Blog
Canada’s Digital Super-Regulator: Bill C-36 Pushes Out the Privacy Commissioner and Hands Private Sector Privacy to an Overloaded Commission
In the last act of an incredibly intense digital policy stretch, the government today tabled new private sector privacy legislation in the form of Bill C-36, the Protecting Privacy and Consumer Data Act. It is a big bill, and my initial take will be divided into two: this post will focus on the seismic shift the bill creates for privacy administration and enforcement, and a second post (hopefully tomorrow) will discuss the substantive changes and additions. I start with the enforcement side because the most consequential feature of C-36 is the question of who will administer the rules. The bill firmly cements the Digital Safety Commission as a new digital super-regulator in Canada, stripping the Privacy Commissioner of authority over private sector privacy law and handing it instead to the same five-member commission the government created a few days ago to police online harms. I believe the approach is unprecedented among peer countries and will have negative repercussions for Canada’s standing in the privacy world. Indeed, removing an Agent of Parliament from private-sector privacy enforcement after decades isn’t something you tuck into a lengthy bill, but rather requires extended public consultation and analysis on how best to ensure Canada has effective privacy enforcement. This is a stunning abrogation of good policy development and a poorly conceived vision of the breadth and importance of privacy.
The Commission: How Bill C-34 Creates an Internet Super-Regulator That Will Touch the Lives of Millions of Canadians
The proposed kids’ social media ban is capturing the headlines, but lost in the debate over Bill C-34 is that its most consequential element may be the creation and powers of the government agency the bill establishes to oversee the entire system. The Digital Safety Commission of Canada will be a super-regulator of the Internet, with greater influence over the daily lives of Canadians than perhaps any other regulator in the country. The breadth of its influence can’t be overstated: it will set the standards that millions of Canadians must satisfy to verify their age in order to use social media services. It will establish what platforms must do about harmful content, including the removal of certain material. It will determine whether the age-gating requirement may be lifted for any given service. It will both regulate the platforms and advocate for their users, dual roles that raise obvious fairness concerns. And it will exercise investigative and adjudicative powers, complete with penalties, hearings, and formal, law-enforcement-style investigations. Yet despite all those powers, it will not be bound by the rules of evidence, will be free to conduct its hearings in secret, and, at least in the beginning, will be capable of operating as a one-person body in which the Commission and its Chair are one and the same individual. The full scope of the new powers is illustrated in the infographic below.
Privacy as a Fundamental Right? The Government’s Terrible Privacy Track Record Suggests Virtue Signalling Over a Genuine Commitment
The government is set to introduce its long-promised privacy reform legislation early this week, with the recognition of a fundamental right to privacy expected to serve as a foundational element of the bill. Establishing privacy as a fundamental right would be a welcome and long-overdue development, one that many have called for and that was set to be added to Bill C-27, the prior attempt at privacy reform. Yet the framing is difficult to square with the government’s actual record on privacy, which over the past year has involved a steady stream of privacy-invasive measures that leave the fundamental rights rhetoric feeling more like virtue signalling than a genuine commitment. Simply put, the government cannot credibly claim to treat privacy as a fundamental right while actively undermining that right through a series of other bills and efforts to sideline the Privacy Commissioner of Canada.
Taking Stock of Bill C-34: Five Things to Know About the Government’s Plan for a Kids’ Social Media Ban, Mandated Age Verification, and AI Chatbot Rules
This past week in digital policy was dominated by Bill C-34, the Safe Social Media Act, which includes platform regulation, an under-16 social media ban backed by mandated age verification, a new AI chatbot regulatory regime, and the creation of a powerful Digital Safety Commission. I have posted daily on the bill, including my initial review, an examination of the 50 key decisions the bill leaves for later, and a closer look at the government’s fast-track implementation plan, alongside a FAQ and posts on mandated ID and trade risks that I published just before the bill was tabled. For those coming to the issue fresh, this post draws on the week’s posts by taking stock of where things stand.
The Exemption Illusion: Why the Government’s Plan to Fast Track Bill C-34’s Kids’ Social Media Ban Means No Standards, No Privacy Review, and No Enforcement
One of the most heavily promoted features of Bill C-34, the government’s Safe Social Media Act, is that its social media ban for those under 16 comes with a potential exemption for platforms that satisfy the new Digital Safety Commission that they provide adequate safeguards for children. But based on comments from government officials, it appears the exemption is an illusion, at least for years to come. The legislation carefully sets out how the ban is supposed to work, but officials at a technical briefing on the bill this week described a very different plan that involves moving quickly after Royal Assent with regulations to bring the ban into force without waiting for the Digital Safety Commission to be fully operational. No Commission means no age verification standards, no privacy review, no exemption, and no effective enforcement. It also creates huge risks since the initial start of the ban is when tens of millions of Canadians would be required to verify their age, yet the government is sidelining the privacy protections written into its own bill and essentially conceding that the ban is unlikely to carry any real consequences for those services that fail to comply when it first takes effect.
Recent Posts
Canada’s Digital Super-Regulator: Bill C-36 Pushes Out the Privacy Commissioner and Hands Private Sector Privacy to an Overloaded Commission 
The Commission: How Bill C-34 Creates an Internet Super-Regulator That Will Touch the Lives of Millions of Canadians 
The Law Bytes Podcast, Episode 272: Build Canada’s Lucy Hargreaves on Canada’s AI Strategy and the Need to Shift From Being Users to Builders 
Privacy as a Fundamental Right? The Government’s Terrible Privacy Track Record Suggests Virtue Signalling Over a Genuine Commitment 
Taking Stock of Bill C-34: Five Things to Know About the Government’s Plan for a Kids’ Social Media Ban, Mandated Age Verification, and AI Chatbot Rules
