7.3 Canada's PIPEDA & Bill C-27

Canada has had a federal private-sector privacy law since 2001 — more than two decades before most of its G7 peers even began drafting comprehensive legislation. But that law is now showing its age, and a major reform is working its way through Parliament.

PIPEDA: the current framework

The Personal Information Protection and Electronic Documents Act (PIPEDA) came into force in 2001 and was last substantively amended through the Digital Privacy Act in 2015. PIPEDA governs how private-sector organisations collect, use, and disclose personal information in the course of commercial activity. It applies across Canada except in provinces that have passed "substantially similar" provincial legislation (Alberta, British Columbia, and Quebec for private-sector activities).

PIPEDA is built on ten Fair Information Principles — derived from the Canadian Standards Association Model Code (1996) — covering: accountability, identifying purposes, consent, limiting collection, limiting use and disclosure, accuracy, safeguards, openness, individual access, and challenging compliance. The principles-based approach gives organisations flexibility to apply them proportionally, but critics argue it produces inconsistent outcomes.

The Office of the Privacy Commissioner (OPC)

PIPEDA is enforced by the Privacy Commissioner of Canada (OPC), an independent officer of Parliament. The OPC investigates complaints, conducts audits, and publishes guidance — but its powers are limited: it can make recommendations but, unlike many EU supervisory authorities, cannot issue binding fines directly. To obtain binding orders, the OPC must refer a matter to the Federal Court, which can award damages.

Bill C-27: the proposed reform

Bill C-27 (Consumer Privacy Protection Act, Digital Charter Implementation Act 2, 2022) would replace PIPEDA with three new pillars:

1. Consumer Privacy Protection Act (CPPA) — strengthened consent rules, a right to erasure (in some circumstances), data portability, and algorithmic transparency requirements for automated decision systems that significantly affect individuals.
2. Personal Information and Data Protection Tribunal Act — a new tribunal with binding enforcement powers and fines up to 3% of global revenue (or CAD $10 million) for ordinary violations, and up to 5$10million)forordinaryviolations,andupto525 million) for the most serious violations.
3. Artificial Intelligence and Data Act (AIDA) — a framework for high-impact AI systems (AIDA is the first dedicated AI governance statute in North America).

As of 2024, Bill C-27 has passed the House of Commons and is before the Senate. The AIDA component has been the most contested, with calls from some quarters to separate it from the privacy bills.

Quebec Law 25: already in force

While federal reform proceeds slowly, Quebec moved decisively. Law 25 (Bill 64, "Act to modernize legislative provisions as regards the protection of personal information") was passed in 2021 and implemented in three phases, with the most significant obligations in force from September 2023. Law 25 is closely aligned with the GDPR: it introduces a right to erasure, data portability, privacy impact assessments, mandatory breach notifications, and the role of a "person in charge of the protection of personal information" (analogous to a Data Protection Officer). Law 25 applies to any organisation processing personal data of Quebec residents — including foreign organisations.

Your takeaway

Canada sits at a crossroads: its current law is principles-based but weakly enforced, while reform bills with strong GDPR-aligned rights are in motion. Quebec's Law 25 is already reshaping obligations for businesses operating in that province — and prefigures where the federal framework is heading.