The federal Liberal government under Prime Minister Mark Carney is entrusting the enforcement of new privacy provisions to a recently announced digital regulator, which will oversee the country's online safety framework.
New Regulator to Handle Privacy and Safety
Artificial Intelligence Minister Evan Solomon announced on Monday that the government is establishing a standalone tech regulator with robust enforcement powers, including the ability to levy penalties and enhance online safety for Canadians. This move comes after years of calls for such a body.
“We believe that it’s very important to set up a robust commission that has those enforcement powers and that’s what we’re doing, in as quick a manner as possible,” Solomon told reporters. “We think Canada needs that kind of independent regulator.”
The creation of the regulator was first revealed last week when Heritage Minister Marc Miller tabled the Safe Social Media Act. That legislation proposes requiring social media platforms and companies operating AI chatbots to reduce users’ exposure to harmful content and enforce a social media ban for children under 16, unless an exemption is granted.
Privacy Overhaul After Two Decades
Solomon also introduced the Protecting Privacy and Consumer Data Act on Monday, marking the most significant overhaul of Canada’s privacy regime in more than 20 years. This act will be implemented by the same digital regulator, which will be built with specific privacy expertise.
“They were written before the iPhone,” Solomon said of the existing privacy rules.
Senior government officials, speaking on condition of anonymity, noted a significant overlap between privacy issues and tech regulation, justifying the regulator’s dual role. One official cited children’s data as an example, touching on both privacy rights and age-appropriate design principles that limit data collection and use.
Privacy Commissioner’s Role Shifted
Solomon and officials confirmed that the Privacy Commissioner of Canada will now focus on how the federal government handles private information. The new bill transfers power to investigate and enforce privacy rules in the private sector to the Digital Safety and Data Protection Commission.
Last week, officials estimated it would take up to 18 months for the new regulator to become fully operational. However, the government can enforce new provisions before the regulator is completely established.
Monday’s privacy bill specifically targets children’s information, classifying it as “sensitive,” and addresses surveillance pricing. It also mandates that companies use plain language when obtaining consent for using personal data.
