🍁 civid v1

Status and scope

• Bill C-36 was introduced at first reading on June 15, 2026. The supplied text is truncated: it contains the bill’s summary, table of provisions and part of its detailed text. Later provisions are identified by title only, so their precise effects cannot be determined from the excerpt.

Part 1 — Protecting Privacy and Consumer Data Act

• Enacts a new commercial-sector privacy law. It applies to organizations handling personal information in commercial activities and to employee and job-applicant information connected with federally regulated businesses. It excludes, among others, government institutions covered by the Privacy Act, purely personal or domestic uses, and anonymized information.
• Defines personal information to include inferred information. De-identified information remains personal information; anonymized information does not. Parents or guardians may generally exercise a child’s rights, subject to the child’s wishes and capacity.
• Requires organizations to designate a responsible person, maintain a privacy management program, limit collection to necessary information, and use appropriate purposes and security safeguards. Organizations remain accountable for information transferred to service providers.
• Generally requires valid consent, supported by specified information in plain language. Consent must usually be express, and individuals may withdraw it subject to legal and contractual limits. The bill also permits specified uses and disclosures without consent, including certain business activities, legitimate interests, investigations, emergencies and disclosures to government. The legitimate-interest exception requires an assessment and measures to address foreseeable adverse effects.
• Requires a privacy impact assessment and risk-mitigation measures before personal information is disclosed or transferred outside Canada. Breaches creating a real risk of significant harm must generally be reported to the Commission and affected individuals as soon as feasible; organizations must keep records of every security breach.
• Gives individuals access and correction rights, and a right to request disposal in specified circumstances, subject to exceptions. Organizations generally must answer access requests within 30 days, with permitted extensions; any charge must be minimal and disclosed in advance. De-identified information is excepted from several access, correction and disposal obligations.
• Requires organizations to disclose their general use of automated decision systems that may have legal or similarly significant effects. On request, an affected individual must receive an explanation and an opportunity to make written representations to an employee able to review the prediction, recommendation or decision.
• Provides for data mobility between organizations subject to a data mobility framework, subject to regulations. It also generally prohibits re-identifying de-identified information, with specified exceptions.
• The table lists complaints, investigations, compliance agreements, orders, penalties, appeals and a private right of action. The supplied detailed text does not reach those provisions, so their conditions and penalty amounts are not available here.

Part 2 — Existing privacy and electronic documents law

• According to the bill’s summary, repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes that Act’s short title to the Electronic Documents Act. The detailed amending provisions are not included in the excerpt.

Part 3 — Commission

• The table identifies amendments concerning the Digital Safety and Data Protection Commission of Canada and related changes to other Acts.
• The new privacy Act’s visible text gives the Commission functions including public education, guidance, research and review of organizations’ privacy management programs. The detailed Part 3 amendments are not included.

Part 4 — Related amendments and commencement

• The table lists consequential and related amendments to several Acts, a transitional provision, coordinating amendments and coming-into-force provisions.
• The table specifies coming into force by order in council, but the excerpt does not provide the detailed commencement rules or a commencement date.