Bill C-36 and the Future of Canada’s Federal Private Sector Privacy Law: What Has Changed, What It Means, and What to Do Now

Introduction

Canada’s federal private sector privacy reform has returned, and it is not merely Bill C-27 in revised form. On June 15, 2026, the federal government introduced Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, marking the latest attempt to modernize Canada’s private sector privacy framework following the failure of Bill C-27 to advance through Parliament before prorogation early last year.

Bill C-36 would enact the Protecting Privacy and Consumer Data Act (“PPCDA”), while Bill C-27 would have enacted the Consumer Privacy Protection Act (“CPPA”), a separate Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act (“AIDA”). The structural shift is significant: Bill C-27 was an omnibus package addressing privacy, tribunal oversight, and AI regulation in a single legislative instrument. Bill C-36, by contrast, is a focused privacy and consumer data bill.

Bill C-36, as currently drafted, reflects a more operationally focused approach, centering on privacy and consumer data while placing increased emphasis on accountability mechanisms, cross-border data governance, and risk-based standards.

If enacted in its current form, Bill C-36 would repeal Part 1 of the Personal Information Protection and Electronic Documents Act (“PIPEDA”). This would result in a fundamentally redesigned federal privacy regime.

What follows is an examination of the changes that, in our view, matter most.

Artificial Intelligence Unbundled: A Privacy-Focused Bill

For businesses, legal teams, and technology leaders, the first and perhaps most striking difference is that AI regulation has been effectively unbundled from the privacy bill. Bill C-27 included the proposed AIDA, a standalone statute within the omnibus bill that would have established a regulatory framework for high-impact AI systems, including requirements for risk assessments, bias mitigation measures, public reporting obligations, ministerial orders, and AI-specific offences.

Bill C-36 contains no equivalent AI legislation. It is framed squarely as a privacy and consumer data bill.

The PPCDA does retain the concept of “automated decision systems” and requires organizations to provide explanations to individuals where such systems are used to make predictions, recommendations, or decisions that could have “a legal or similarly significant effect” on them. Organizations must also provide a general account of their use of automated decision systems in their publicly available privacy policies.

A Redesigned Regulatory Model

Bill C-27 relied on two bodies: the Privacy Commissioner of Canada for investigations and the proposed Personal Information and Data Protection Tribunal to hear appeals and impose administrative monetary penalties. Bill C-36 replaces this model entirely. It establishes the Digital Safety and Data Protection Commission of Canada (the “Commission”), a Privacy and Consumer Data Commissioner (the “Commissioner”), and a Privacy and Consumer Data Division (the “Division”). Critically, appeals under Bill C-36 are subject to review by the Federal Court rather than a specialized tribunal.

Under Bill C-36, the Commission would consist of five full-time members appointed by the Governor in Council. The Commissioner would lead investigations and compliance activities, while the Division would handle functions such as the approval of codes of practice and certification programs.

An entity may apply to the Division for approval of a code of practice that provides for substantially the same or greater protection of personal information as the PPCDA, and may also apply for approval of disciplinary measures for non-compliance with such a code, including the revocation of an organization’s certification.

Practical Consequences of Proposed Regulatory Model…

Read the Full Article at Lexology