Canada’s private sector privacy law is more than 25 years old and there is broad consensus that a modernization is long overdue. Bill C-36, tabled on Monday, is the government’s third attempt at updating the law, following the failed efforts with Bill C-11 in 2020 and Bill C-27 in 2022. My first post on the new bill focused on what I think remains both the most important development and the biggest mistake: the decision to push the Privacy Commissioner of Canada out of private-sector privacy and to place the file with an overloaded digital safety commission. For years, privacy critics have argued that, given the absence of order-making powers or serious penalties, Canada’s biggest shortcoming has been weak enforcement. Yet just as the government adds much-needed new rights and penalties to the privacy law framework, it undermines enforcement once again by introducing a new regulator that will take years to establish. The consequence is that, rather than updating the law for 2027, it is updating it for 2030 or later.
Articles by: Michael Geist
Gary Anandasangaree’s Vic Toews Moment Shows the Government Has Lost Its Way on Lawful Access
As the government prepares to shut down debate on lawful access and push Bill C-22 through committee without even discussing or debating dozens of potential amendments, Public Safety Minister Gary Anandasangaree’s responded by saying it was time for opposition parties to “choose” whether to stand with law enforcement and victims of crime. The response was telling as it evoked a similar response to another lawful access debate in 2012. At that time, the Conservatives were in power and Vic Toews was the Public Safety Minister. Toews infamously had the following exchange with Liberal MP Francis Scarpaleggia, who is now the Speaker of the House.
Government Moves to Shut Down Lawful Access Hearing In Order To Fast Track Passing the Bill This Week
The government is planning to shut down hearings into Bill C-22, the lawful access bill, with no further debate or discussion on potential amendments to the bill. It has just placed a motion on the Order Paper that would limit today’s committee meeting to only 30 minutes for standard clause-by-clause review. After that, it plans to cancel all further debate or discussion on any other amendments. The committee will instead be required to vote on all remaining amendments with no further debate, discussions or questions to officials. In fact, the substance of the amendments will remain secret and will not even be disclosed to the public. The government’s intent is clearly to complete clause-by-clause review tonight to ensure that the bill passes through the House of Commons by the end of the week
Yesterday, the government introduced privacy reforms that shuts down the Privacy Commissioner of Canada’s role in private sector privacy regulation. Today, it is shutting down hearings into one of the biggest privacy threats in years. Public Safety Minister Gary Anandasangaree had committed to amendments during the lawful access hearings, but this move means that only secret government amendments that will not be made public during the hearing will pass. Opposition parties have submitted many amendments based on testimony from the Privacy Commissioner, bar associations, security companies, and privacy experts. These include potential changes to the rules on mandatory metadata retention, risks to security and encryption, and privacy safeguards. All of these amendments will not even be made public, much less open to debate and discussion. Weeks of hearings and public concern tossed aside by the government in a rush to shut down debate and consideration of amendments to a deeply flawed, risky legislative plan.
Canada’s Digital Super-Regulator: Bill C-36 Pushes Out the Privacy Commissioner and Hands Private Sector Privacy to an Overloaded Commission
In the last act of an incredibly intense digital policy stretch, the government today tabled new private sector privacy legislation in the form of Bill C-36, the Protecting Privacy and Consumer Data Act. It is a big bill, and my initial take will be divided into two: this post will focus on the seismic shift the bill creates for privacy administration and enforcement, and a second post (hopefully tomorrow) will discuss the substantive changes and additions. I start with the enforcement side because the most consequential feature of C-36 is the question of who will administer the rules. The bill firmly cements the Digital Safety Commission as a new digital super-regulator in Canada, stripping the Privacy Commissioner of authority over private sector privacy law and handing it instead to the same five-member commission the government created a few days ago to police online harms. I believe the approach is unprecedented among peer countries and will have negative repercussions for Canada’s standing in the privacy world. Indeed, removing an Agent of Parliament from private-sector privacy enforcement after decades isn’t something you tuck into a lengthy bill, but rather requires extended public consultation and analysis on how best to ensure Canada has effective privacy enforcement. This is a stunning abrogation of good policy development and a poorly conceived vision of the breadth and importance of privacy.
The Commission: How Bill C-34 Creates an Internet Super-Regulator That Will Touch the Lives of Millions of Canadians
The proposed kids’ social media ban is capturing the headlines, but lost in the debate over Bill C-34 is that its most consequential element may be the creation and powers of the government agency the bill establishes to oversee the entire system. The Digital Safety Commission of Canada will be a super-regulator of the Internet, with greater influence over the daily lives of Canadians than perhaps any other regulator in the country. The breadth of its influence can’t be overstated: it will set the standards that millions of Canadians must satisfy to verify their age in order to use social media services. It will establish what platforms must do about harmful content, including the removal of certain material. It will determine whether the age-gating requirement may be lifted for any given service. It will both regulate the platforms and advocate for their users, dual roles that raise obvious fairness concerns. And it will exercise investigative and adjudicative powers, complete with penalties, hearings, and formal, law-enforcement-style investigations. Yet despite all those powers, it will not be bound by the rules of evidence, will be free to conduct its hearings in secret, and, at least in the beginning, will be capable of operating as a one-person body in which the Commission and its Chair are one and the same individual. The full scope of the new powers is illustrated in the infographic below.
Recent Posts
One Step Forward, Two Steps Back: Bill C-36 Modernizes Canada’s Privacy Law, Then Delays It to 2030 
Gary Anandasangaree’s Vic Toews Moment Shows the Government Has Lost Its Way on Lawful Access 
Government Moves to Shut Down Lawful Access Hearing In Order To Fast Track Passing the Bill This Week 
Canada’s Digital Super-Regulator: Bill C-36 Pushes Out the Privacy Commissioner and Hands Private Sector Privacy to an Overloaded Commission 
The Commission: How Bill C-34 Creates an Internet Super-Regulator That Will Touch the Lives of Millions of Canadians
