Carney government proposes major overhaul of privacy legislation

And in a bid to stop surveillance pricing that some critics say lacks teeth, it beefs up what amounts to “acceptable purposes” of data use to allow a yet-to-be-created regulator to crack down on the emerging practice.

However, there is no sweeping ban on the use of personal data to set individualized prices after a push from major retailers like Instacart, which claimed that it would affect discount programs.

Justifying that move, Artificial Intelligence Minister Evan Solomon said Ottawa wants to stop “price gouging” but also allow for the use of reward points “to get lower prices on food or lower prices on goods.”

“When this law passes, I will be asking the regulator to publish guidance as one of my first acts on surveillance pricing to clarify exactly what that will be,” Solomon told reporters.

The newly-proposed law will be implemented by a new digital safety and data protection commission that will lay out details and have the power to levy hefty multimillion-dollar fines on companies that violate the new rules or refuse to comply with its probes.

That new regulator will replace the federal privacy commissioner as the watchdog for the private sector’s use of data, and will also watch over Ottawa’s recently proposed online harms legislation.

Following previous failed attempts by the Trudeau Liberals, the newly proposed update comes as artificial intelligence reshapes how corporations collect and use consumers’ personal data, and amid questions about how the Canadian government will ensure privacy rights as it encourages widespread AI adoption.

“Canada’s consumer privacy laws are 25 years old. They were written before the iPhone. It was a different time, before AI, before deep fakes,” Solomon told reporters. “And because so much of our lives right now, especially our kids’ lives, have been shaped by platforms, apps and digital services, we’re living in a different world. And our laws need to catch up.”

Florian Martin-Bariteau, a digital law expert at the University of Ottawa, said it was a “great step forward” for privacy rights at first glance, bringing Canada closer to best practices in jurisdictions like the European Union.

But Vass Bednar, a managing director of the think tank The Canadian Shield Institute, said she questions if it “places enough emphasis on protection versus permission,” where as long as consent is obtained, it’s “all systems go.”

Bednar said the surveillance pricing provisions are a big step but “not as strong” as necessary, or as touted by the minister.

One of the biggest changes is the limiting of Canada’s federal privacy commissioner’s mandate to cover only the federal government’s data use, and giving the power to set rules to go after non-compliant corporations to the new regulator, which is not expected to be created for up to 18 months from now.

The new powers are a welcome step that shows “Canada is serious about privacy,” but the timeline for the regulator to get up and running, hire staff, and build a working culture is a cause for concern, Martin-Bariteau said. 

The privacy commissioner, which Solomon said can enforce existing laws until the legislation passes and the new regulator is running, had recently pleaded for stronger enforcement powers after recent investigations into X’s Grok and OpenAI’s ChatGPT found the digital giants’ AI tools violated Canadians’ rights, but he could not force them to comply or fine them.

Under the new regime, the most serious violations of the law are punishable by maximum fines of the greater of up to $25 million or five per cent of a company’s global revenue.

“A single commission of five government appointees will now be responsible both for regulating online speech and content moderation across the country’s largest platforms and for overseeing how every organization in Canada collects, uses and discloses personal information,” said Michael Geist, a digital law expert at the University of Ottawa.

“There is no precedent in Canadian law for this kind of digital superregulator.”

Josh Tabish, the senior director for Canada at the Chamber of Progress, a group representing tech companies, said “I think Canadians will welcome a new privacy right, but the real test is whether this bill protects people’s data without making digital services less useful.”

NDP Leader Avi Lewis, who has been pushing for a ban on surveillance pricing, said he’s worried the Carney government is kicking a crackdown on it down the road.

“The bill doesn’t ban this disturbing practice — in fact, it doesn’t even mention it by name,” he said in a statement. “Instead, it just promises vague regulatory action in the future.”