Status of the bill
Bill C-27 was first tabled in June 2022. It progressed through committee review but did not receive royal assent before Parliament dissolved. Given the high rate of change around privacy reform, always verify current status on the Parliament of Canada website.
Even if enacted, the CPPA and AIDA would include transition periods before they take effect. PIPEDA remains the governing federal private-sector privacy law until the reform is in force.
What the CPPA would change
Compared with PIPEDA, the CPPA as proposed would:
- Raise administrative monetary penalties to up to 3% of global revenue or $10 million for certain violations; up to 5% or $25 million for more serious offences.
- Strengthen the concept of valid consent and require plain-language explanations.
- Create a specific regime for de-identified information and anonymized information.
- Add a right of data mobility (portability) for personal information between organizations.
- Create a right to deletion ('disposal') at an individual's request, subject to legal and business exceptions.
- Require automated-decision transparency for decisions that could have significant impact on an individual.
- Codify protections for minors' personal information.
- Modernize breach notification and record-keeping requirements.
The new Tribunal
The Personal Information and Data Protection Tribunal Act would create a new administrative tribunal with authority to impose administrative monetary penalties and review OPC decisions on recommendation. The OPC's expanded powers would include order-making authority.
AIDA at a glance
The Artificial Intelligence and Data Act would regulate 'high-impact' AI systems. It would create obligations for AI developers and deployers around risk assessment, transparency, and accountability, and create a federal AI and Data Commissioner to monitor compliance.
The scope of 'high-impact' systems is partly defined by future regulation, which has generated ongoing debate.
What it means for Canadians today
Bill C-27 signals the direction of federal privacy reform even before it is enacted. Many organizations are already preparing for stricter consent and breach obligations, higher penalties, and new individual rights around automated decisions and data portability.
Regardless of whether and when Bill C-27 passes, Quebec residents already benefit from many of these rights under Law 25, which serves as a useful preview.