Canada’s Bill C-36: New Privacy Laws to Curb Surveillance Pricing

Canada introduced Bill C-36 to replace the outdated PIPEDA framework, targeting “surveillance pricing” and establishing a new regulator with the power to levy fines up to C$25 million or 5% of global revenue. According to Artificial Intelligence and Digital Innovation Minister Evan Solomon, the legislation prevents businesses from using personal data, such as browsing history and location, to charge consumers unfair prices.

What is surveillance pricing and how does Bill C-36 address it?

Surveillance pricing is the practice of using a consumer’s device type, location, purchasing behavior, or browsing history to set individualized prices. Minister Evan Solomon told reporters that personal information shouldn’t be used for “price gouging” or to exploit consumer vulnerabilities.

Bill C-36, known as the Protecting Privacy and Consumer Data Act, doesn’t ban the practice entirely. Instead, it bars the use of data for individualized pricing when the harms to the consumer outweigh the benefits. The government intends to keep loyalty programs and promotional discounts legal.

There’s a catch in the fine print. BetaKit reports that “surveillance pricing” isn’t explicitly mentioned in the bill’s text. Instead, the government will rely on a new regulator to draft specific guidance once the body is operational.

How do the new penalties and regulatory powers work?

The bill creates the Digital Safety and Data Protection Commission. This new body will oversee private-sector compliance and manage the proposed Digital Safety Act, which focuses on protecting children online. The Office of the Privacy Commissioner of Canada will still handle government compliance.

The financial stakes for companies are significantly higher than under the previous 1998 laws. For general non-compliance, the commission can impose fines of C$10 million or 3% of global revenue. The most severe offenses carry penalties up to C$25 million or 5% of global revenue, whichever is greater.

New consumer rights under Bill C-36

The legislation moves Canada closer to the European Union’s General Data Protection Regulation (GDPR). Key changes include:

• The Right to Erasure: Canadians can request the deletion of their personal information under specific conditions.
• Algorithmic Transparency: Companies must disclose more information regarding automated decisions that affect consumers.
• Children’s Data: This is now classified as “sensitive,” requiring a higher standard of care during collection.

How does Canada’s approach compare to other regions?

Canada is taking a middle-ground approach compared to more aggressive bans. An Abacus Data poll of 1,931 Canadians found that 52% want a total ban on surveillance pricing, while 31% support strict regulation. Bill C-36 aligns with the minority view by restricting rather than banning the practice.

Why is the timing of this bill significant?

The bill arrived shortly after the launch of a $2.3 billion national AI strategy. This creates a complex tension: the government is spending billions to accelerate AI adoption while simultaneously restricting how AI-driven pricing algorithms can use data.

This strategy follows warnings from Carney at the G7 regarding the systemic risks of AI dependence. The government appears to be attempting to build a regulatory framework that balances data sovereignty with economic investment.

Will Bill C-36 actually become law?

Passing Parliament is the biggest hurdle. A previous attempt to modernize privacy laws—the Artificial Intelligence and Data Act within Bill C-27—failed to move through the legislative process and hasn’t been revived.

If Bill C-36 fails, Canada will remain under a privacy regime written in 1998, long before the era of smartphones and large-scale algorithmic data collection.

Frequently Asked Questions