Canada: Data Subject Rights

Separately, and operating under a different legislative vehicle, the Budget 2025 Implementation Act has begun operationalising a data-mobility right within the existing Personal Information Protection and Electronic Documents Act framework, intended to facilitate economy-wide data sharing. This data-mobility right is connected to, though distinct from, the Consumer-Driven Banking Act's open-banking data-access framework: the PIPEDA-level mobility right provides the general data-protection law basis, while the Consumer-Driven Banking Act provides the sector-specific implementing structure for the financial-services context specifically.

Both developments point toward an expansion of individual data-subject rights in Canada beyond PIPEDA's current baseline, which does not include an explicit, general-purpose data-portability or deletion right of the scope now proposed. Bill C-36's deepfake-deletion right remains proposed rather than in force, while the data-mobility right's operationalisation under the Budget 2025 Implementation Act appears to be further along, tied as it is to the enacted Consumer-Driven Banking Act framework, though the precise state of the mobility right's own implementation timeline was not independently confirmed against primary legislative text this cycle.

Outlook

The deepfake-deletion right's fate depends entirely on Bill C-36's passage; the data-mobility right's practical availability to individuals depends on the Consumer-Driven Banking Act's own implementing regulations and the Bank of Canada's accreditation timetable for participating entities, neither of which was confirmed as finalised this cycle.