Canada is suggesting a revamp of its privacy laws that would limit surveillance costs and grant consumers the ability to remove their data.

      TL;DR: Canada's Bill C-36 aims to replace PIPEDA, limit surveillance pricing, and establish a regulator with the authority to impose fines of up to C$25M or 5% of revenue.

      On Monday, the Canadian government unveiled legislation designed to reform private-sector privacy laws, incorporating new limitations on businesses that utilize personal data to charge higher prices to individual consumers. The Protecting Privacy and Consumer Data Act, or Bill C-36, seeks to replace the Personal Information Protection and Electronic Documents Act (PIPEDA), a 1998 law criticized for being outdated in the context of algorithmic pricing and extensive data collection.

      Minister of Artificial Intelligence and Digital Innovation Evan Solomon mentioned that the bill addresses surveillance pricing, where companies leverage a consumer's browsing history, location, device type, or purchasing behavior to establish personalized prices. “Businesses should not exploit your behavior, location, profile, vulnerabilities, or personal data to impose unfair prices,” Solomon stated. “Your personal information shouldn't be weaponized for price gouging.”

      The legislation does not completely prohibit surveillance pricing. Solomon clarified that the intent is to restrict data use for targeting consumers with individualized prices when the negative impacts outweigh the advantages. However, the government does not intend to stop companies from offering better pricing through loyalty programs or promotional discounts. The term "surveillance pricing" is not explicitly included in the bill, according to BetaKit, and Solomon plans to direct the new regulator to create guidance on this matter once it is operational.

      This regulatory gap is significant as the bill proposes the establishment of a new body called the Digital Safety and Data Protection Commission, which will oversee compliance with the privacy legislation as well as the proposed Digital Safety Act aimed at protecting children online. While the Office of the Privacy Commissioner of Canada will continue its role in ensuring government adherence to federal privacy laws, the new commission will focus on the private sector.

      The penalties outlined in the bill are considerable. The commission would be empowered to impose fines of up to C$10 million (approximately $7.1 million) or 3% of global revenue, whichever is higher, for non-compliance. The most severe violations could incur fines of up to C$25 million or 5% of global revenue. The actual application of these penalties will hinge on whether the bill is passed by Parliament and the commission's approach to its mandate.

      In addition to tackling surveillance pricing, the bill lays out several consumer protections that align Canada more closely with the European Union’s General Data Protection Regulation. Canadians would have the right to request the deletion of their personal data in specific situations. Organizations would be mandated to provide more transparency regarding automated decisions that affect consumers. Furthermore, data pertaining to children would be categorized as sensitive, necessitating a higher standard of care from businesses that collect it.

      Canada is not acting alone in this matter. The provincial government of Manitoba introduced Bill 49 in March, which restricts retailers from using personal data to raise prices for individual consumers both online and in physical stores. In the U.S., Maryland became the first state to implement a ban on surveillance pricing when Governor Wes Moore signed HB 895, which prohibits large food retailers and third-party delivery services from using personal data to hike prices for individual shoppers. This law will take effect on October 1.

      Public sentiment in Canada is strongly in favor of legislative action. A March survey by Abacus Data showed that 52% of 1,931 Canadians believed surveillance pricing should be completely banned, while 31% felt it should be regulated more stringently. The government’s strategy, which restricts rather than outright bans, aligns it more with the minority opinion, although Carney's broader $2.3 billion national AI strategy had already indicated forthcoming privacy legislation without detailing its extent.

      The introduction of the privacy bill comes less than two weeks after the launch of the AI strategy and shortly after Carney highlighted the systemic risks associated with dependence on AI at the G7. This timing suggests that the government is trying to create a cohesive regulatory framework addressing AI investment, data sovereignty, and consumer protection simultaneously. How these elements integrate without conflict, especially considering the substantial investment of $2.3 billion to hasten AI adoption while imposing restrictions on AI-driven pricing using consumer data, will depend on the specifics that the new commission ultimately devises.

      The bill must still be passed by Parliament. Canada's earlier attempt to modernize its privacy structure, the Artificial Intelligence and Data Act under Bill C-27, did not progress through the legislative process and has not been revived. Should Bill C-36 face a similar outcome, the country would continue to operate under a privacy law that predates smartphones, while other regions advance their own digital protection frameworks.