Bill C-36: the Canadian privacy bill that finally reaches automated decisions

What happened

The federal government introduced Bill C-36, the Protecting Privacy and Consumer Data Act, on June 15, 2026. If it passes, it would repeal Part 1 of PIPEDA and set up a new federal privacy regime for the private sector. It's the third attempt, after Bills C-11 and C-27 died on the order paper.

Parliament rose on June 18 and was due to resume on September 21, with second reading expected in the fall. The bill still has to clear committee, third reading and the Senate, and it may change on the way. Its stage may have moved since we wrote this, so check the parliamentary record.

What it would require, according to law-firm analyses:

• A privacy management program at every covered organization.
• A privacy impact assessment before personal information is disclosed or transferred outside Canada.
• Rules for automated decision systems. The definition is broad and covers everything from rules-based tools to machine learning. If a system's prediction, recommendation or decision could significantly affect someone, the organization must explain it on request, including the types of personal information used and the main factors behind the outcome. A person could ask a human to review it.
• Stronger protection for children. Anyone under 18 counts as a child, and their information is treated as sensitive.
• Penalties. Administrative penalties of up to the greater of $10 million or 3% of global revenue, with fines for serious offences of up to the greater of $25 million or 5%. Individuals could also sue for damages.

So what for your business

The right to an explanation is the clause to watch if you use AI. Many systems can produce an answer but can't say why. If a customer, a job applicant or a borrower asks you to explain a decision, "the model said so" won't do.

Meeting that standard isn't a last-minute job. It means knowing which decisions are automated, what data feeds them and who can review them.

What to do this month

1. List your automated decisions. Anything that scores, ranks, approves, declines or recommends for a person.
2. Check what each one uses. The data types and where they come from.
3. Test the explanation. Pick one decision and try to write a plain-language reason for it. If you can't, note why.
4. Assign a human reviewer. For each significant decision, name who can review it on request.
5. Review cross-border transfers. List where personal data goes outside Canada, including vendors and cloud regions.