Canada’s Bill C-36 Creates New Privacy Commission to Replace Privacy Commissioner
Bill C-36 creates the Digital Safety and Data Protection Commission replacing the Privacy Commissioner for private sector oversight.
Why it matters: Privacy teams, legal counsel, and compliance officers in regulated industries must prepare for a centralized regulator with stronger enforcement powers and higher penalties. The changes impact sectors handling sensitive personal data, especially children's information, and companies subject to provincial or federal privacy rules.
- Bill C-36, introduced June 15, 2026, establishes the Digital Safety and Data Protection Commission, replacing the Privacy Commissioner for private sector privacy oversight (sourced from <a href="https://gowlingwlg.com/en-ca/insights-resources/articles/2026/ottawa-tables-long-awaited-federal-privacy-reform-legislation" target="_blank" rel="noopener">Gowling WLG</a> and <a href="https://www.canada.ca/en/innovation-science-economic-development/news/2026/06/government-of-canada-tables-protecting-privacy-and-consumer-data-act-to-modernize-privacy-laws.html" target="_blank" rel="noopener">Canadian government</a>).
- Maximum fines for violations rise to $10 million or 3% of worldwide gross revenue, significantly increasing penalties (Bill C-36 sections on penalties).
- Children’s personal data is classified as sensitive with enhanced protections reflecting growing concerns about data safety for minors.
- Part 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA) is repealed, transforming it into the Electronic Documents Act and shifting privacy provisions under the new framework.
On June 15, 2026, the Honourable Evan Solomon, Minister of Artificial Intelligence and Digital Innovation, introduced Bill C-36, the Protecting Privacy and Consumer Data Act, in Canada’s House of Commons. This legislation establishes the Digital Safety and Data Protection Commission of Canada, which will replace the Office of the Privacy Commissioner of Canada as the principal regulator for privacy matters in the private sector.
Minister Solomon stated in the official government announcement, “The moment is here for reform, positioning privacy protection as foundational to responsible AI innovation and public trust.” While the bill does not include AI-specific regulation, it forms part of a broader modernization agenda including Bill C-27, the proposed AI and Data Act, which is aimed specifically at AI governance.
Bill C-36 marks a significant structural shift in Canadian privacy law by repealing Part 1 of PIPEDA and creating a dedicated privacy regulator with expanded powers. The Digital Safety and Data Protection Commission will be empowered to impose administrative monetary penalties (AMPs), a form of financial penalty authorized by the Governor in Council, capped at $10 million or 3% of gross global revenue for serious offenses.
Children’s personal data receives enhanced protections under the bill, reflecting intensified policy focus on safeguarding minors’ privacy in the digital economy.
The bill also retains the “substantially similar” exemption within federal privacy law, which allows the Governor in Council (the federal Cabinet) to exempt entities already subject to comparable provincial privacy rules, avoiding regulatory duplication.
Bill C-36 complements Bill C-34, the Safe Social Media Act. Together they streamline digital safety and privacy enforcement through the new Commission, with Bill C-34 addressing platform accountability and harmful content online, imposing penalties up to 5% of gross global revenue.
Legal teams, compliance officers, and technology companies should begin assessing the impact of these reforms on internal policies, data governance, and cross-border data flows.
By the numbers:
- $10 million or 3% of global revenue — maximum fine under Bill C-36 for serious privacy breaches
- June 15, 2026 — date Bill C-36 was introduced in the House of Commons
- 5% of gross global revenue — maximum penalty proposed under Bill C-34 for harmful social media content
Yes, but: While Bill C-36 centralizes privacy enforcement and raises penalties, it does not address AI-specific regulations directly, which remain under Bill C-27 that is still pending.
What's next: Bill C-36 will proceed through parliamentary readings, committee review, and possible amendments before becoming law; timelines for these stages are not yet specified.