FTR Now
Canada Tables Bill C-36, the Protecting Privacy and Consumer Data Act
Date: June 18, 2026
On June 15, 2026, the Government of Canada announced the tabling of Bill C-36, the Protecting Privacy and Consumer Data Act (PPCDA) which, if passed, will require private sector organizations to take on new responsibilities regarding the protection and deletion of personal information they collect.
Similar to the Personal Information Protection and Electronic Documents Act (PIPEDA), as currently drafted, the PPCDA will apply to every organization in respect of personal information that:
(a) the organization collects, uses or discloses in the course of commercial activities; or
(b) is about an employee of, or an applicant for employment with, the organization and that the organization collects, uses or discloses in connection with the operation of a federal work, undertaking or business.
New Requirements for Private Sector Organizations
The PPCDA will implement new requirements for private sector organizations, aimed at the following goals:
- recognizing privacy as a fundamental right of all Canadians
- setting higher standards for organizations when they manage children’s information
- requiring meaningful consent for the use of personal information and plain-language explanations for how personal information is handled
- ensuring that organizations are transparent about their use of automated decision making for significant decisions about individuals
- providing Canadians with the right to request deletion of their personal information to better protect their privacy and reputation
- ensuring that personal information is used responsibly, transparently and for appropriate purposes, and preventing unfair or inappropriate uses such as surveillance pricing
- supporting data mobility, so Canadians can move their personal information securely between organizations where a framework applies
- enhancing Canada’s digital sovereignty by requiring robust privacy safeguards and risk assessments before personal information is transferred outside Canada
- establishing strong enforcement mechanisms, including significant penalties for non-compliance
New Digital Safety and Data Protection Commission
The PPCDA will be administered by the Digital Safety and Data Protection Commission of Canada, a new commission designed to provide regulatory oversight and enforcement. This Commission will also have responsibility for the Safe Social Media Act.
The Commission will have the ability to issue binding orders which can include penalties of up to $10 million or 3% of global revenue, whichever is greater, and fines of up to $25 million or 5% of global revenue, whichever is greater, for the most serious offences.
Other Recent Developments and Background
The proposed Bill C-36 comes on the heels of a number of privacy-related proposals from the federal government, including Bill C-34, the Safe Social Media Act, which was announced on June 10, 2026, and Canada’s National Artificial Intelligence Strategy: AI for All, which was announced on June 8, 2026.
The current private sector privacy legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA), is the only Canada-wide private sector legislation that organizations must adhere to. PIPEDA was enacted on April 13, 2000, and to date, it has not had any substantive updates including with respect to the ongoing development of Artificial Intelligence (AI).
We will continue to monitor updates on Bill C-36 as they become available.
For assistance, please contact Scott T. Williams, Andrew J. Movrin or Victoria McCorkindale, or other members of the firm’s Information, Data Security & Privacy Practice Group.
The article in this client update provides general information and should not be relied on as legal advice or opinion. This publication is copyrighted by Hicks Morley Hamilton Stewart Storie LLP and may not be photocopied or reproduced in any form, in whole or in part, without the express permission of Hicks Morley Hamilton Stewart Storie LLP. ©