Bill C-36 proposes empty privacy protections, broad exceptions for corporate data exploitation, and little to address AI harms

Yesterday, the government tabled Bill C-36, the Protecting Privacy and Consumer Data Act, which seeks to overhaul Canada’s federal privacy framework for private companies.

The proposal—a “cornerstone” of Canada’s “National Artificial Intelligence Strategy: AI for All”—is intended to provide Canadians with more control over their personal data with the stated objective of providing confidence in, and higher adoption of AI tools.

Many of the bill’s supposed privacy benefits, including the right of deletion, heightened protections for children’s privacy, and banning of inappropriate data practices such as surveillance pricing, simply re-state measures that have been part of Canada’s federal privacy framework since it was first adopted over twenty-five years ago. Other ostensible benefits, such as the law’s claimed recognition of privacy as a “fundamental right”, are purely rhetorical in nature and undermined by other provisions that would create a new imperative to facilitate personal data commodification across all elements of the law.

The bill does offer some improvements to Canada’s existing privacy law, including much over-due enforcement mechanisms. But these are weakened by broad exceptions for business activities, an overly permissive framework for personal data that is de-identified but not anonymized, and dilution of the Privacy Commissioner of Canada’s role as steward of commercial privacy protections.

The new regime also continues the government’s failure to make federal pollical parties subject to meaningful privacy laws and suffers from a marked absence of any effective protections against AI systems despite the well-documented harms this emerging suite of technologies is already causing. Equally absent are any transparency or oversight measures to address the ever-growing reliance of police on the vast data troves held by private companies.

Tamir Israel, Director of CCLA’s Privacy, Surveillance and Technology Program, made the following statement:

“While Bill C-36 offers some new protections for our privacy, it also grants businesses the ability to ignore consent requirements and retain personal data indefinitely if superficially de-identified. The proposal offers scant constraints on AI despite the growing challenges these technologies pose to society and embeds commercial interests and trade obligations as core considerations in the proposed law’s application. In the face of escalating data exploitation, Canada deserves meaningful, not illusory, data safeguards.”