Canada’s Consumer Privacy Protection Act (Bill C-27): Impact for businesses

On June 15, 2022, the Minister of Innovation, Science and Industry, François-Phillippe Champagne introduced Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts (or Digital Charter Implementation Act, 2022). This long-awaited piece of legislation is in a sense the faithful successor of the former Bill C-11, tabled in 2020, which died on the order paper in August 2021.

Bill C-27 reintroduces two Acts that will sound familiar for those who followed Bill C-11 (2020), namely the Consumer Privacy Protection Act (CPPA) and the Personal Information and Data Protection Tribunal Act. The novelty of C-27 primarily lies in the introduction of a third legislation, the Artificial Intelligence and Data Act.

Bill C-27 seeks to replace the Personal Information Protection and Electronic Documents Act with a modernized and stronger privacy and data protection legal framework in Canada. This bulletin focuses on the key differences between the proposed legislation and the actual federal privacy regime in the private sector governed by PIPEDA.

The new version of the CPPA (C-27) is also introducing new changes from the previous version C-11 (2020). To assist you in your review of Bill C-27, we have prepared a comparative chart describing the most significant changes introduced by C-27 compared to C-11 (2020).