TL;DR
Canada Bill C-36 would replace PIPEDA, restrict surveillance prices and create a regulator that can fine companies up to C$25 million or 5% of revenue.
The Canadian government introduced legislation on Monday reform the country’s private sector privacy laws, including new restrictions on companies that use personal data to charge higher prices to individual consumers. Bill C-36, the Consumer Privacy and Data Protection Act, would replace the Personal Information and Electronic Documents Protection Act, a law first enacted in 1998 that has been widely criticized for being outdated in the era of algorithmic pricing and large-scale data collection.
Minister of Artificial Intelligence and Digital Innovation Evan Solomon said the bill targets so-called surveillance pricing, the practice of using a consumer’s browsing history, location, device type or purchasing behavior to set individualized prices. “Companies should not be able to use your behavior, location, profile, vulnerabilities, or personal information to charge unfair prices.“Solomon told reporters.”Your personal information should not be used against you to increase prices.“
The bill does not completely prohibit surveillance price fixing. Solomon said the legislation aims to prohibit the use of data to target consumers with individualized prices when the harms outweigh the benefits, but the government does not want to prevent companies from rewarding consumers with better prices through loyalty programs or promotional discounts. According to BetaKit, the price of surveillance is not specifically mentioned in the text of the bill, and Solomon will ask the new regulator to draft guidance on the issue once it is operational.
The 💜 of EU technology
The latest rumors from the EU tech scene, a story from our wise founder Boris and some questionable AI art. It’s free, every week, in your inbox. Sign up now!
That regulatory gap is significant. The bill creates a new body called the Data Protection and Digital Safety Commission to oversee compliance with both privacy legislation and the proposed Digital Safety Act, which aims to protect children online. The Office of the Privacy Commissioner of Canada would retain responsibility for overseeing government compliance with federal privacy laws, but the new commission would look after the private sector.
The sanctions are substantial on paper. The commission could impose fines of up to C$10 million ($7.1 million) or 3% of global revenue, whichever is greater, for non-compliance. More serious offenses could face fines of up to 25 million Canadian dollars or 5% of global revenue. The application of those sanctions will depend on whether the bill is approved by Parliament and how aggressively the commission interprets its mandate.
Beyond price surveillance, the bill introduces several consumer protections that bring Canada closer to the European Union’s General Data Protection Regulation. Canadians would gain the right to have their personal information deleted in certain circumstances. Organizations would be required to disclose more information about automated decisions that affect consumers. Children’s data would be classified as sensitive and would require a higher level of care from any company collecting it.
Canada does not move forward in isolation. Manitoba’s provincial government introduced Bill 49 in March, which would prohibit retailers from using personal data to raise prices for individual consumers, both online and in stores. In the United States, Maryland became the first state to enact a ban on price surveillance when Governor Wes Moore signed HB 895, which prohibits food retailers with locations larger than 15,000 square feet and third-party delivery services from using personal data to raise prices on individual shoppers. That law will go into effect on October 1.
Public opinion in Canada is strongly in favor of the action. An Abacus Data poll conducted in early March surveyed 1,931 Canadians and found that 52% said surveillance pricing should be banned entirely, while 31% said it should be allowed but more strictly regulated. The bill’s approach, which restricts rather than prohibits, places the government closer to minority opinion, although Carney’s broader $2.3 billion national AI strategy He had already signaled that new privacy legislation was coming without specifying how far it would go.
Privacy Bill Arrives Less Than Two Weeks After AI Strategy Launched and Days After Carney warned at the G7 about the systemic risks of dependence on AI. The timing suggests that the government is attempting to build a coherent regulatory framework that encompasses AI investment, data sovereignty and consumer protection simultaneously. Whether those pieces fit or contradict each other, spending $2.3 billion to accelerate AI adoption while restricting how AI-powered pricing can use consumer data will depend on the details the new commission ultimately produces.
The bill must still be approved by Parliament. Canada’s previous attempt to modernize its privacy framework, the Data and Artificial Intelligence Act within Bill C-27, never made it through the legislative process and has not been revived. If Bill C-36 suffers the same fate, the country will still operate under a privacy law written before smartphones existed, while Other jurisdictions move forward with law enforcement of their own digital protection regimes.
