An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts

This bill overhauls Canada's private-sector privacy law. It repeals the main consumer privacy rules currently in the Personal Information Protection and Electronic Documents Act (PIPEDA), which is renamed the Electronic Documents Act and stripped down to its original electronic-signature/document provisions, and replaces them with a new stand-alone law called the Protecting Privacy and Consumer Data Act. This new law applies to businesses that collect, use, or share personal information in commercial activity, and to federally regulated employers regarding their employees.

The new law sets out detailed rules organizations must follow: obtaining meaningful consent before collecting personal data (with plain-language disclosure requirements), limiting collection to what's necessary, keeping information accurate and secure, disposing of it when no longer needed, and being transparent about their privacy practices. It creates numerous specific exceptions where consent isn't required, such as routine business activities, fraud prevention, emergencies, legal investigations, journalism, and disclosures to law enforcement or government agencies in defined circumstances. It gives individuals new rights, including the right to request access to and correction of their data, to withdraw consent, to request deletion in some cases, to receive explanations when automated decision-making systems affect them, and to move their data between organizations under a "data mobility" framework. Special attention is given to children's data and "sensitive" information.

Enforcement is significantly strengthened. A new Digital Safety and Data Protection Commission of Canada is established, along with a dedicated Privacy and Consumer Data Commissioner and a Privacy and Consumer Data Division, replacing the current Privacy Commissioner's ombudsman-style oversight of this area. The Commission can investigate complaints, order audits, negotiate compliance agreements, issue binding compliance orders, and impose substantial monetary penalties (up to the greater of $10 million or 3% of global revenue for a set of contraventions, and up to $25 million or 5% of global revenue for certain offences prosecuted criminally). Individuals also gain a private right of action to sue organizations for damages once a contravention has been established. Decisions can be appealed to the Federal Court.

The remainder of the bill makes consequential changes to other statutes (such as the Access to Information Act, Privacy Act, Competition Act, Telecommunications Act, and Canada Business Corporations Act) to reflect the new law and the renamed Commission, and includes transitional and coordinating provisions plus a requirement for Parliament to review the new Act every five years.

This bill replaces PIPEDA with a new Protecting Privacy and Consumer Data Act and creates a Commission, Commissioner and Division with rule-making, investigation, audit and penalty powers over organizations' handling of personal information.

• New enforcement body — the existing Digital Safety Commission of Canada is renamed the Digital Safety and Data Protection Commission of Canada, gaining privacy jurisdiction; its five members are appointed by the Governor in Council (Cabinet) to hold office "during good behaviour," removable only for cause; a Privacy and Consumer Data Commissioner is designated by Cabinet from among its members.
• Rule-making left to regulation — Cabinet may make regulations on de-identification, retention, security safeguards, what counts as a "business activity," data mobility frameworks, and criteria for provinces' laws being "substantially similar," leaving the operational detail to future regulation rather than the Act itself.
• Investigative and entry powers — the Commissioner and Commission may summon witnesses, compel sworn testimony, order retention of records, and enter any premises other than a dwelling-house on reasonable notice to conduct audits or investigations.
• Penalties — administrative monetary penalties up to the greater of $10,000,000 or 3% of an organization's global gross revenue per investigation; criminal offences for knowing contraventions (e.g., breach reporting, obstruction) carry fines up to the greater of $25,000,000 or 5% of global revenue (indictable) or $20,000,000 or 4% (summary).
• Individual remedies and exceptions — individuals gain a private right of action for damages after a finding of contravention, but organizations may collect, use or disclose personal information without knowledge or consent in numerous listed circumstances (business activities, "legitimate interest," fraud detection, debt collection, emergencies, law enforcement and national-security requests, journalistic purposes, and more), each subject to conditions defined in the Act or left to regulation.
• Oversight — Commission decisions can be appealed to the Federal Court; a compliance-agreement route lets the Commissioner settle matters without penalty; a parliamentary committee must review the Act every five years, but there is no sunset clause ending the powers themselves.