Bill C-36, the Protecting Privacy and Consumer Data Act

If enacted, C-36 would enact the Protecting Privacy and Consumer Data Act, repeal Part 1 of PIPEDA, rename the remainder the Electronic Documents Act, and replace the private-sector privacy regime with a standalone statute. Three differences from the failed C-27 matter for planning. AI regulation has been decoupled entirely (the Artificial Intelligence and Data Act is not carried forward, leaving Canada without a comprehensive federal AI statute). The bill frames privacy as a fundamental right rather than as a balance against commercial interests — a framing that shapes how its consent, de-identification, and enforcement provisions are read. And it is institutionally disruptive in a way C-27 was not: it would establish a Digital Safety and Data Protection Commission of Canada as the federal private-sector privacy regulator in place of the Office of the Privacy Commissioner, so an organization's Canadian supervisory counterparty would change, not just its obligations. Expect administrative monetary penalties well above PIPEDA's current (effectively nonexistent) fine exposure if it passes. Because the bill is live legislation, treat every specific in it as subject to amendment.