When the federal government introduced Bill C-36 in June 2026 to modernize Canada's private-sector privacy rules, it followed six years of stalled legislative efforts. The new bill replaces Bill C-27, the Digital Charter Implementation Act, 2022, which spent more than two and a half years in Parliament before expiring on the Order Paper on January 6, 2025.

Bill C-27 was introduced in June 2022 as Canada's federal response to modern digital commerce and emerging artificial intelligence. It passed second reading with cross-party support in April 2023. However, the bill stalled in the House of Commons Standing Committee on Industry and Technology (INDU).

Disputes over artificial intelligence regulation, procedural friction regarding a new administrative appeals tribunal, and criticism that the bill failed to treat privacy as a fundamental human right prevented it from reaching a final vote before the 44th Parliament dissolved.

With Parliament now debating its replacement, Bill C-36, the legislative history of Bill C-27 explains why that reform failed and how the new legislation alters the federal approach.

For our full breakdown of the replacement legislation, see Canada's Bill C-36 Explained: The Protecting Privacy and Consumer Data Act.

What Was Bill C-27?

Tabled on June 16, 2022, by then-Minister of Innovation, Science and Industry François-Philippe Champagne during the 44th Parliament, Bill C-27 was designed to replace the commercial provisions of the Personal Information Protection and Electronic Documents Act (PIPEDA).

The bill was divided into three enactments:

  1. Part 1: The Consumer Privacy Protection Act (CPPA): The core privacy statute, which updated rules for commercial consent, added data mobility and deletion rights, and established financial penalties for non-compliance.
  2. Part 2: The Personal Information and Data Protection Tribunal Act (PIDPTA): Created an administrative tribunal to review decisions of the Privacy Commissioner of Canada and determine Administrative Monetary Penalties (AMPs).
  3. Part 3: The Artificial Intelligence and Data Act (AIDA): Canada's first statutory framework for artificial intelligence, establishing criminal and civil penalties for unlawful data handling in AI systems and requiring risk-mitigation measures for high-impact AI systems.

On April 24, 2023, the House of Commons passed Bill C-27 at second reading in two recorded divisions: Vote 300 (approving Parts 1 and 2 by 205 to 109) and Vote 301 (approving Part 3 by 203 to 112).

The bill was then referred to INDU, where its initial legislative momentum slowed.

The Four Structural Disputes That Paralyzed Bill C-27

Committee records, witness testimony, and briefs from the Office of the Privacy Commissioner of Canada (OPC) identify four main issues that prevented the bill from advancing.

Core Dispute Problem in Bill C-27 Committee Consequence
1. The AIDA Framework Drafted before generative AI emerged; broad ministerial amendments were introduced mid-study. Opposition members resisted rewriting the statute in committee; requests to split the bill were denied.
2. The Appeals Tribunal Model The Privacy Commissioner had no direct fining power and had to recommend penalties to a separate tribunal. Added an extra adjudicative layer and potential multi-year litigation delays.
3. Economic Balancing vs. Human Rights Treated privacy as a commercial trade-off rather than an explicit fundamental right. Drew persistent criticism from Privacy Commissioner Philippe Dufresne and civil liberties advocates.
4. Gaps in Children's Protections Lacked a dedicated children's code and permitted commercial retention carve-outs for deletion requests. Sparked backlash over continued commercial profiling and data collection of minors.

1. The Artificial Intelligence and Data Act (AIDA)

When Bill C-27 was drafted in early 2022, generative AI systems like ChatGPT had not yet gained widespread public adoption. Consequently, AIDA was drafted as a framework statute, leaving core terms, including the definition of "high-impact system," to future regulations drafted by the minister.

By the time committee hearings began in the fall of 2023, public attention on generative AI had increased significantly. Academics, civil society groups, and industry representatives criticized AIDA as both vague and incomplete. In response, Minister Champagne submitted a 30-page package of amendments to INDU in late 2023, attempting to add new obligations for generative AI and general-purpose AI systems during the committee review.

Opposition MPs, including Conservative digital critic Ryan Williams, Bloc Québécois MP René Villemure, and NDP critic Brian Masse, argued that introducing significant statutory revisions at committee bypassed parliamentary debate. Opposition members and witnesses repeatedly called on the government to split the bill, allowing the privacy sections (CPPA) to proceed while studying AI regulation independently. The government maintained the bill as a package, leading to months of procedural delay in committee.

2. The Appeals Tribunal Model (PIDPTA)

The enforcement framework in Part 2 created another major point of contention. Under Bill C-27, the Privacy Commissioner of Canada received the authority to investigate complaints and issue compliance orders, but not the power to impose financial penalties.

Instead, the Privacy Commissioner had to recommend penalties to the proposed Personal Information and Data Protection Tribunal. The Tribunal was designed as an administrative body of three to six members, with only one required to have privacy expertise. It would hear penalty recommendations de novo, allowing organizations to reargue factual determinations.

Privacy Commissioner Philippe Dufresne and former commissioner Daniel Therrien opposed the tribunal model in committee submissions. Commissioner Dufresne stated that the tribunal introduced unnecessary administrative delay, required individual complainants to defend findings before a second body, and diverged from international counterparts in Europe and the United Kingdom where data protection authorities directly levy administrative fines.

3. Privacy Framed as an Economic Interest

During committee hearings, legal scholars and the OPC criticized the statutory purpose clause in Section 5 of the CPPA. The provision continued PIPEDA's model of balancing an individual's interest in privacy against an organization's commercial need to process personal data.

In his testimony before INDU in October 2023, Commissioner Dufresne called on Parliament to recognize privacy as a fundamental human right:

"Privacy is not simply an economic asset to be traded off against innovation; it is a fundamental human right that is indispensable to individual dignity, personal autonomy, and the health of our democratic institutions."

While the Department of Justice issued a Charter Statement examining the bill under Section 8 (search and seizure) and Section 2(b) (freedom of expression), witnesses warned that an economic framing failed to provide sufficient protection against commercial profiling, behavioral tracking, and algorithmic bias.

4. Children's Privacy Protections

Although Bill C-27 classified the personal information of minors as sensitive, it did not create a distinct children's privacy code.

Witnesses before INDU noted that the bill did not specify a uniform age threshold for minors. In addition, the bill permitted companies to refuse an individual's deletion request if destroying the data would affect the ongoing delivery of a product or service. Child advocacy groups warned that this exception would allow digital platforms and online games to retain children's profiles indefinitely.

Committee Timeline and Final Expiration

Between September 2023 and September 2024, the INDU committee held dozens of meetings and received testimony from more than 100 witnesses representing technology companies, small businesses, academic institutions, and human rights organizations.

Despite extensive study, clause-by-clause consideration moved slowly due to hundreds of proposed amendments across the three parts of the bill. By late 2024, the committee had not completed its review, and the bill never progressed to Report Stage or Third Reading.

When the 44th Parliament dissolved on Monday, January 6, 2025, Bill C-27 died on the Order Paper. It was the second consecutive federal privacy bill to expire without enactment, following Bill C-11 in 2021.

How Bill C-36 Changes the Regulatory Approach

Introduced on June 15, 2026, by Minister of Artificial Intelligence and Digital Innovation Evan Solomon, Bill C-36 (the Protecting Privacy and Consumer Data Act) alters several elements that caused deadlock under Bill C-27:

Issue Bill C-27 (Died January 2025) Bill C-36 / PPCDA (Tabled June 2026) Legislative Remedy in Bill C-36
Enforcement Model Two-tier model: OPC investigates; separate Tribunal (PIDPT) levies fines. Unified regulator: Digital Safety and Data Protection Commission of Canada. Tribunal removed: Direct order-making and direct administrative penalties (up to $10M or 3% global revenue).
AI Legislation Embedded the separate, framework-level AIDA directly in the privacy bill. Decoupled: Standalone AI statute removed. Broad AI policy shifted to the AI for All strategy; online platform safety shifted to Bill C-34 (Safe Social Media Act). Privacy bill focuses strictly on data protection, automated decision transparency, and profiling limits.
Statutory Purpose Balanced individual privacy against business data needs. Explicitly recognizes privacy as a fundamental human right (Section 5). Adopts the Privacy Commissioner's core human-rights recommendation.
Children's Privacy Minors' data recognized generally as sensitive. Dedicated children's code: defines child as under 18; non-derogable right to erasure; mandatory "best interests of children" standard. Closes corporate retention exceptions for children's data.
Surveillance Pricing Permitted business activity exceptions with general restrictions. Strict statutory bar: Consent exceptions are invalid if personal data is used to influence individual behaviour or decisions (Section 18). Prohibits dynamic surveillance pricing and behavioral manipulation without consent.
Cross-Border Transfers Treated as routine service provider transfers under general accountability. Mandatory Privacy Impact Assessments (PIAs) and risk mitigation required before data leaves Canada (Section 57). Enhances data sovereignty and subjects cross-border data flows to regulatory audit.

Next Steps for Privacy Legislation in Canada

The expiration of Bill C-27 left Canada's private-sector data protection governed by PIPEDA, which was enacted in 2000.

By eliminating the separate appeals tribunal, separating frontier AI industrial regulation into a distinct policy track, and adding direct penalties and children's protections, Bill C-36 addresses the primary procedural and legal issues that delayed its predecessor.

Bill C-36 is currently before the House of Commons at second reading. As the legislation moves toward committee review, parliamentarians will examine how its streamlined enforcement model and new corporate obligations function in practice.

Official Sources