Bill C-36's proposals aren't entirely new
Much of Bill C-36 is built from Bill C-27, the last Parliament's privacy reform bill, which died on the order paper when Parliament prorogued in early 2025.4 Nearly 4,000 people already contacted their MPs demanding stronger privacy protections when that bill was on the table.5
C-36 revives those modest reforms with tighter language, but this time adds a serious new problem: it strips independent enforcement power from the Privacy Commissioner of Canada.6 Privacy reform that was already overdue now risks doing more harm than good.
What Bill C-36 gets right — and wrong
âś… Bill C-36 recognizes privacy as a fundamental right; strengthens Canadians' consent and deletion rights; and will give whomever is in charge of privacy significantly higher fine-making power that could be used to penalize violations of our privacy. These are the kind of reforms privacy advocates and our community have called for over many years.
⚠️ But there’s an enormous catch: the bill also removes the Privacy Commissioner of Canada's authority over private-sector privacy enforcement. Instead, that power goes to a single member of a new "Digital Safety Commission," a body that reports to Cabinet and AI Minister Evan Solomon — the same Minister leading Canada’s AI adoption strategy, and who says Canada shouldn’t “over-index” on regulating new technologies.
Stronger rights on paper mean little if enforcement answers to political priorities rather than an independent privacy watchdog. That's the core problem with C-36.
The worst part of Bill C-36 is in the fine print
There’s good reason to be worried about how that new management will defend — or fail to defend — our privacy. Section 77 of Bill C-36 explicitly requires the new Digital Safety Commission to weigh a list of competing priorities — including trade agreements, "general public interest," and "the importance of supporting economic growth, competition, and innovation" — before opening privacy investigations or taking enforcement action.7
In practice, this means the body that's supposed to protect your privacy must first consider whether doing so might get in the way of business interests; if it does, they’ll face pressure to let it slide. That's a significant departure from independent, rights-based enforcement.
What real reform looks like
Independent privacy enforcement is the international norm, not the exception. Under the EU's General Data Protection Regulation, member states are legally required to maintain independent supervisory authorities that must act free from external influence and cannot take instructions from any outside body — including their own government.8
Countries like France, Germany, and Ireland each maintain their own independent data protection authority that answers to no single minister.9
Privacy enforcement in Canada has been weak because the powers and penalties we grant our Privacy Commissioner were weak, not because of the quality of their work, which is internationally respected. Canada should be fixing privacy by pairing the strong independent regulator we already have with the strong enforcement powers of our peers — not requiring it to balance our privacy rights against a minister's economic agenda.
Why your voice matters now
In the age of AI, privacy reform is more urgent than ever. Companies that violate your privacy rights routinely face no meaningful financial consequences in Canada to this day. Bill C-36 will update privacy protections Canadians need; but that won’t matter if we pair it with deep erosion of independent oversight and enforcement.
When the House returns in the fall, it will begin committee study of Bill C-36, and decide how to change Bill C-36 before it is passed. If enough of us stand up and defend the Privacy Commissioner in the next few weeks, we can win reformed privacy laws AND a regulator who wants to use them. Tell your MP to fix Bill C-36 before it's too late!