Bill C-36: Understanding Canada's privacy reform and what Bill C-27 had planned for AI

Bill C-27 at a Glance

Bill C-27 was not limited to a simple update of consumer privacy legislation. It introduced an entirely new framework for regulating AI in Canada, a first in Canadian legislative history. This bill consisted of three distinct acts, each serving a specific role in protecting the rights of Canadians:

Legislative Journey of Bill C-27

Understanding where Bill C-27 stands in the Canadian parliamentary process is essential for evaluating the urgency to act. Here are the key milestones of this bill since its introduction in the House of Commons.

Bill C-27 was subjected to thorough scrutiny by the House of Commons Standing Committee on Industry and Technology. Key criticisms centred on the lack of clarity in defining high-impact AI systems, the expansive powers of the AI Commissioner, and the absence of explicit references to fundamental rights in the text of the law.

Since the tabling of Bill C-36 on June 15, 2026, a successor to C-27 is undergoing parliamentary review. It retains the essence of the CPPA but takes a different approach: no AIDA, a new regulator (the Canadian Digital Safety and Data Protection Commission), and AI oversight limited to automated decision-making within privacy law. In Quebec, Law 25 is already in effect. Organizations that have begun complying with it are well-positioned for C-36 as well.

What Bill C-27 Changes for Canadians

A Concrete Strengthening of Consumer Rights

The Consumer Privacy Protection Act (CPPA) introduces rights that Canadians do not yet have under current federal legislation, but which Quebec residents are already familiar with thanks to Law 25. These rights protect privacy in the digital economy:

• Right to disposal/erasure: anyone can request that an organization delete their personal information when it is no longer necessary for the purposes for which it was collected.
• Right to mobility/portability: individuals can request to receive their data in a structured, machine-readable format to transfer it to another service provider.
• Enhanced control over consent: consent must be explicit for sensitive uses of personal information, and individuals can withdraw it more easily.
• Right to contest automated decisions: anyone affected by a fully automated decision can request a human explanation and contest the decision.

For private sector organizations, these rights translate into concrete obligations: mapping collected data, documenting the legal basis for processing personal information, and establishing mechanisms to respond to access requests within strict timelines.

Canada's First AI Framework

The Artificial Intelligence and Data Act (AIDA) is the cornerstone of Bill C-27 for technology companies. It introduces the central concept of "high-impact AI systems": any system whose decisions or recommendations can have significant repercussions on a person's health, safety, or fundamental rights and freedoms. AIDA targets commercial activities exclusively. Governmental and national security activities remain outside its scope.

Breakdown of Bill C-27 Components

The Consumer Privacy Protection Act (CPPA)

The CPPA modernizes PIPEDA, the 2000 law governing personal information protection in the private sector, whose fines currently cap at $100,000 for willful infractions. The CPPA draws heavy inspiration from the European GDPR while retaining a Canadian risk-management approach rather than an exhaustive list of prescriptive obligations.

New Obligations for Organizations

• Clear language privacy policy: the law requires simple and understandable communication regarding personal information collection and use practices.
• Privacy management program: organizations must establish internal policies, designate a responsible individual, and document protection practices.
• Privacy Impact Assessment (PIA): mandatory prior to deploying any new product or service handling sensitive personal information.
• Breach reporting: any breach presenting a real risk of significant harm must be reported to the Privacy Commissioner and affected individuals.

Penalties That Demand Attention

For a Quebec SME with an annual turnover of $10M, a serious violation under Bill C-27 could theoretically result in a $500,000 penalty. It is no longer a theoretical risk.

The Artificial Intelligence and Data Act (AIDA)

The Artificial Intelligence and Data Act is the first Canadian federal law regulating AI in the private sector. This legislative framework applies to organizations that design, develop, market, or operate AI systems in the context of commercial activities. The law also creates a new AI Commissioner equipped with investigative and oversight powers.

Most Impacted Commercial Sectors

AIDA targets commercial interprovincial or international activities exclusively. Governmental and national security activities are outside its scope. The commercial sectors most likely to be affected include:

• Human resources and algorithmic recruitment
• Financial services: credit, insurance, automated investment
• Healthcare and social services
• Commerce and essential services (housing, transportation, telecommunications)
• Large-scale digital platforms (content recommendation, targeted advertising)

Obligations for High-Impact Systems

• Risk assessment: identify and document risks of harm prior to deploying any AI system.
• Mitigation measures: establish concrete mechanisms to reduce identified risks, particularly algorithmic bias.
• Ongoing monitoring: monitor system performance post-deployment and maintain monitoring data.
• Transparency: inform individuals when interacting with a high-impact AI system.
• Records: keep detailed documentation on systems, accessible to the AI Commissioner upon request.

The AI Commissioner: A New Watchdog

Under C-27, AIDA would have created an AI Commissioner with investigation, audit, and sanction recommendation powers, able to compel record production, order the shutdown of problematic systems, and refer cases to the Tribunal. This role was one of the most criticized points in committee due to the breadth of its powers. C-36 does not include this position: privacy oversight is entrusted to the Canadian Digital Safety and Data Protection Commission.

Personal Information and Data Protection Tribunal

Under C-27, this Tribunal would have served two functions: providing an appeal mechanism for Commissioner decisions and imposing administrative monetary penalties. C-36 abandons this model; these functions are entrusted to the Canadian Digital Safety and Data Protection Commission, a new body whose members are appointed by the Governor in Council rather than Parliament.

Generative AI in Enterprise: ChatGPT, Copilot, and Bill C-27

The widespread adoption of generative AI tools (ChatGPT, Microsoft Copilot, Google Gemini, GitHub Copilot) in Canadian companies raises specific questions that Bills C-27 and C-36 help address.

What Generative AI Use Entails Under C-27

When an employee uses ChatGPT to draft customer communications, or Microsoft Copilot accesses an organization's internal emails and documents, personal information of customers, partners, or employees is potentially processed by a third-party system. Bill C-36, replacing C-27, regulates these uses via its automated decision-making and legitimate interest provisions rather than a dedicated AI act. Under Bill C-27, this triggers several obligations:

• Consent and transparency: if customer personal information is submitted to a generative AI system, the organization remains responsible for its use. Consent from affected individuals may be required.
• Contracts with AI vendors: Microsoft, OpenAI, and Google are service providers under the CPPA. Data protection contractual clauses must govern these relationships.
• Risk assessment: if a generative AI system is used for high-impact tasks such as drafting HR decisions or analyzing customer files, a risk assessment is required.
• Hallucinations and automated decisions: results from a generative AI system must not be presented as final decisions without human oversight, especially when affecting individual rights.

Immediate Best Practices for Businesses

• Draft an acceptable use policy for AI tools explicitly covering generative tools.
• List approved and prohibited generative AI tools for processing personal information.
• Train teams on cases where generative AI use requires prior data anonymization.
• Verify privacy settings for used tools (e.g., Microsoft Copilot has an "enterprise" mode with stricter confidentiality guarantees).

Comparison with International Privacy Regulations

Parallels with the European GDPR

For anyone who has navigated the European Union's General Data Protection Regulation, Bill C-27 feels like a Canadian cousin, albeit with notable differences.

Positioning Relative to US Laws

The United States lacks a federal privacy framework. For Canadian organizations exporting there, compliance with C-27 facilitates relations with European partners subject to the GDPR.

AI in the Enterprise: What You Need to Know

Impacts on SMEs and Startups

Bill C-27 impacts SMEs as much as large enterprises. SMEs collecting customer personal information, using behavioral analytics, or deploying recommendation tools are directly affected.

• Data mapping: identify where all personal information resides within the organization.
• Documentary governance: maintain processing records, impact assessments, and updated internal policies.
• Third-party contracts: cloud service providers, SaaS, and marketing vendors must be contractually bound.
• Privacy by design: integrating privacy protection right from design—a principle explicitly recognized by the CPPA—provides a structural advantage for startups.

Risks and Responsibilities Related to Enterprise AI Use

Managing Algorithmic Bias

An AI system trained on historical data reflects the bias inherent in that data. If past decisions underrepresented certain groups, your AI system will replicate that pattern, and you will be held legally responsible under AIDA. Evaluating bias is a legal obligation for high-impact systems.

Automated Decisions and Fundamental Rights

When an AI system makes a decision that significantly affects an individual (credit refusal, candidate elimination, insurance premium modification), that person will have the right to request an explanation and contest the decision. Fundamental rights of individuals facing automated systems are at the core of AIDA.

Legal and Reputational Liabilities

• Civil liability: an individual harmed by a flawed AI system or a privacy breach could file a civil claim for damages.
• Reputational damage: a publicized data breach or algorithmic bias incident can permanently harm brand reputation and customer trust.
• Administrative penalties: penalties under Bill C-27 can reach up to 5% of global turnover.

Implementation Challenges for Businesses

Data Mapping: Your Starting Point

Before you can protect personal information, you must know where it is, who has access to it, why it was collected, and how long it is retained. Practical implementation steps include:

1. Inventory all systems that collect, process, or store personal information.
2. Document for each data flow: legal basis for processing, recipients, retention periods.
3. Identify security gaps and processing that potentially non-complies with privacy law.
4. Prioritize corrective actions based on risk and potential impact.

Training and Corporate Culture

• Staff awareness: train employees to recognize personal information, breach reporting obligations, and responsible use of generative AI technologies.
• Privacy by design: collect only necessary data, encrypt sensitive information, embed access controls into system design from inception.
• Contract updates: updated privacy policy, data protection clauses with service providers, acceptable AI use policy.

Bill C-36 and Data Protection: Get Expert Guidance

With Bill C-36 tabled on June 15, 2026 (the third reform attempt in six years), the direction is clear: Canadian private sector organizations will need to comply with heightened requirements regarding personal information protection. C-36 retains the core of C-27 while dropping AIDA. AI regulation is addressed through provisions on automated decision-making and impact assessments (Sources: Fasken, Norton Rose Fulbright, Canada.ca).

In the meantime, Law 25 in Quebec already mandates many of these obligations. Organizations that have complied possess a significant head start on future requirements under Bill C-36. Compliance is not merely a cost: it builds trust, protects reputation, and provides a sustainable competitive advantage in a market where AI ethics are increasingly scrutinized.

At Baseline, our team supports SMEs and organizations in the responsible integration of AI and compliance implementation: compliance assessment, personal information mapping, design of explainable and auditable AI systems, generative AI policy drafting, and team training.