Canada suggests a revamp of privacy regulations that would limit surveillance costs and grant consumers the ability to erase their data.

      Canada's Bill C-36 aims to overhaul private-sector privacy regulations, replace PIPEDA, limit surveillance pricing, and establish a regulator that can impose fines up to C$25 million or 5% of revenue. The government introduced this legislation on Monday to address the shortcomings of the outdated Personal Information Protection and Electronic Documents Act, originally enacted in 1998, amidst extensive criticism regarding the modern landscape of algorithmic pricing and extensive data collection.

      Artificial Intelligence and Digital Innovation Minister Evan Solomon stated that the bill addresses "surveillance pricing," which involves using consumers’ online behavior, location, device type, or purchasing habits to set personalized prices. He remarked, “Companies should not have the ability to use your behavior, your location, your profile, your vulnerabilities, or your personal information to charge unfair prices,” insisting that personal data should not facilitate price gouging.

      Though the bill does not outright prohibit surveillance pricing, it seeks to limit the use of data for individualized pricing when potential harms exceed the benefits. However, it still allows companies to offer better prices through loyalty programs and discounts. Notably, surveillance pricing is not explicitly mentioned in the bill, and Solomon suggested that the new regulator will be tasked with developing guidelines on this issue once it is established.

      The bill proposes the creation of the Digital Safety and Data Protection Commission to ensure compliance with privacy laws and the upcoming Digital Safety Act, which aims to protect children online. The Office of the Privacy Commissioner of Canada will oversee government adherence to privacy laws, while the new commission will focus on the private sector.

      The proposed fines are significant, with the commission having the authority to levy penalties of up to C$10 million ($7.1 million) or 3% of global revenue for non-compliance, whichever amount is higher. More severe violations could incur fines of up to C$25 million or 5% of global revenue; however, the actual implementation of these penalties will depend on the bill passing through Parliament and the commission's approach to enforcement.

      In addition to addressing surveillance pricing, the bill introduces various consumer protections, aligning Canada more closely with the European Union’s General Data Protection Regulation. Canadians would have the right to request the deletion of their personal information under specific conditions, and organizations would need to provide more transparency regarding automated decisions affecting consumers. Furthermore, data collected from children would be deemed sensitive, imposing stricter obligations on businesses that handle it.

      Canada is not alone in this endeavor. Manitoba's provincial government introduced Bill 49 in March, which seeks to prevent retailers from using personal data to increase prices for individuals, both online and in stores. In the U.S., Maryland enacted a surveillance pricing ban, with Governor Wes Moore signing HB 895, prohibiting larger food retailers and third-party delivery services from raising prices based on consumers' personal data; this law will go into effect on October 1.

      Public sentiment in Canada strongly supports taking action, with a poll from Abacus Data indicating that 52% of Canadians believe surveillance pricing should be banned entirely, while 31% think it should be regulated more strictly. The government's decision to restrict rather than ban surveillance pricing aligns more with the minority perspective. Previously, Carney's broader $2.3 billion national AI strategy had indicated forthcoming privacy legislation without detailing its extent.

      This privacy bill was introduced shortly after the launch of the AI strategy and in light of Carney's G7 warnings regarding AI dependence risks. This timing suggests the government is trying to create a cohesive regulatory framework addressing AI investment, data sovereignty, and consumer protection at the same time. Whether these elements harmonize or conflict—spending $2.3 billion to promote AI while limiting AI-driven pricing data use—will depend on the outcomes produced by the new commission.

      For now, the bill must pass through Parliament. Canada previously attempted to modernize its privacy framework with the Artificial Intelligence and Data Act in Bill C-27, which failed to progress and has not been revived. Should Bill C-36 share the same fate, the country will continue to operate under a privacy law established before the advent of smartphones, while other regions advance their digital protection regulations.