Canada's Proposed Privacy Law: Do You Know Where Your Data Goes?
Bill C-36 would replace the privacy part of PIPEDA, and one change many firms won't see coming is a documented assessment before personal information leaves Canada. Here's what's proposed and how to prepare.
A Bill Worth Preparing For
The federal government has introduced Bill C-36, a proposed law that would replace the privacy part of PIPEDA. In Ontario, PIPEDA is the law that governs how most private businesses handle personal information today.
The bill isn't law yet, and it may change as it moves through Parliament. But its direction is clear, and some of what it asks for takes time to prepare.
What Would Change
As proposed, the law would bring several notable changes:
A regulator with real teeth
Privacy oversight would move to a new federal regulator with the power to issue binding orders, something the current Privacy Commissioner largely can't do.
Significant penalties
Fines for serious breaches of the law could be substantial.
Clearer consent
Organizations would need to explain in plain language why they collect information, how they'll use it, and who they'll share it with.
Assessments before data leaves Canada
A documented privacy assessment would be required before personal information is sent or stored outside the country.
Privacy as a fundamental right
The bill frames privacy this way, which could influence how the law is applied.
Why the Cross-Border Rule Matters
This is the change most firms may not see coming.
Most firms send personal information outside Canada every day without thinking about it. Cloud storage, email filtering, e-signature platforms, practice and claims management software, and AI tools are often hosted in the United States or elsewhere.
Under the proposed rule, each of those could need a documented assessment of the risks and the steps taken to reduce them. For a law firm handling client files, an insurer handling claims, or a property manager handling tenant information, that's a meaningful amount of work if it's left until the last minute.
The AI Question
AI tools deserve particular attention. Staff often paste client details into free AI services to summarize a document or draft a reply, without knowing where that information goes, how long it's kept, or whether it's used to train the tool.
Even before any new law, that's worth addressing. Under stricter rules, it becomes harder to ignore.
What to Do Now
- 1.Map your data. List the systems and vendors that hold client and personal information, and where each one stores it.
- 2.Prefer Canadian storage. Many cloud services offer a Canadian data location. Where they do, use it.
- 3.Review vendor contracts. Check where data is stored, who can access it, and how quickly you'd be told about a breach.
- 4.Set an AI policy. Be clear about which AI tools staff can use, and what information can go into them.
- 5.Review your privacy notices. Make sure they explain, in plain language, what you collect and why.
- 6.Watch the bill. Changes are most likely during committee review. There's time to prepare, but not a reason to wait.
General information only, not legal advice. Speak with counsel about how the proposed law may apply to your organization.
Do you know where your clients' data lives?
VSIT helps clients understand where their data lives and put sensible AI policies in place. Email [email protected] or call 416.466.4079. Toll-free 888.232.9030.
Book a Free Assessment