Bill C-36: An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts

Tabled in the House of Commons, August 19, 2026

Explanatory Note

Section 4.2 of the Department of Justice Act requires the Minister of Justice to prepare a Charter Statement for every government bill to help inform public and Parliamentary debate on government bills. One of the Minister of Justice’s most important responsibilities is to examine legislation for inconsistency with the Canadian Charter of Rights and Freedoms [“the Charter”]. By tabling a Charter Statement, the Minister is sharing some of the key considerations that informed the review of a bill for inconsistency with the Charter. A Statement identifies Charter rights and freedoms that may potentially be engaged by a bill and provides a brief explanation of the nature of any engagement, in light of the measures being proposed.

A Charter Statement also identifies potential justifications for any limits a bill may impose on Charter rights and freedoms. Section 1 of the Charter provides that rights and freedoms may be subject to reasonable limits if those limits are prescribed by law and demonstrably justified in a free and democratic society. This means that Parliament may enact laws that limit Charter rights and freedoms. The Charter will be violated only where a limit is not demonstrably justifiable in a free and democratic society.

A Charter Statement is intended to provide legal information to the public and Parliament on a bill’s potential effects on rights and freedoms that are neither trivial nor too speculative. It is not intended to be a comprehensive overview of all conceivable Charter considerations. Additional considerations relevant to the constitutionality of a bill may also arise in the course of Parliamentary study and amendment of a bill. A Statement is not a legal opinion on the constitutionality of a bill.

Charter Considerations

The Minister of Justice has examined Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, for any inconsistency with the Charter pursuant to his obligation under section 4.1 of the Department of Justice Act. This review involved consideration of the objectives and features of the bill. What follows is a non-exhaustive discussion of the ways in which Bill C-36 potentially engages the rights and freedoms guaranteed by the Charter. It is presented to assist in informing the public and Parliamentary debate on the bill.

Overview

The Personal Information Protection and Electronic Documents Act (PIPEDA) is the law that currently sets out rules for how private sector organizations may collect, use, and disclose personal information during commercial activities. Bill C-36 would repeal Part 1 of the PIPEDA and re-enact it as part of a new and updated law protecting personal information. The new law, to be known as the Protecting Privacy and Consumer Data Act (PPCDA), continues to support and promote digital commerce by establishing rules to govern the collection, use and disclosure of personal information in the course of commercial activities. Its rules will establish clear guardrails to protect Canadians’ personal information and the need of organizations to collect, use and disclose it for appropriate purposes.

Bill C‑36 would create a new institutional structure for administering and overseeing the Protecting Privacy and Consumer Data Act. The Digital Safety Commission of Canada proposed in Bill C-34, the Safe Social Media Act, would become the Digital Safety and Data Protection Commission of Canada (Commission). One of the members of the Commission will be designated as a new Privacy and Consumer Data Commissioner (Commissioner). The new Commissioner would be responsible for performing many of the roles currently performed by the Privacy Commissioner under PIPEDA, including complaint investigations and audits. The Commissioner would also assume new oversight functions such as issuing notices of contravention potentially containing reviewable penalties and orders. The broader Commission would perform a range of functions, including research, public education, the development of guidance materials, consultations and reviewing notices of contraventions issued by the Commissioner. The Bill also creates a new Privacy and Consumer Data Division (Division) to be comprised of the Commissioner and at least one other member of the Commission. The Division would be responsible for a range of other tasks, including approving codes of practice and certification programs and conducting dispute resolution. Certain decisions under the PPCDA, including penalties and orders that have been issued, may be appealed to the Federal Court.

Finally, Bill C-36 would streamline the remainder of the Personal Information Protection and Electronic Documents Act, which would become a separate law known as the Electronic Documents Act.

Search and Seizure (section 8 of the Charter)

Section 8 of the Charter protects against unreasonable searches and seizures. The purpose of section 8 is to protect individuals from an unreasonable intrusion into a reasonable expectation of privacy by the state. A search or seizure will be reasonable if it is authorized by law, the law itself is reasonable (in the sense of striking an appropriate balance between privacy interests and the state interest being advanced), and the search is carried out in a reasonable manner.

The Protecting Privacy and Consumer Data Act has the potential to impact rights under section 8 of the Charter because the powers of the Commission and Commissioner and certain provisions allowing government institutions access to personal information may implicate information subject to a reasonable expectation of privacy.

First, the Protecting Privacy and Consumer Data Act would re-enact and add to PIPEDA’s existing investigation and audit powers. These powers, including the authority to compel the production of records and enter private places, other than dwelling-houses, to examine records and to talk with individuals in the place entered, would be extended to the Commissioner’s investigation functions and the Commission’s review function. The PPCDA also provides for the sharing of information with certain other federal regulatory bodies, provincial counterparts, and foreign states if various conditions and safeguards are met.

The following considerations support the consistency of these investigative, audit, review and information-sharing powers with section 8. Where information is subject to a reasonable expectation of privacy, the legal authority to access and share the information would be clearly set out in the Protecting Privacy and Consumer Data Act. This legal authority supports the objectives of the PPCDA through tailored powers similar to those found in other regulatory contexts and subject to similar restrictions governing their use.

Second, the Protecting Privacy and Consumer Data Act may implicate rights under section 8 by re-enacting a range of existing provisions in the Personal Information Protection and Electronic Documents Act that allow organizations to disclose an individual’s personal information to a government institution without their knowledge or consent in certain circumstances. For example, the PPCDA would re-enact a provision allowing an organization to disclose personal information without the knowledge or consent of the individual if a government institution has made a request for the information, identified its lawful authority to obtain the information and indicated that it suspects the information relates to national security. In addition, it would re-enact related provisions allowing an organization to collect personal information for the purposes of certain disclosures to government institutions, such as in the situation described above or where a disclosure is required by law. Existing rules that may limit the information an organization is allowed to provide to an individual about these disclosures would be kept in the bill. In each case, the rules that applied under the Personal Information Protection and Electronic Documents Act would remain the same under the Protecting Privacy and Consumer Data Act.

In the case of re-enacted provisions allowing organizations to disclose personal information to a government institution in certain prescribed circumstances, consistency with section 8 is supported by the following considerations. The focus of the measures is on ensuring the Protecting Privacy and Consumer Data Act does not prevent an organization from disclosing information where a disclosure is authorized by another source of legal authority, such as another law, a warrant, or a subpoena, which allows the government to collect the information. The re-enacted provisions also permit an organization to disclose personal information to a government institution when the disclosure is at the initiative of a private sector organization, made voluntarily by the organization, and the relevant statutory requirements have been met. These provisions apply in only limited and specific circumstances where the disclosure is in the public interest. To limit impacts on privacy interests, a broad range of transparency, accountability, and oversight provisions exist under other measures and the broader legal context governing public institutions. For example, the Privacy Act and other specialized legal regimes impose rules and safeguards that apply to government institutions collecting personal information; the Privacy Commissioner has broad powers to oversee these institutions’ compliance with the Privacy Act and the PPCDA contains a range of oversight mechanisms to secure organizations’ compliance with its requirements. In addition, information about these disclosures to government institutions may be shared with the individual affected when it would not compromise sensitive government operations.

Similar considerations support consistency with section 8 in relation to provisions permitting organizations to collect personal information without an individual’s knowledge or consent for the purposes of specific disclosures to government institutions. Like the disclosure measures discussed above, these collection provisions enable organizations to respond to government requests for information where government access to the information is authorized by another source of legal authority, like another law, a warrant or a subpoena. They also support the collection of personal information for voluntary disclosures at the initiative of private sector organizations. Collection of personal information without an individual’s knowledge or consent for this purpose is permitted only in limited situations of significant public importance, such as where the information potentially implicates national security, the defence of Canada or the conduct of international affairs or where a disclosure of information is required by law.

Freedom of Expression (section 2(b) of the Charter)

Section 2(b) of the Charter protects freedom of thought, belief, opinion and expression. Section 2(b) has been interpreted broadly to encompass any activity or communication, aside from violence or threats of violence, which conveys or attempts to convey meaning. It protects the rights of those seeking to exercise expressive freedoms and those who would receive this expression.

Restrictions on the collection, use, and disclosure of personal information in the Protecting Privacy and Consumer Data Act could impact regulated organizations’ commercial expressive activities where these activities would involve a collection, use, or disclosure of personal information that is restricted or prohibited under the Act.

To the extent the Protecting Privacy and Consumer Data Act would interfere with protected commercial expression, consistency with the Charter is supported by the following considerations. The PPCDA applies only to personal information. It advances the important regulatory purpose of protecting personal information in accordance with individuals’ privacy rights and organizations’ legitimate needs. It balances individuals’ interests in the protection of their personal information with organizations’ needs. It is consent-based and recognizes a range of other circumstances in which personal information may be legitimately used for commercial purposes. The provisions of the Protecting Privacy and Consumer Data Act may be viewed as proportionate to the objectives of supporting and promoting commerce and the right of privacy of individuals through the protection of personal information.

Open court principle (section 2(b) of the Charter)

The open court principle receives protection under section 2(b) of the Charter. Under the open court principle, court and tribunal proceedings are presumptively open to both the public and the media.

The Protecting Privacy and Consumer Data Act maintains the general confidentiality of information generated in the course of the administration of the Act with some exceptions. These exceptions include disclosing information during various proceedings, including any appeals to the Federal Court under the PPCDA. The PPCDA also provides that when the Commission elects to conduct a hearing in the course of its review function, all or part of the hearing may be held in private.

The following considerations support the consistency with the Charter of provisions in the Protecting Privacy and Consumer Data Act that could limit the openness of any proceedings under the PPCDA that may implicate the open courts principle. The PPCDA aims to protect individuals’ privacy but allows for the disclosure of any information in the public interest. The Commission has discretion over the openness of its hearings. This discretion, which must be exercised in accordance with the Charter, allows a proper balance to be struck between openness and any competing considerations such as privacy. The PPCDA does not contain any provisions that would limit the openness of related court proceedings.

Offence Rights (section 11 of the Charter)

Section 11 of the Charter guarantees certain rights to persons who have been charged with an offence, including the right to a fair and public hearing before an independent and impartial adjudicator. Its protections apply only to persons “charged with an offence”. For the purposes of section 11, this occurs when a person is subject either to proceedings that are criminal in nature, or that result in “true penal consequences”. True penal consequences include imprisonment and fines with a punitive purpose or effect, such as when a fine or penalty is out of proportion to the amount required to achieve regulatory purposes.

The Protecting Privacy and Consumer Data Act would authorize the imposition of an administrative monetary penalty on an organization that has contravened certain provisions of the Act. It would keep existing offences for when organizations knowingly contravene specific obligations they have under the Act. The offence of obstructing the investigation of a complaint or the conduct of an audit would be extended to the Commission’s review function. The PPCDA would also create new offences for re-identifying personal information that has been de-identified, subject to specified exceptions such as for security testing, and for contravening orders issued by the Commission following its review of a matter. These offences would be punishable by fine.

The following considerations support the consistency of the administrative monetary penalty and offence provisions in the Protecting Privacy and Consumer Data Act with section 11.

The proposed administrative monetary penalty provisions would not involve criminal charges, prosecution, or sentencing. The Protecting Privacy and Consumer Data Act would expressly provide that the purpose of administrative monetary penalties is to promote compliance with the legislative regime, not punish. Under the PPDCA, administrative monetary penalties would be subject to a legislated cap with no mandatory minimum fine. There is discretion to propose, determine and impose administrative monetary penalties. The exercise of this discretion would be governed by statutory criteria.

The proposed offence provisions under the Protecting Privacy and Consumer Data Act would provide for criminal charges, prosecution, and sentencing that could engage rights under section 11 of the Charter. In reviewing the relevant measures, no potential inconsistencies between the offence provisions and rights under section 11 have been identified.