Canada Unveils Sweeping Privacy Reform to Give Citizens Greater Control Over Personal Data

In a major move aimed at modernizing Canada’s digital privacy framework, the federal government has introduced a comprehensive bill designed to strengthen protections for personal information and give Canadians greater control over how their data is collected, used, and stored by private-sector organizations.

The proposed legislation, tabled in Parliament on Monday by Artificial Intelligence Minister Evan Solomon, marks the government’s latest effort to overhaul privacy rules that have remained largely unchanged for more than two decades.

Speaking after introducing the bill, Solomon said Canada’s existing privacy laws were created long before the rise of smartphones, artificial intelligence, and advanced digital technologies.

“Canadians live in a very different world today than they did 25 years ago,” Solomon said. “Our laws must evolve to ensure privacy rights are protected while still encouraging innovation and economic growth.”

One of the most significant features of the proposed legislation is the introduction of a stronger “right to privacy” framework. The bill would require businesses to obtain clear and informed consent before collecting, using, or sharing personal information.

Companies would also be required to explain their data practices in plain and understandable language, making it easier for consumers to know exactly how their information is being handled.

The legislation would further grant Canadians the right to request that companies delete their personal information if they believe it was collected improperly or if they withdraw consent for its use. Businesses would, however, be allowed to reject such requests in limited circumstances where deleting the information could cause significant harm to their operations.

Recognizing growing concerns about online privacy among younger users, the bill designates all children’s personal information as “sensitive data.” This classification would impose stricter rules on how companies collect, process, and share information belonging to minors.

Government officials say the measure is intended to provide stronger safeguards against misuse of children’s data in an increasingly digital environment.

Although the legislation does not specifically mention artificial intelligence or surveillance-based pricing practices, government officials confirmed that additional regulations would be introduced after the bill becomes law to address these emerging issues.

The government has expressed concern over the use of consumer data to charge different prices to different customers based on personal information or online behaviour. Solomon emphasized that while data can be used for legitimate purposes such as loyalty programs and customer rewards, it should not be exploited to unfairly increase prices.

He added that future guidance from regulators would clarify where the line should be drawn between beneficial business practices and harmful forms of data-driven pricing.

The bill also proposes the creation of a powerful new federal regulator responsible for overseeing both digital safety and private-sector data protection.

Under the plan, a new privacy and consumer data commissioner would operate within the broader digital safety commission that was proposed in the government’s recently introduced online harms legislation.

The regulator would have authority to launch investigations, issue compliance orders, and impose significant financial penalties on organizations found to have violated privacy laws.

Companies that fail to comply could face fines of up to $10 million or three per cent of their annual global revenue, whichever amount is higher.

Government officials argue that combining online safety and privacy oversight under a single organization would provide Canadians with a clearer and more efficient avenue for addressing

While privacy advocates have generally welcomed the proposed reforms, some experts have expressed concern over the decision to establish a brand-new regulatory body instead of expanding the powers of the existing Privacy Commissioner’s Office.

Florian Martin-Bariteau, a law professor at the University of Ottawa, described the creation of a new regulator as one of the most controversial aspects of the legislation.

According to Martin-Bariteau, Canada’s current privacy watchdog already possesses significant expertise and could potentially have been strengthened through additional powers and resources rather than replaced with a new institution.

Critics warn that building a new agency from scratch could take years before it becomes fully operational.

The legislation represents the Liberal government’s third effort to modernize Canada’s private-sector privacy laws after previous attempts in 2020 and 2023 failed to become law before Parliament was dissolved.

With Parliament scheduled to rise for its summer break later this week, the bill is unlikely to be passed before the fall session. Nevertheless, the government says the proposed reforms are a crucial step toward ensuring Canadians have stronger protections in an era increasingly shaped by artificial intelligence, digital platforms, and vast data collection practices.

If approved, the legislation would become one of the most significant privacy reforms in Canada in decades, fundamentally reshaping how businesses handle personal information and strengthening consumer rights across the country.