The Canadian government on June 15 introduced Bill C-36, the Protecting Privacy and Consumer Data Act, to replace PIPEDA — Canada’s private-sector privacy law dating to 1998 — with a framework that restricts surveillance pricing and expands consumer data rights. Artificial Intelligence and Digital Innovation Minister Evan Solomon said the bill would bar companies from using browsing history, location, device type, or purchasing behaviour to set individualised prices when harms outweigh benefits, though it stops short of an outright ban and explicitly protects loyalty programmes and promotional discounts. “Your personal information should not be used against you for price gouging,” Solomon told reporters. The bill creates a new Digital Safety and Data Protection Commission to oversee private-sector compliance, with fines up to C$10 million ($7.1 million) or 3% of global revenue for standard violations, rising to C$25 million or 5% of global revenue for the most serious offences. It also introduces GDPR-style consumer rights: the right to delete personal data, mandatory disclosure about automated decisions, and a higher care standard for children’s data.
A significant caveat: “surveillance pricing” does not appear in the bill’s text, and Solomon said the new commission would be asked to draft guidance on it once operational — leaving the practical scope of the restriction undefined at launch. A March Abacus Data poll of 1,931 Canadians found 52% favour an outright ban and 31% favour stricter regulation, placing the government’s approach closer to the minority view. The legislation arrives less than two weeks after Carney unveiled a C$2.3 billion national AI strategy and days after he warned at the G7 about systemic AI risks, suggesting Ottawa is trying to build a coherent framework spanning AI investment, data sovereignty, and consumer protection simultaneously. Canada’s previous modernisation attempt — Bill C-27’s Artificial Intelligence and Data Act — never cleared Parliament; if Bill C-36 meets the same fate, the country will continue operating under a privacy law written before smartphones existed.