How does Bill C-3 impact privacy rights in Canada?
Executive summary
Bill C‑27 (often discussed as the Digital Charter Implementation Act) aimed to overhaul federal private‑sector privacy law by creating the Consumer Privacy Protection Act, an Artificial Intelligence and Data Act, expanding the Privacy Commissioner’s powers and penalties (including fines up to the greater of $25 million or 5% of global revenue), and establishing a new administrative tribunal — but the bill died when Parliament was prorogued on January 6, 2025, so its measures have not become law [1] [2] [3] [4]. The Office of the Privacy Commissioner called the bill “a step in the right direction” while urging further measures such as stronger rights (for example, a right of disposal) and additional safeguards for AI [5] [6].
1. What the bill would have changed: stronger enforcement, broader rights, AI rules
Bill C‑27 bundled several reforms: a modernized consumer privacy statute, an AI/data law, bigger enforcement tools for the federal regulator and an administrative tribunal to hear cases — all intended to bring Canada closer to GDPR‑style enforcement. Commentators and law firms note the proposal would expand the Privacy Commissioner’s powers, increase monetary penalties for serious violations and create new rules for automated decision‑making and AI, as well as introduce data portability and child‑focused protections [2] [1] [3].
2. Concrete enforcement levers and fines that worried businesses
Under the reform trajectory described by legal analysts, fines could be substantial: administrative and criminal/administrative monetary penalties in previous reform drafts were framed as up to the greater of $25 million and 5% of global revenue for the preceding fiscal year, and other penalties up to the greater of $10 million and 3% of global revenue were contemplated — figures that would materially raise compliance risk for large organizations [1].
3. The Privacy Commissioner’s view: progress, but not enough
Privacy Commissioner Philippe Dufresne publicly described the proposed reforms as “a step in the right direction” while pressing for stronger rights and more structural protections. The OPC submitted 15 recommendations in committee — including a right to disposal of personal information even when retention policies exist — and urged recognition of privacy as a fundamental right in federal law [6] [5].
4. Political reality: reform killed by prorogation; status quo continues
All bills on the Order Paper, including C‑27, died when Parliament was prorogued on January 6, 2025, which means the proposed changes in C‑27 did not become law and Canada continues to rely on existing federal statutes while provinces pursue their own reforms [2] [7] [3]. Multiple law firms and the OPC note that the legislative work done up to prorogation provides a roadmap for future bills, but the immediate legal effect is nil [4] [7].
5. Competing viewpoints: stronger enforcement vs. procedural concerns
Supporters — including the OPC and many privacy specialists — argued that stronger powers and a tribunal would give “teeth” to enforcement and align Canada with global norms [6] [2]. Critics in Parliament and some legal commentators warned that creating a tribunal could slow enforcement or undermine the Commissioner’s authority, and that bundling privacy and AI regulation in one bill complicated consensus [4].
6. Where this leaves Canadian privacy rights today
Because C‑27 did not become law, Canadians remain protected by current federal statutes and evolving provincial regimes (notably Quebec’s modernized law), and the OPC continues to apply existing law to new technologies such as generative AI while urging legislative reform [7] [2]. Legal observers expect privacy and AI reforms will re‑emerge as priorities, possibly decoupled (privacy separate from AI) to ease passage [4].
7. What to watch next
Watch three things: whether Parliament re‑introduces privacy reform with separated bills (privacy first, AI later), a path discussed in committee debates [4]; how provinces — especially Quebec, which already enacted strong rules — continue to set the bar and create de facto national pressure [2] [1]; and whether the OPC’s recommendations (including a right of disposal and mandatory privacy impact assessments for government programs) are adopted into future drafts [5] [8].
Limitations: available sources document the content, debate and demise of Bill C‑27/C‑27‑style reforms and the OPC’s position, but do not provide full final legislative text or post‑prorogation re‑introduced bills — therefore this analysis relies on summaries and institutional statements in the cited reporting [2] [6] [4].