Bill C-36 proposes empty privacy protections, broad exceptions for corporate data exploitation, and little to address AI harms

Yesterday, the government tabled Bill C-36, the Protecting Privacy and Consumer Data Act, which seeks to overhaul Canada’s federal privacy framework for private companies.

The proposal—a “cornerstone” of Canada’s “National Artificial Intelligence Strategy: AI for All”—is intended to provide Canadians with more control over their personal data with the stated objective of providing confidence in, and higher adoption of AI tools.

Many of the bill’s supposed privacy benefits, including the right of deletion, heightened protections for children’s privacy, and banning of pratiques de données inappropriées such as surveillance pricing, simply re-state measures that have been part of Canada’s federal privacy framework since it was first adopted over twenty-five years ago. Other ostensible benefits, such as the law’s claimed recognition of privacy as a “fundamental right”, are purely rhetorical in nature and undermined by other provisions that would create a new imperative to facilitate personal data commodification across all elements of the law.

The bill does offer some improvements to Canada’s existing privacy law, including much over-due enforcement mechanisms and a transparency measure for algorithmic decision-making. But these are weakened by broad exceptions for business activities, an overly permissive framework for personal data that is de-identified but not anonymized, and dilution of the Privacy Commissioner of Canada’s role as steward of commercial privacy protections.

The new regime also continues the government’s failure to make federal pollical parties subject to meaningful privacy laws and suffers from a marked absence of any effective protections against AI systems despite the well-documented harms this emerging suite of technologies is already causing. Equally absent are any transparency or oversight measures to address the ever-growing reliance of police on the vast data troves held by private companies.

Tamir Israel, directeur du programme "Vie privée, surveillance et technologie" de l'ACLC, a fait la déclaration suivante :

“While Bill C-36 offers some new protections for our privacy, it also grants businesses the ability to ignore consent requirements and retain personal data indefinitely if superficially de-identified. The proposal offers scant constraints on AI despite the growing challenges these technologies pose to society and embeds commercial interests and trade obligations as core considerations in the proposed law’s application. In the face of escalating data exploitation, Canada deserves meaningful, not illusory, data safeguards.”