Privacy Law Reform
Issue at a Glance
Canada is facing the most significant changes to its private sector privacy laws in decades.
With privacy rules under reform across Canada, the CMA has been actively engaged with federal and provincial governments to provide feedback on behalf of the marketing community, and to ensure coordination of privacy rules across the country.
The CMA, in consultation with our Privacy and Data Committee, is engaged with governments at all levels on important issues related to privacy law reform. On this page, you can find more information about changes to the law, and the CMA’s advocacy initiatives.
For information on privacy compliance and best practices, including our guides and resources for the marketing community, please see our Privacy Protection webpage.
CMA Articles
- What you should know: Final consent guidance from Quebec's privacy regulator
- CMA urges speedy adoption of privacy law at House of Commons committee meeting in Ottawa
- Experts weigh in on recent developments in Canada’s privacy and AI landscape
- Bill C-27 – CMA was in the room where it happened
- Quebec's privacy regulator consults on consent rules
- CMA Op-Ed: It's time to bring Canada's privacy law into the digital age
- CMA Op-Ed: Canadian's can't wait for consumer privacy reform (joint association)
- Expert insights into Canada’s changing privacy and AI rules
- What the new privacy bill means for marketers
- Privacy rules set to change across the provinces
- CMA Op-Ed: Canada's new privacy bill must be tabled before parliamentary summer recess
- CMA Op-Ed: Europe’s privacy law tells a cautionary tale for Canada’s Digital Charter
- Marketing within the rules: Wrapping up 2021
- Quebec adopts new privacy law
- CMA Op-Ed: Innovation can't wait
- Canada introduces new privacy legislation. Here is what marketers need to know
- CMA Advocacy in Action: 2020 year in review
- CMA elevates marketing's voice on data privacy
- Privacy Update - Provincial privacy law reform, final CCPA regulations and more
- Government Releases Digital Charter, announces review of PIPEDA and more
CMA Resources
- CMA Report: Canada’s Privacy Law Priorities: Better Protections for Canadians + Innovation for Economic Growth (EN/ FR)
- Detailed overview of Bill C-27 (Members only) | Non-member overview
- CMA Report: Privacy Law Pitfalls: Lessons learned from the European Union (EN/ FR)
- CMA Preliminary Overview of Bill C-11 (Members only)
CMA Responses
- CMA Letter to the Standing Committee on Industry and Technology - A More Effective “Made in Canada” Approach to Privacy Law: Amendment needed to the Consumer Privacy Protection Act
- CMA Letter to the Standing Committee on Industry and Technology - A More Effective Approach to Protecting Young People’s Data: Amendment needed to the Consumer Privacy Protection Act
- CMA Presentation: House of Commons Standing Committee on Industry and Technology regarding its study of Bill C-27
- CMA Response to the Standing Committee on Industry and Technology on the proposed Consumer Privacy Protection Act contained in Bill C-27
- CMA Response to the Commission D'Access A l'information On Criteria For Valid Consent
- CMA Signs Statement Urging Parliaments to Prioritize Bill C-11
- Government of Ontario's Consultation on Strengthening Privacy Protections in Ontario
- Proposed amendments (Bill 64) to Quebec’s private sector privacy law – French or English
- Feedback to Special Committee Reviewing British Columbia's Personal Information and Protection Act (PIPA)
- OPC Proposals for Ensuring the Appropriate Regulation of Artificial Intelligence
- Federal Government's PIPEDA Reform Proposals
- OPC Consultations on Transfers for Processing (available by request)
- OPC Consent and Privacy’ Discussion Paper (available by request)
In June 2022, the government introduced Bill C-27 in the House of Commons. This was the second major attempt to change Canada's federal privacy law in two decades.
Bill C-27 proposes to replace PIPEDA with a new Consumer Privacy Protection Act (CPPA).
The bill – with amendments in a few key areas - proposes a fair and effective approach to update Canada’s federal privacy law, and the CMA will be actively involved in the legislative process – making submissions and meeting with officials to provide our perspectives on key aspects of the law.
Ontario: After wrapping up a summer 2021 consultation on the possibility of bringing a private sector privacy law to Ontario for the first time, Ontario is expected to continue to rely on federal law for private sector privacy protection.
British Columbia: A Special Committee of the Legislative Assembly consulted on reforming BC’s private sector privacy law, the Personal Information Protection Act (BC PIPA), in summer 2021. In December 2021, it released a report with 34 recommendations for reform, highlighting a number of important recommendations from the CMA
Alberta: In summer 2021, Alberta launched a brief survey on the need to reform its own Personal Information Protection Act (AB PIPA). The survey did not include detailed proposals for reform, and more consultations are expected.
See the CMA’s responses to the above consultations here.
Quebec: Most provisions of Quebec’s new privacy law - Law 25 - came into effect in September 2023. The new law, which includes significant enforcement penalties, new GDPR-like rights for consumers, and stringent consent and transparency requirements, has had important consequences for companies that do business in Quebec and those that handle the personal information of Quebec residents.
The Quebec Privacy Regulator (“the CAI”)’s official guidance on consent practices under Law 25 was released in November 2023. CMA members can access an English version of the CAI’s new consent guidelines (electronically translated) here.
The CMA provided feedback on an earlier draft version of the guidance here.
The GDMA Global Privacy Principles serve as an ethical framework and best practice guidance for the global data and marketing industry.
A key aim of the new principles is to establish best practice guidance that the global data and marketing industry can use to strengthen existing self-regulatory privacy initiatives and codes worldwide. The principles will help organizations cultivate consumer trust and deliver a better customer experience by adhering to strong privacy principles – from being clear and transparent to respecting individual choices with respect to personal information.
The CMA is a champion of Data Privacy Week, an international effort to empower individuals and encourage businesses to respect privacy, safeguard data and enable trust.
For questions or comments about privacy law reform, marketers are encouraged to reach out to Fiona Wilson, CMA’s Director, Public Policy and Chief Privacy Officer.
