Canada Introduces Bill C-36 to Replace PIPEDA’s Privacy Framework
Canada has introduced Bill C-36, the Protecting Privacy and Consumer Data Act, a major federal privacy reform proposal that would replace the private-sector privacy portions of PIPEDA if enacted. The bill received first reading in the House of Commons on June 15, 2026, and is currently still moving through the legislative process. For now, PIPEDA remains the governing federal private-sector privacy law, but Bill C-36 signals that Canada is again moving toward a more modern privacy regime.
If passed, the proposed law would create a standalone privacy statute for commercial personal information, recognize privacy as a fundamental right, and introduce stronger enforcement tools, including binding orders and significant monetary penalties. It would also place greater emphasis on children’s personal information, cross-border transfers, automated decision systems, privacy management programs, and deletion rights. Organizations subject to PIPEDA should continue complying with current requirements while monitoring Bill C-36 closely, since its passage would likely require updates to privacy notices, governance documentation, consent practices, automated decision-making disclosures, and third-party data transfer processes.
Canada’s consumer protection laws ensure that private-sector organizations handle personal information responsibly. A key piece of legislation in this area is the Personal Information Protection and Electronic Documents Act (PIPEDA). This article offers an overview of PIPEDA’s requirements and its impact on businesses and consumers nationwide.
What is PIPEDA?
PIPEDA sets the framework for how businesses must manage personal data during their commercial activities. It also covers the personal information of employees in federally regulated sectors, ensuring a standard of privacy protection across Canada.
Core Responsibilities Under PIPEDA
Businesses governed by PIPEDA are required to follow ten key principles to protect personal information:
- Responsibility
- Purpose Identification
- Obtaining Consent
- Data Minimization
- Limited Usage and Retention
- Data Accuracy
- Security Measures
- Transparency
- Access for Individuals
- Addressing Complaints
Adhering to these principles helps businesses build consumer trust and contribute to a secure digital economy.
Applicability of PIPEDA
PIPEDA applies to private-sector organizations that collect, use, or disclose personal information in their commercial activities. This includes any transaction or conduct of a commercial nature, such as selling or leasing donor lists.
Provincial Privacy Legislation
Certain provinces, like Alberta, British Columbia, and Quebec, have their own privacy laws deemed equivalent to PIPEDA. Businesses in these provinces are generally exempt from PIPEDA for activities conducted within the province. Additionally, Ontario, New Brunswick, Nova Scotia, and Newfoundland and Labrador have similar laws for personal health information.
Handling Data Across Borders
Organizations operating in Canada and dealing with personal information that crosses provincial or national borders must comply with PIPEDA, regardless of their location. This requirement includes provinces with their own privacy laws.
Federally Regulated Entities
Federally regulated businesses, such as banks, telecommunications companies, and transportation firms, must adhere to PIPEDA. This also includes the personal information of their employees. Organizations in the Northwest Territories, Yukon, and Nunavut fall under this category as well.
Definition of Personal Information
Under PIPEDA, personal information is any factual or subjective data about an identifiable individual. This can include:
- Basic details like age, name, ID numbers, income, ethnic origin, or blood type
- Personal opinions, evaluations, comments, social status, or disciplinary actions
- Employee records, credit and loan histories, medical records, disputes, or consumer intentions (e.g., purchasing plans or job changes)
Exceptions to PIPEDA
PIPEDA does not apply to:
- Personal data handled by federal government bodies listed under the Privacy Act
- Provincial or territorial governments and their representatives
- Business contact information used solely for professional communication
- Personal data collected, used, or disclosed for personal reasons (e.g., holiday card lists)
- Data used for journalistic, artistic, or literary purposes
Moreover, PIPEDA typically does not cover not-for-profit and charity organizations, political parties, and associations unless they engage in commercial activities involving personal data.
Canada’s consumer protection framework, particularly PIPEDA, is vital for ensuring the careful handling of personal information in the digital landscape. By adhering to PIPEDA’s principles, businesses can foster consumer confidence and contribute to a robust and secure digital economy.
Information sourced from the Office of the Privacy Commissioner of Canada (OPC).
