Bill C-36, the Protecting Privacy and Consumer Data Act, was introduced in the House of Commons on June 15, 2026. If passed, it would require organizations to publish a general account of any automated decision system used for predictions, recommendations, or decisions with a legal or similarly significant effect, and to explain such a decision to the affected person on request. As of October 31, 2026, the bill has completed first reading only, it is not law, and none of its rules are in force.
Key takeaways
- The bill defines an automated decision system as technology that assists or replaces human judgment, which reaches well beyond machine learning.
- Organizations would have to publish a general account of such systems and, on request, explain a decision that has a legal or similarly significant effect.
- Proposed penalties reach the greater of CAD 10 million or three percent of global revenue, and fines for the most serious offences reach the greater of CAD 25 million or five percent.
- The bill is a privacy law, not an AI law: it has no risk tiers for high-impact AI and no rules specific to generative AI.
- The official record shows first reading on June 15, 2026 and no second reading debate by October 31, 2026.
Where the bill stands in Parliament
Sources describe the stage differently. The Parliament of Canada's LEGISinfo record for Bill C-36 carries a status line reading "At second reading in the House of Commons", yet its list of stages shows first reading completed on June 15, 2026 (House sitting 136) and "No activity" under second reading. Both are consistent: after first reading, a government bill waits on the Order Paper at the second reading stage, and the status line names that waiting stage. No second reading debate, vote, committee referral, or Senate step is recorded as of October 31, 2026. Parliamentary news previews dated October 29 and 30, 2026 also list the bill as awaiting second reading.
Any report describing the bill as having passed second reading is not supported by the official record reviewed. On October 8, 2026, the Privacy Commissioner of Canada said the Office of the Privacy Commissioner was still analyzing the bill and would give Parliament its views in due course.
How the bill defines an automated decision system
Section 2(1) of the first-reading text of the bill defines the term as "any technology that assists or replaces the judgment of human decision-makers". The definition then lists techniques, among them rules-based systems, regression analysis, predictive analytics, machine learning, deep learning, and neural networks, and closes with a catch-all for other techniques.
Two features stand out. The definition is technology-neutral, so a credit-scoring formula built on fixed rules is covered in the same way as a neural network. It also covers systems that only assist a person, whereas the Quebec rule described on the tracker covers decisions based exclusively on automated processing. The words "artificial intelligence" do not appear anywhere in the operative provisions of the text reviewed; they appear only in the title of the sponsoring minister, the Minister of Artificial Intelligence and Digital Innovation.
What organizations would have to tell people
Three duties apply to automated decision systems. Under section 62(2)(c), an organization must make available a general account of its use of any such system to make predictions, recommendations, or decisions that could have a legal or similarly significant effect. Under section 63(4), a person affected by such an outcome may request an explanation. Under section 63(5), the explanation must state the type of personal information used, where it came from, and the reasons or principal factors behind the outcome.
Section 63(6) adds a route to a human: the person must be able to make written representations to an employee who can review the prediction, recommendation, or decision. Separately, section 62(1) requires an organization to make its privacy policies and practices readily available in plain language. Commentary on the bill reports that C-36 narrows the trigger from the "significant impact" wording of its predecessor, Bill C-27, to "legal or similarly significant effect", language that resembles European data protection law. That comparison comes from law firm analysis and was not checked against the older bill text for this page.
Privacy impact assessments in the bill
The bill does not create a stand-alone privacy impact assessment for automated decision systems. Its assessment duties sit elsewhere. Section 57(1) requires an organization to carry out a privacy impact assessment, in accordance with prescribed requirements, and to implement measures to mitigate the risks it identifies before transferring personal information outside Canada. Section 57(2) lets the Commission request the assessment. Section 18(4) requires a similar assessment, identifying likely adverse effects, before an organization relies on the legitimate interest exception to collect or use information without consent.
The government backgrounder describes the transfer rule as a requirement to assess and mitigate privacy risks before sending personal information abroad. An organization that sends customer data to an AI service hosted outside Canada would appear to fall within that rule, subject to regulations that have not been written. The Privacy Commissioner told a legal audience on October 8, 2026 that he welcomes the bill's assessment requirements.
Children's data
The bill defines a child as an individual under 18 years of age and treats a child's personal information as sensitive, and sensitivity is one of the factors weighed when deciding whether a purpose is appropriate. A parent, guardian, or tutor may exercise a child's rights unless the child wishes to do so personally and is capable of it (section 4(a)). Both the Commission and the Privacy and Consumer Data Commissioner must consider the best interests of children when exercising their powers. The government describes the result as a higher standard for organizations handling children's information.
The text reviewed does not contain a ban on profiling children, a privacy-by-default rule, or a child-specific consent age. Online harms are handled in a separate bill, the Safe Social Media Act (Bill C-34), introduced on June 10, 2026. The Privacy Commissioner said on October 8, 2026 that his office plans to publish a Children's Privacy Code.
Penalties and the new commission
The bill would replace the Privacy Commissioner's current role with a regulator called the Digital Safety and Data Protection Commission of Canada. It would administer the new act, including through a Privacy and Consumer Data Commissioner and a Privacy and Consumer Data Division, and it could issue binding orders. The same commission is meant to oversee the proposed Digital Safety Act, giving it a dual mandate.
The government backgrounder states two penalty tiers. Administrative monetary penalties would reach the greater of CAD 10 million and three percent of global revenue (section 114 of the bill). Fines for the most serious offences would reach the greater of CAD 25 million and five percent. The bill text also sets a lower fine for summary conviction, the greater of CAD 20 million and four percent (section 145). Administrative penalties apply only to contraventions listed in the bill, and no penalty applies where the organization shows due diligence or compliance with an approved certification program. After a finding or conviction, individuals could also bring a civil claim for damages.
What the bill does not do for AI
Bill C-27 paired a privacy bill with the Artificial Intelligence and Data Act, which would have regulated high-impact AI systems. Bill C-36 contains no counterpart. It does not classify AI systems by risk, require developers to test or document models, regulate generative AI or chatbots as such, or set rules for training data beyond general privacy duties. Provisions on de-identified and anonymized information are the nearest the bill comes to model development: de-identified information remains personal information, re-identifying it is generally prohibited, and organizations may de-identify information without consent and use it for internal research and development.
The government has tied the bill to its "AI for All" strategy, and the rest of the federal approach relies on existing privacy law, online safety legislation, and sector rules.
Proposed rules compared with current law
| Topic | Bill C-36 as introduced | What applies today |
|---|---|---|
| Status | First reading completed June 15, 2026; no second reading debate recorded | PIPEDA remains the federal private-sector privacy law |
| Automated decision systems | Defined as technology that assists or replaces human judgment; general account must be available; explanation on request for decisions with legal or similarly significant effect | PIPEDA has no automated-decision provision; general openness and access principles apply; Quebec has its own notice rule |
| Human review | Written representations to an employee able to review the decision | No federal private-sector right in PIPEDA |
| Privacy impact assessment | Required before cross-border transfers and before relying on legitimate interest | No express duty for private organizations; the Office of the Privacy Commissioner lists impact assessments as an accountability measure |
| Children | Child defined as under 18; sensitive information; best interests considered by regulators | No dedicated children's provisions in PIPEDA; regulators' generative AI principles flag children as a vulnerable group |
| Monetary penalties | Up to the greater of CAD 10 million or three percent of global revenue | None; PIPEDA offences are limited to listed knowing contraventions and obstruction, with fines up to CAD 10,000 or CAD 100,000 |
| Orders | Commission could issue binding orders | The Privacy Commissioner has said the office cannot currently issue compliance orders |
| AI-specific regime | None | None |
This page is general information, not legal advice. A bill can change at any stage, and organizations with a specific question about their obligations should consult a qualified lawyer or the text of the law itself.
FAQ
Is Bill C-36 law yet?
No. It has completed first reading in the House of Commons and nothing else. It would need to pass the House and the Senate and receive royal assent, and its provisions would come into force on a day set by order of the Governor in Council.
Does Bill C-36 regulate artificial intelligence?
Not directly. It regulates automated decision systems that affect individuals and applies general privacy duties to personal information, including information used to train models. It has no risk-based regime for high-impact AI like the lapsed Artificial Intelligence and Data Act.
Would a small business using a scoring tool or chatbot be covered?
The duties attach to an organization that uses an automated decision system for decisions about individuals with a legal or similarly significant effect. The text reviewed shows no general small-business exemption, though the government says the regulator must account for the challenges faced by small and medium-sized businesses.
Who would enforce the bill?
The proposed Digital Safety and Data Protection Commission of Canada, through its Privacy and Consumer Data Commissioner. It could issue binding orders and administrative penalties, powers the Privacy Commissioner does not have today.
Related reading
- How PIPEDA already applies to AI
- Quebec's automated decision rules
- Canada's AI regulation overview
- Federal rules for high-impact AI
More in AI Law in Canada.
Last verified: October 2026
Sources
- Bill C-36, 45th Parliament, 1st Session: LEGISinfo record, Parliament of Canada, 2026
- Bill C-36, Protecting Privacy and Consumer Data Act, first reading text, House of Commons of Canada, 2026
- Backgrounder: Government of Canada introduces legislation to Protect Canadians' Privacy in the Digital Age, Innovation, Science and Economic Development Canada, June 15, 2026
- News release: Government of Canada tables new legislation to protect children's data, strengthen privacy and build trust in the digital economy, Innovation, Science and Economic Development Canada, June 15, 2026
- Remarks by the Privacy Commissioner to the Ontario Bar Association Privacy Law Summit, Office of the Privacy Commissioner of Canada, October 8, 2026
- News release on the investigation into the Grok chatbot and sexualized deepfakes, Office of the Privacy Commissioner of Canada, June 11, 2026
- Personal Information Protection and Electronic Documents Act, section 28, Justice Laws Website, Government of Canada
- Parliament Today previews for October 29 and 30, 2026, The Hub, 2026
- Canada tables Bill C-36, the Protecting Privacy and Consumer Data Act, DLA Piper, 2026