The Canadian government introduced a new privacy bill in the House of Commons on Monday aimed at strengthening protections for personal data, with a particular focus on children’s information and transparency in the digital economy. The legislation, known as Bill C-36, seeks to modernize the country’s privacy framework, which has not been substantively updated since the Personal Information Protection and Electronic Documents Act (PIPEDA) was enacted more than 25 years ago.

Among the key provisions, the bill sets a higher standard for the handling of data relating to individuals under 18. Companies would be required to treat children’s personal information as sensitive, obtaining explicit parental consent to retain such data and limiting its retention period. Evan Solomon, Minister of Artificial Intelligence and Digital Innovation, emphasized that the bill aims to ensure stronger safeguards around children’s data while balancing the use of information for benefits like loyalty programs.

The bill also addresses emerging privacy risks posed by artificial intelligence and automated decision-making. Consumers would gain the right to transparency about how their data influences major decisions such as mortgage approvals or credit ratings, including the use of AI systems with minimal human intervention. Solomon noted the importance of providing Canadians with "visibility inside how decisions are made by AI."

In addition, the legislation would empower a newly established federal regulatory body, the Digital Safety and Data Protection Commission of Canada, to oversee compliance. This entity would have authority to enforce the law, including imposing fines of up to $10 million or 3 percent of a company’s global revenue for violations. The proposed regulator would also be tasked with addressing issues such as surveillance pricing—a practice where retailers adjust prices for consumers based on their shopping habits—though the bill does not explicitly mention this term. Solomon indicated plans to have the regulator issue guidance on such practices once established.

The bill would also introduce the right for individuals to request deletion of their personal data, including AI-generated deepfakes, although exceptions apply when data is retained for non-identifying purposes or law enforcement use. Canadians would be able to withdraw consent for data use and have greater control over the portability of their personal information between companies.

Privacy Commissioner of Canada Philippe Dufresne welcomed the bill, highlighting its recognition of privacy as a fundamental right and the explicit focus on protecting children’s interests. He also supported the enhanced enforcement powers and mandatory privacy impact assessments introduced in the legislation.

However, some experts caution that the effectiveness of the bill will depend on its implementation and enforcement. Vass Bednar, managing director of the Canadian Shield Institute, described the bill as “a welcome restart” but stressed that it must provide meaningful protections to Canadians navigating an increasingly complex digital landscape.

Overall, Bill C-36 represents a comprehensive effort by the Canadian federal government to update privacy laws in response to technological advancements and changing societal expectations, with a particular emphasis on data transparency, children’s privacy, and oversight of AI-driven practices.