About Bill C-36 and an Overview of PPCDA
On June 15, 2026, the Government of Canada introduced Bill C-36 for first reading. Bill C-36 would repeal and replace Part 1 “Protection of Personal Information in the Private Sector” of the Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”) with a new statute called the Protecting Privacy and Consumer Data Act (“PPCDA”). PIPEDA is Canada’s federal private-sector privacy legislation.
PPCDA will establish a strengthened privacy regime for the private sector. It will apply to every organization that collects, uses, or discloses personal information in the course of commercial activities, as well as to federal organizations collecting, using, or disclosing personal information of their employees.
Key Changes Your Business Should Know About
- A Stricter Test for Collecting and Using Personal Information
Bill C-36 proposes that the “appropriate purposes” test will be revised. Under section 5(3) of PIPEDA, a business may collect, use, or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances. Pursuant to section 12 of Bill C-36, PPCDA would expand this test so that it applies not only to why you collect data, but also to how you collect and handle data. This is a meaningful change because it directs attention not only to the business objective, but also to how the organization carries out the data activity.
Section 12(2) of Bill C-36 lists factors that must be considered when assessing whether the manner of handling personal information and purposes are appropriate. Those factors include:
- the sensitivity of the personal information;
- whether the purposes represent legitimate business needs;
- whether the collection, use, or disclosure is effective in meeting those needs;
- whether less intrusive alternatives are available at comparable cost and benefit; and
- whether the individual’s loss of privacy is proportionate to the benefits in light of mitigation measures.
Practical Takeaway: Businesses will need to be prepared to justify not only that a data practice supports a real business objective, but also that the practice is proportionate, effective, and appropriately limited.
- New Exceptions to Consent
Currently, businesses generally need an individual’s consent before collecting or using their personal information. PPCDA would create specific consent exceptions for certain defined business activities. Under section 18(1) of Bill C-36, an organization may collect or use an individual’s personal information without their knowledge or consent, if:
- the collection or use is made for the purpose of an exempt business activity (as described below);
- a reasonable person would expect the collection or use for such an activity; and
- the personal information is not collected or used for the purpose of influencing the individual’s behaviour or decisions.
Pursuant to section 18(2) of Bill C-36, the exempt business activities include:
- activities that are necessary to provide a product or service that the individual has requested from the organization;
- activities that are necessary for the security of the organization’s information, systems or networks;
- activities that are necessary for the safety of a product or service that the organization provides; and
- any other prescribed activity (as prescribed by regulation).
Practical Takeaway: These exceptions could provide some businesses with more flexibility in defined operational contexts, but they are narrow. They do not apply where the real aim is to influence an individual’s decisions.
- Defining Automated Decision Systems
As artificial intelligence (“AI”) becomes more widely used, the proposals of Bill C-36 impose greater transparency and accountability obligations on organizations that use these systems. Section 2(1) of Bill C-36 introduces a statutory definition of “automated decision system” covering technologies that assist or replace human judgment through rules-based systems, regression analysis, predictive analytics, machine learning, deep learning, neural networks, or other techniques.
Practical Takeaway: Businesses using AI or other automated decision systems to make decisions about individuals should expect more scrutiny of how such automated tools affect individuals and how those tools fit within the organization’s privacy governance framework.
- Clearer Rules for De-Identification
Sections 74 and 75 of Bill C-36 add explicit rules for de-identification of personal information. De-identification means modifying personal information so that an individual cannot be directly identified from it, although a risk of re-identification remains. Importantly, de-identified information does not cease to be personal information. If an organization de-identifies personal information, it must consider the risk of an individual being identified and ensure such measures are proportionate to the purpose.
These new rules require organizations to implement appropriate measures when using de-identification. Bill C-36 also prohibits an organization from using de-identified personal information, alone or in combination with other information, to identify an individual except in specifically permitted circumstances.
Practical Takeaway: Businesses using data analytics, product improvement programs, research datasets, or AI tools will need to ensure compliance with these new rules.
- New Disposal Rights
Pursuant to section 54 of Bill C-36, individuals will gain a right to request that an organization dispose of their personal information. Where an organization disposes of personal information at an individual’s request, it must also inform its service providers and ensure that those service providers delete the information as well.
Practical Takeaway: Organizations must be prepared to receive disposal requests from individuals and should establish a process for receiving and acting on such requests. Companies should know exactly where personal information is stored to ensure complete deletion.
- New “Legitimate Interest” Pathway
Under section 18(3) of Bill C-36, organizations would have a new pathway for some collection, use, or disclosure without consent, based on “legitimate interests”. To rely on this pathway, an organization would need to identify and describe the legitimate interest, conduct a privacy impact assessment, address reasonably foreseeable adverse effects, and keep records available to the Privacy Commissioner.
Practical Takeaway: This is not a general exemption from consent. It is a documented, conditions-based route that requires analysis and recordkeeping before an organization can rely on it.
- Higher Penalties and Enforcement Risk
Under section 28 of PIPEDA, current offences are limited to specified knowing contraventions and obstruction with fines of up to $10,000 on summary conviction or $100,000 on indictment. Bill C-36, on the other hand, proposes to add administrative monetary penalties of up to the greater of $10 million and 3% of the organization’s gross global revenue for specified contraventions (section 114 of Bill C-36). Additionally, if a company knowingly contravenes certain obligations, fines could reach up to the greater of $25 million and 5% of the organization’s gross global revenue (section 145 of Bill C-36).
Practical Takeaway: For most organizations, especially those earning substantial annual revenue, privacy non-compliance will become a material enterprise risk.
Final Thoughts
While Bill C-36 must pass several more stages before it becomes law, businesses should not wait to make changes to their privacy policies. With the proposed higher penalties for non-compliance, the stakes have never been higher. Bill C-36 makes clear that privacy is not merely a reputational concern; it is a financial and operational one. Organizations that begin reviewing and strengthening their data practices now will be best positioned to comply when the new rules under PPCDA take effect.
If you have any questions about how Bill C-36 may affect your business, or if you would like assistance preparing for the proposed changes, please reach out to the author.
The author would like to acknowledge and thank summer student, Serena Vivekanand, for her contributions to this article.
The information contained in this article is intended to provide information and comment, in a general fashion, about recent developments in the law and related practice points of interest. The information and views expressed are not intended to provide legal advice. For specific legal advice, please contact us.