Canada Data Protection & Privacy Regulation

Regulator & Framework

The central development in Canada's data-protection framework this cycle is the first reading of Bill C-36, the Protecting Privacy and Consumer Data Act, in the House of Commons on June 15, 2026. As introduced, the bill would enact the Protecting Privacy and Consumer Data Act to govern the protection of personal information while taking into account the needs of organisations, and it would repeal the privacy provisions currently found in the Personal Information Protection and Electronic Documents Act. In place of the Office of the Privacy Commissioner's current enforcement role under PIPEDA, the bill proposes a new Digital Safety and Data Protection Commission of Canada, a dedicated enforcement body with powers to issue binding orders against non-compliant organisations.

This is a proposed instrument, not yet enacted, and its first-reading status means its provisions remain subject to committee review, amendment and further readings before any final form is settled. The scale of the proposed change, however, is substantial on its face: a shift from PIPEDA's current enforcement model, which relies on the Privacy Commissioner's recommendation-based powers with limited direct penalty authority, to a dedicated Commission with binding enforcement powers would represent the most significant architectural change to Canadian federal private-sector privacy law since PIPEDA's original enactment.

The bill's introduction does not alter the current operative framework. PIPEDA remains in force in its existing form, and the Office of the Privacy Commissioner continues to exercise its existing powers, including the capacity demonstrated this cycle through its joint investigation of OpenAI, while Bill C-36 proceeds through the legislative process. Organisations operating in Canada should therefore treat the current PIPEDA framework, including the Privacy Commissioner's existing oversight role, as the operative regime, with Bill C-36 representing a proposed future state rather than a present obligation.

Outlook

The pace and outcome of Bill C-36's passage through committee and subsequent House and Senate readings will determine when, and in what final form, the Digital Safety and Data Protection Commission comes into existence and PIPEDA's privacy provisions are repealed. As at this cycle, the bill has passed only first reading, and no committee timetable was located in the material reviewed.

Regulator & Framework

Canada's federal privacy-framework reform advanced procedurally this cycle with the first reading of Bill C-36, the Protecting Privacy and Consumer Data Act, on 15 June 2026. The bill drops the Artificial Intelligence and Data Act entirely and proposes a new Digital Safety and Data Protection Commission of Canada, carrying order-making and administrative-monetary-penalty powers that would take over the private-sector enforcement role currently held by the Office of the Privacy Commissioner under the Personal Information Protection and Electronic Documents Act. The Privacy Commissioner has publicly welcomed several of the bill's features, including its recognition of privacy as a fundamental right, its best-interests-of-the-child provisions, its mandatory privacy-impact-assessment requirements and its stronger enforcement powers, while also noting that the bill would transfer private-sector oversight responsibilities away from the Office itself to the new Commission. As of 11 October 2026, the bill remains at first reading with no committee or passage activity recorded.

Outlook

The bill's progress through committee stage is the development most likely to determine the shape of Canada's private-sector privacy enforcement over the coming year; its proposed Commission, if enacted, would mark a structural departure from the current OPC-centred model.

Regulator & Framework

Canada's federal private-sector privacy framework remains anchored in PIPEDA, which applies except where a province has enacted substantially similar legislation, with Quebec, British Columbia and Alberta recognised as meeting that standard. This jurisdictional-scope rule continues to define the practical division of regulatory authority between the federal Office of the Privacy Commissioner and the recognised provincial regulators.

On 15 June 2026 the federal government introduced Bill C-36, the Protecting Privacy and Consumer Data Act, as the successor to Bill C-27, which died on the Order Paper when Parliament prorogued on 6 January 2025. The most structurally significant feature of Bill C-36 is understood to be what it does not contain: whereas Bill C-27 had combined privacy reform with the Artificial Intelligence and Data Act in a single package, Bill C-36 addresses only privacy and consumer-data matters, leaving AIDA, and AI governance generally, without any legislative successor. This is reported as a deliberate unbundling rather than an oversight, separating the comparatively more settled privacy-reform agenda from the more contested AI-governance debate.

Whether Bill C-36 has progressed past first reading since its 15 June 2026 introduction had not been independently established this cycle. The bill's introduction nonetheless represents the most concrete sign of continued federal legislative activity on private-sector privacy reform since the C-27 prorogation, and its privacy-only scope is understood to reduce at least one source of legislative complexity, AI-governance controversy, that had previously slowed the combined package's progress.

Outlook

The pace of Bill C-36's progress through Parliament is the central open question for Canada's federal privacy-framework trajectory. Its unbundled, privacy-only scope may improve its prospects relative to the combined C-27 package, though no committee-stage or second-reading developments had been established this cycle. The continued absence of a legislative vehicle for AI-specific governance means that, for the foreseeable future, AI-adjacent personal-information practices will likely continue to be addressed through general-purpose PIPEDA tools rather than dedicated AI law.

Sectoral Watch

The Department of Finance pre-published draft Consumer-Driven Banking Regulations in the Canada Gazette on 27 June 2026, opening a sixty-day comment period that closed on 26 August 2026. The Office of the Privacy Commissioner filed formal comments on that same closing date, giving the privacy regulator a direct, documented role in shaping the financial-data-sharing framework before it is finalised. A staggered commencement has been proposed, beginning with accreditation requirements rather than full operational rollout. This is an active rulemaking in which the privacy regulator is a formal participant rather than an after-the-fact commentator, distinguishing it from the more passive sectoral-watch postures typical of other financial-data frameworks.

Outlook

The finalised regulations, once published, will be the first concrete indication of how far the Department of Finance has incorporated the Privacy Commissioner's formal comments of 26 August 2026, particularly regarding the staggered, accreditation-first commencement structure.

Algorithmic, Biometric & Surveillance Governance

The Office of the Privacy Commissioner of Canada, together with Quebec's Commission d'acces a l'information and the privacy regulators of British Columbia and Alberta, published a joint finding on May 6, 2026 concerning OpenAI OpCo, LLC. The finding, published as PIPEDA Findings number 2026-002, concluded that the manner in which OpenAI initially collected personal information from publicly accessible websites and licensed third-party sources to train its models was overbroad and therefore inappropriate, given the scale, nature and sensitivity of the data collected and used. This is a Confirmed, in-force finding from Canada's primary federal privacy regulator acting jointly with three provincial counterparts, representing one of the more significant AI-training-data enforcement actions issued by a Canadian privacy authority to date.

The joint and multi-regulator nature of the finding is itself notable: it reflects coordinated action across the federal regulator and three provincial regulators with their own independent statutory mandates, rather than a single regulator acting alone, suggesting a degree of cross-jurisdictional alignment on how AI-training-data collection practices should be assessed under Canada's various privacy statutes.

This enforcement activity occurs against the backdrop of Canada's continued absence of an enacted, federal AI-specific statute. Bill C-27, which would have enacted the Artificial Intelligence and Data Act, spent over two years in committee review and never reached a final vote, dying when the bill did not survive prorogation. Canada's AI-related privacy enforcement, including the OpenAI finding, therefore currently proceeds entirely under existing general-purpose privacy statutes, PIPEDA at the federal level and Law 25 and equivalent provincial statutes, rather than under any AI-specific legal framework, since no enacted replacement for the Artificial Intelligence and Data Act exists as at this cycle.

Outlook

Whether the joint OpenAI finding's overbroad-collection standard becomes a template applied to other AI-training-data investigations by Canadian privacy regulators, and whether any federal AI-specific statute re-emerges following Bill C-27's failure to pass, both remain open questions not resolved by this cycle's material.

Algorithmic, Biometric & Surveillance Governance

The Artificial Intelligence and Data Act is confirmed dead rather than merely paused: it died along with the remainder of Bill C-27 at prorogation on 5 and 6 January 2025 and has not been reintroduced in any form. Bill C-36, Canada's current federal privacy-reform vehicle, does not revive a standalone AI statute; instead, it confines AI-adjacent oversight to automated-decision-making transparency provisions within the proposed successor privacy law. This means Canada's algorithmic-governance landscape, for the foreseeable term, will be shaped through general privacy legislation's automated-decision-making transparency requirements rather than through dedicated AI-specific rules, a materially narrower scope than AIDA would have provided.

Outlook

Whether Bill C-36's automated-decision-making transparency provisions prove adequate to the governance gap AIDA's death leaves behind will likely become clearer only once the bill progresses beyond first reading and its specific transparency obligations are tested against real automated-decision-making deployments.

Enforcement & Redress

Bill C-36 proposes to establish a new Digital Safety and Data Protection Commission of Canada with binding enforcement powers against non-compliant organisations, a material departure from the Office of the Privacy Commissioner's current, more recommendation-oriented enforcement model under PIPEDA. The bill's proposed penalty ceiling, however, is reported inconsistently between contemporaneous secondary sources reviewed this cycle: one account states the figure at up to CAD 10 million or three percent of global revenue, while another states it at up to CAD 25 million or five percent of global revenue, a substantial increase in either case from PIPEDA's current maximum penalty of CAD 100,000. Neither figure has been reconciled against the bill's own text this cycle, and it is not established from the material reviewed whether the two figures describe different penalty tiers within the bill (for example, a tier for individual violations versus a tier for systemic or repeated violations) or whether one source is simply in error.

Independent of Bill C-36's still-proposed penalty structure, Quebec's Law 25 enforcement regime remains in force and continues to apply its own penalty framework: administrative monetary penalties of up to CAD 10 million or two percent of worldwide turnover, and penal fines of up to CAD 25 million or four percent of worldwide turnover, alongside a statutory-minimum private right of action set at CAD 1,000. Quebec's regime therefore already operates at a penalty scale broadly comparable to the higher of the two figures reported for Bill C-36, meaning that, depending on which Bill C-36 figure proves accurate, the federal regime may either introduce penalties below, or roughly in line with, Quebec's existing provincial ceiling.

The joint OpenAI finding issued May 6, 2026 by the Office of the Privacy Commissioner together with Quebec, British Columbia and Alberta counterparts stands as the most significant enforcement outcome of the cycle under the current, pre-C-36 framework, demonstrating that multi-regulator joint investigations remain an active enforcement mechanism available to Canadian privacy authorities notwithstanding the absence, so far, of the binding-powers Commission that Bill C-36 would create.

Outlook

Resolution of the discrepancy between the two reported Bill C-36 penalty figures against the bill's own text would materially sharpen the picture of how the new Commission's enforcement powers would compare to Quebec's existing Law 25 penalty regime; this remains unresolved as at this cycle.

Enforcement & Redress

The Office of the Privacy Commissioner told Parliament directly, in a submission dated 14 May 2026, that under the Personal Information Protection and Electronic Documents Act as currently in force, it has no power to issue binding orders or impose administrative monetary penalties on private-sector organizations, and that it has asked Parliament for such powers — precisely the gap Bill C-36's proposed new Commission is designed to close. This structural limitation has not stopped the Office from pursuing active enforcement work within its existing powers: its 2025-26 annual report disclosed a joint investigation into TikTok, conducted together with provincial counterparts, that led to privacy-practice improvements; a new breach investigation was opened on 21 September 2026; and a notice of application was filed in Federal Court on 28 August 2026 in connection with a Google de-listing investigation. The combination illustrates an enforcement body that remains active across multiple matters while operating without the binding-order and penalty powers it has formally requested.

Outlook

The Federal Court proceeding on the Google de-listing matter and the newly opened breach investigation are the two enforcement threads most likely to produce dated developments before Bill C-36 could plausibly expand the Office's underlying powers.