CANADA Trends and Developments Contributed by: Brent Arnold, Carole Piovesan, Tamara Adler, Michael Pascu and Dilan Brar, INQ Law
ment’s Bill C-36, which aims to strengthen privacy requirements in several key areas, namely the dis - closure or transfer of personal information outside of Canada. Organisations will be required to carry out PIAs and implement measures to mitigate any risks they identify. This is a step-up from the accountability principle in PIPEDA, which essentially only required ensuring foreign service providers offered a compa - rable level of protection. Businesses will need to be diligent about mapping their data flows to determine if personal information is leaving the country, which would trigger their obliga - tion to conduct a PIA. Bill C-36 significantly increases the consequences of non-compliance with privacy obligations, creating actual penalties for non-compliance. While the inter - national data transfer provisions are excluded from the penalty structure, Bill C-36 still requires organisations to protect personal information, including against privacy risks from transferring personal information to a service provider. This likely includes risks from cross-border data transfer to service providers, and contravention of that provision is within the scope of the penalty-issuing powers. Practical Implications for Businesses Operating in the Digital Economy Canada’s regulatory environment for AI and data pro - tection has changed materially in the past 18 months. Businesses operating in the Canadian digital economy face a more demanding compliance posture than at any prior point under PIPEDA, driven by new federal legislation, active privacy enforcement, provincial reform, and tightening constraints on cross-border data flows. Compliance programmes built to the pre- 2024 federal standard are already inadequate. A fragmented jurisdiction requires jurisdiction- specific analysis The compliance landscape governing AI and personal data in Canada is fragmenting rather than converging towards a single framework. Businesses will need to comply with different privacy regimes offering different rights and imposing different obligations.
At the federal level, Bill C-36 proposes the Protecting Privacy and Consumer Data Act (PPCDA) to replace PIPEDA. The proposed legislation recognises privacy as a fundamental right, shifts the default to express consent, conditions any legitimate interest exception on a documented PIA, introduces a private right of action, and introduces rights to deletion and explana - tion of automated decisions. Enforcement would pass to a new Digital Safety and Data Protection Commis - sion of Canada, with penalties up to CAD25 million or 5% of global revenues. Quebec’s Law 25, already in force since September 2024, applies to any organisation collecting or using the personal information of Quebec residents regard - less of where the organisation is incorporated. It requires documented PIAs before deploying any tech - nology involving personal information, designation of a person responsible for personal information protec - tion, and a privacy-by-default governance framework, with penalties reaching the greater of CAD25 million or 4% of worldwide revenues. Alberta, British Columbia and Ontario are each con - ducting parallel statutory reviews. Until those process - es are resolved, national-level generalisations are an unreliable basis for compliance planning. Existing law already governs AI Previous assumptions that AI governance obligations would crystallise only upon passage of dedicated AI legislation have been discredited by privacy regulators seeking to enforce existing privacy regimes. The joint Office of the Privacy Commissioner of Canada (OPC) investigation into OpenAI’s ChatGPT, (findings pub - lished 6 May 2026), concluded that ChatGPT’s initial training violated Canadian privacy law through over- collection, invalid consent, and inadequate individual redress. The volume of OPC complaints doubled year- on-year to 3,044 filings, and breach reports affected more than 20 million Canadians in the same period. The federal Voluntary Code of Conduct on Responsi - ble Generative AI, though not yet enforceable, is being used by the OPC as a reference standard in complaint proceedings. PIAs, data minimisation analyses, valid consent archi - tecture, human oversight protocols, and processor
158 CHAMBERS.COM
Powered by FlippingBook