Privacy Law Reform
Issue at a Glance
Canada is facing the most significant changes to its private sector privacy laws in decades. In November 2020, the federal government introduced a bill to usher in a new Canadian privacy law. Bill C-11 establishes a new Consumer Privacy Protection Act (CPPA) to replace the current law governing privacy in the private sector (known as the Personal Information Protection and Electronics Documents Act (PIPEDA) and described below), as well as a new Personal Information and Data Protection Tribunal.
More legislative reform is on the horizon as three provincial governments (Quebec, British Columbia and Ontario) embark on introducing or modernizing their private sector privacy laws.
The CMA, in consultation with our Privacy and Data Committee, is engaged with governments at all levels on important issues related to privacy law reform. On this page, you can find more information about changes to the law, and the CMA’s advocacy initiatives.
For information on privacy compliance and best practices, including our guides and resources for the marketing community, please see our Privacy Protection webpage.
- Canada introduces new privacy legislation. Here is what marketers need to know
- CMA Advocacy in Action: 2020 year in review
- CMA elevates marketing's voice on data privacy
- Privacy Update - Provincial privacy law reform, final CCPA regulations and more
- Government Releases Digital Charter, announces review of PIPEDA and more
- OPC Concludes Review of Third-Party Data Consent Rules: Status Quo to Continue
- CMA Preliminary Overview of Bill C-11 (Members only)
- CMA Signs Statement Urging Parliaments to Prioritize Bill C-11
- Government of Ontario's Consultation on Strengthening Privacy Protections in Ontario
- Proposed amendments (Bill 64) to Quebec’s private sector privacy law – French or English
- Feedback to Special Committee Reviewing British Columbia's Personal Information and Protection Act (PIPA)
- OPC Proposals for Ensuring the Appropriate Regulation of Artificial Intelligence
- Federal Government's PIPEDA Reform Proposals
- OPC Consultations on Transfers for Processing (available by request)
- OPC Consent and Privacy’ Discussion Paper (available by request)
In May 2019, the Government of Canada initiated an open consultation on a set of reform proposals to modernize PIPEDA, which followed the release of Canada's Digital Charter earlier that year. The CMA provided a submission on behalf of the marketing community in December 2019.
In November 2020, the government introduced Bill C-11 in the House of Commons. This is the first major attempt to change Canada's federal privacy law in two decades.
Bill C-11 would establish a new private sector privacy law for Canada, the Consumer Privacy Protection Act (CPPA), and a new Personal Information and Data Protection Tribunal. These laws would replace PIPEDA.
The CMA is continuing to engage with government as the bill undergoes further review and debate in the House of Commons.
The CMA is calling for the coordination of privacy frameworks across the country to prevent unnecessary complexity and confusion for organizations and consumers.
Quebec, British Columbia, and Ontario are considering reforming, or introducing new, private sector privacy rules. In 2020, the CMA responded to consultations on behalf of the marketing community in each of these provinces and we remain engaged in the files.
- Quebec: In June 2020, Quebec introduced Bill 64, which contains proposed amendments to its private sector privacy law, including GDPR-like fines and new privacy rights for individuals. See the CMAs submission, available in French and English.
- British Columbia: In August 2020, a Special Committee of B.C.’s Legislative Assembly wrapped up a consultation to reform the province’s private sector privacy law. See the CMA’ s submission.
- Ontario: In August 2020, Ontario launched a consultation to create the province’s first-ever private sector privacy law. See the CMA’s submission.
The CMA is a champion of Data Privacy Day, an international effort held annually on January 28 to create awareness about the importance of respecting privacy, safeguarding data, empowering individuals and enabling trust.