful Access Act the same House passed in a single day on June 18.

Canada's New Privacy Bill Carries the Biggest Penalties in Its History. It Isn't Expected to Take Effect Until About 2030 — and the Independent Privacy Watchdog Won't Be the One Enforcing It.

On June 15, 2026, Minister of Artificial Intelligence and Digital Innovation Evan Solomon tabled Bill C-36, an Act to enact the Protecting Privacy and Consumer Data Act (PPCDA) — the most significant rewrite of Canada's private-sector privacy law since PIPEDA took effect in 2001. The bill's substance is real: a single definition of children (under 18) with children's data classified as sensitive, personal information extended to cover inferred data, a right to human review of automated decisions with significant effects, binding order-making powers, administrative penalties up to $10 million or 3% of global revenue, and fines up to $25 million or 5% of global revenue for the most serious offences. Several provisions — the right to deletion, data mobility, algorithmic transparency, a conditional private right of action — return from Bills C-11 (2020) and C-27 (2022), both of which died without passing. The structural choices are where the debate lives. Enforcement of the new law moves from the Privacy Commissioner of Canada, an independent Agent of Parliament, to a new Digital Safety and Data Protection Commission — a Cabinet-appointed body that also administers online-harms regulation, with a designated Privacy and Consumer Data Commissioner inside it. University of Ottawa law professor Michael Geist calls the design unprecedented among peer countries, argues the commission's internal separation between investigators and adjudicators is more formal than real, and estimates the full regime will not be operational until roughly 2030-31 — a year for passage, eighteen months to stand up the commission, and two more years for it to build privacy expertise. He also notes that anonymized data falls outside the Act entirely while the anonymization standards are left to regulations not yet written. Bill C-36 received first reading June 15 and awaits second reading in the fall. This article documents what the bill does, what it delays, and how its timeline compares with the Lawful Access Act the same House passed in a single day on June 18.