On 15 June 2026, the Government of Canada introduced Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act (PPCDA), in the House of Commons on first reading. The bill is Canada's third federal attempt to replace Part 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA), following the failed Bill C-11 (2020) and Bill C-27 (2022). The Minister of Artificial Intelligence and Digital Innovation tabled the bill, which codifies privacy as a fundamental right in federal legislation for the first time.
The PPCDA would transfer private-sector privacy complaint handling and enforcement from the Office of the Privacy Commissioner to a new Digital Safety and Data Protection Commission of Canada. Administrative monetary penalties would be set at up to CAD 10 million or 3% of global annual revenue (whichever is greater) for standard violations, and up to CAD 25 million or 5% of global annual revenue for the most serious offences. Organizations must obtain meaningful and specific consent for personal data processing. Consumers gain an explicit right to request deletion of their personal information, covering AI-generated deepfakes created using their likeness.
Organizations that collect, use, or disclose personal information of Canadian users must review consent mechanisms, data retention schedules, and technical deletion capabilities before the PPCDA comes into force. Businesses processing children's data must adopt age-appropriate design standards and additional safeguards. AI developers and deployers whose systems generate synthetic personal information, including deepfake audio or video using an identified individual's likeness, face specific deletion obligations on request.
Bill C-36 has yet to pass second reading; the timeline for Royal Assent and the Act's in-force dates remain undetermined. Several PPCDA provisions overlap with Quebec's Act respecting the protection of personal information in the private sector (Law 25), which has been in force since September 2023, creating potential dual-compliance obligations for organizations operating across Canadian provinces. Alignment between the new Commission and the existing Office of the Privacy Commissioner mandate in the public-sector context will require further clarification as the bill progresses.
Licentium advises technology companies and multinational businesses on Canadian and international privacy law compliance. Organizations preparing for Bill C-36 are invited to contact us. Work we undertake includes PIPEDA-to-PPCDA gap analysis, consent mechanism design, AI governance reviews, children's data compliance programmes, and multi-jurisdictional Canadian privacy structuring.