An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts
This bill is from the 44th Parliament, 1st session, which ended in January 2025.
In committee (House), as of April 24, 2023 (This bill did not become law.)
Summary
This is from the published bill. The Library of Parliament has also written a full legislative summary of the bill.
Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts. Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act . Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.
Elsewhere
All sorts of information on this bill is available at LEGISinfo, an excellent resource from Parliament. You can also read the full text of the bill.
Bill numbers are reused for different bills each new session. Perhaps you were looking for one of these other C-27s:
C-27 (2011)Law
First Nations Financial Transparency Act
Votes
April 24, 2023Passed 2nd reading of Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts
April 24, 2023Passed 2nd reading of Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts
This is a computer-generated summary of the speeches below.
Usually it’s accurate, but every now and then it’ll contain inaccuracies or total fabrications.
Bill C-27 aims to modernize Canadian privacy laws by enacting the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act. The bill seeks to provide individuals with greater control over their personal data, strengthen privacy enforcement, and establish a framework for the responsible development and deployment of artificial intelligence systems. While proponents argue the bill balances innovation with robust protections, critics express concerns about loopholes, government overreach, and the lack of recognition for privacy as a fundamental right.
Liberal
Supports Bill C-27: Liberal members expressed strong support for Bill C-27, emphasizing its role in protecting children in the digital age and updating Canada's privacy framework to align with current technologies and business practices.
Modernizing Privacy Laws: Members highlighted the urgent need to modernize privacy laws to address the exponential growth of data and the emergence of new technologies like social media and AI. The goal is to give Canadians more control over their data and ensure responsible innovation.
Balancing Innovation: Liberals stressed the importance of balancing strong privacy protections with responsible innovation, allowing businesses to innovate while ensuring they use data responsibly. They mentioned a new exception to consent for activities in which an organization has a legitimate interest, with safeguards to prevent abuse.
Protecting Minors' Data: A key focus was on enhancing the protection of minors' personal information, defining it as sensitive and requiring higher standards of protection. The bill aims to give parents and minors more power over this information, including the ability to have it deleted.
Regulating Artificial Intelligence: The Liberals emphasized the need to regulate AI to mitigate potential harms, including bias and discrimination, while supporting responsible AI development. The bill seeks to establish clear expectations and regulations for high-impact AI technologies.
Global Interoperability: Members noted the importance of maintaining Canada's adequacy status with the European Union's GDPR and ensuring interoperability with international partners. The bill aims to align with international best practices and facilitate cross-border data flows.
Enforcement and Accountability: The legislation would strengthen privacy protection by granting the Privacy Commissioner more powers and establishing tougher penalties for non-compliant organizations. A new tribunal would be created to hear appeals and impose penalties.
Conservative
Privacy not a right: Conservatives argue that the bill fails to recognize privacy as a fundamental human right. They assert that this omission weakens the bill, making it easier for industry players to be irresponsible with personal data and failing to align with international declarations on human rights.
Consent is too vague: The Conservatives claim the bill relies on a flawed 'notice and consent' model, and that the exceptions, particularly 'legitimate interest,' are too broad and undefined. They worry that businesses will determine what constitutes a legitimate interest, trivializing privacy, and that implied consent is not sufficient.
Tribunal is unnecessary: The Conservatives criticize the bill for creating a bureaucratic tribunal instead of empowering the Privacy Commissioner. They believe the tribunal will cause delays and that the Privacy Commissioner should have the authority to levy fines directly, aligning with practices in other countries.
AI portion inadequate: Conservatives contend that the AI portion of the bill requires a complete rewrite and should be split into its own bill. They argue it lacks independent oversight and gives excessive power to the Minister of Innovation, Science and Economic Development to make political decisions on privacy.
NDP
Supports sending to committee: The NDP supports sending Bill C-27 to committee for further study and amendments. They believe it is important to modernize Canada's privacy laws and establish rules around data governance.
Splitting the bill: The NDP have asked for separate votes on the artificial intelligence and data act, arguing that it deals with distinct issues from the rest of the bill, and should be considered separately.
Falls short of standards: The NDP believes that Bill C-27 does not meet the standards set by GDPR and other privacy legislation around the world, and that numerous amendments are required to strengthen consumer protections and ensure accountability.
Need for stronger rights: The NDP is concerned that the bill is lopsided towards the business sector and does not adequately protect individual rights, they will propose amendments to ensure informed consent and better protection for individuals.
Bloc
Supports Bill C-27 principle: The Bloc supports the principles of Bill C-27. However, members suggest that the Bill, which combines the consumer privacy protection act and the artificial intelligence and data act, should be split into two separate bills.
Privacy as a fundamental right: Bloc members believe that the time has come to treat privacy as a fundamental right. While Bill C-27 is an improvement, it still does not establish privacy as a fundamental right.
Harmonization with Quebec law: Since privacy protection is a shared jurisdiction, it is vital that Bill C‑27 not take precedence over Quebec law. Clause 122(2) of Bill C‑27 allows for exemptions where provincial legislation is substantially similar and applies within that province, such as Quebec's Bill 25.
Need for further study: The Bloc will support the bill at second reading but believe the real work must be done in committee. Good principles do not necessarily make good laws, and the committee needs to hear from witnesses from all walks of life. When it comes to privacy, it only takes one tiny flaw to bring down the whole structure.
Green
Concerns with AI regulation: The Green Party acknowledges the complexity of regulating artificial intelligence and data, emphasizing the need for thorough study and consideration of potential unintended consequences. They suggest that the AI and data act (part 3 of the bill) may warrant separate committee study to ensure comprehensive review and understanding.
Privacy for political parties: The Green Party believes that privacy legislation should apply to political parties, which are currently exempt. They advocate for adding political parties to the list of organizations obligated to protect the privacy of Canadians.
Potential privacy issues: The Green Party raises concerns that the legislation could weaken some privacy protections, referencing an assessment that gives the bill a low passing grade. They intend to propose amendments to address these concerns during the committee stage.
Clarify privacy exemptions: The Green Party agrees with concerns raised about overly broad exemptions within the bill, specifically referencing subclause 18(3). They emphasize the need for further clarification regarding what constitutes a "legitimate" reason for invading people's privacy.
Madam Speaker, it is a question that has come up many times, even when we look at PIPEDA historically. Why were political parties excluded? They seem to have fallen into a no man's land, in many respects, when it comes to privacy and data protection. I would be interested to know why and, if not, how we can work to better protect the data of Canadians when it comes to political parties. Definitely, it is a very worthwhile question that the member has raised.
Links & Sharing
Digital Charter Implementation Act, 2022Government Orders
Pursuant to Standing Order 69.1, the first question is on parts 1 and 2, including the schedule to clause 2 of the bill.
If a member of a recognized party present in the House wishes that parts 1 and 2, including the schedule to clause 2 of the bill be carried or carried on division or wishes to request a recorded division, I would invite them to rise and indicate it to the Chair.
Links & Sharing
Digital Charter Implementation Act, 2022Government Orders
The recorded division on parts 1 and 2, including the schedule to clause 2 of the bill stands deferred.
The next question is on part 3 of the bill.
If a member of a recognized party present in the House wishes that part 3 of the bill be carried or carried on division or wishes to request a recorded division, I would invite them to rise and indicate it to the Chair.
Links & Sharing
Digital Charter Implementation Act, 2022Government Orders
The recorded division on part 3 of the bill stands deferred.
Normally at this time, the House would proceed to the taking of the deferred recorded divisions at the second reading stage of the bill. However, pursuant to order made on Thursday, June 23, 2022, the recorded division stands deferred until Monday, April 24, at the expiry of the time provided for Oral Questions.
Links & Sharing
Digital Charter Implementation Act, 2022Government Orders
Madam Speaker, I suspect if you were to canvass the House, you would find unanimous consent at this time to see the clock at 5:30 p.m. so that we could begin the Private Members' Business hour.
Links & Sharing
Digital Charter Implementation Act, 2022Government Orders
It being 3:13 p.m., pursuant to order made on Thursday, June 23, 2022, the House will now proceed to the taking of the deferred recorded division on the motion at the second reading stage of Bill C-27.
Call in the members.
The question is on the motion. Pursuant to Standing Order 69.1, the first question is on parts 1 and 2, including the schedule to clause 2 of the bill.
Links & Sharing
(The House divided on the motion on parts 1 and 2, which was agreed to on the following division:)
