Privacy Law Reform

Issue at a Glance

Canada is facing the most significant changes to its private sector privacy laws in decades.

With privacy rules under reform across Canada, the CMA has been actively engaged with federal and provincial governments to provide feedback on behalf of the marketing community, and to ensure coordination of privacy rules across the country.

The CMA, in consultation with our Privacy and Data Committee, is engaged with governments at all levels on important issues related to privacy law reform. On this page, you can find more information about changes to the law, and the CMA’s advocacy initiatives.

For information on privacy compliance and best practices, including our guides and resources for the marketing community, please see our Privacy Protection webpage.

CMA Articles

CMA Resources

CMA Report: Canada’s Privacy Law Priorities: Better Protections for Canadians + Innovation for Economic Growth (EN/ FR)
Detailed overview of Bill C-27 (Members only) | Non-member overview
CMA Report: Privacy Law Pitfalls: Lessons learned from the European Union (EN/ FR)
CMA Preliminary Overview of Bill C-11 (Members only)

CMA Responses

CMA Response to the Standing Committee on Industry and Technology on the proposed Consumer Privacy Protection Act contained in Bill C-27
CMA Response to the Commission D'Access A l'information On Criteria For Valid Consent
CMA Signs Statement Urging Parliaments to Prioritize Bill C-11
Government of Ontario's Consultation on Strengthening Privacy Protections in Ontario
Proposed amendments (Bill 64) to Quebec’s private sector privacy law – French or English
Feedback to Special Committee Reviewing British Columbia's Personal Information and Protection Act (PIPA)
OPC Proposals for Ensuring the Appropriate Regulation of Artificial Intelligence
Federal Government's PIPEDA Reform Proposals
OPC Consultations on Transfers for Processing (available by request)
OPC Consent and Privacy’ Discussion Paper (available by request)

In June 2022, the government introduced Bill C-27 in the House of Commons. This was the second major attempt to change Canada's federal privacy law in two decades.

Bill C-27 proposes to replace PIPEDA with a new Consumer Privacy Protection Act (CPPA).

The bill – with amendments in a few key areas - proposes a fair and effective approach to update Canada’s federal privacy law, and the CMA will be actively involved in the legislative process – making submissions and meeting with officials to provide our perspectives on key aspects of the law.

Ontario: After wrapping up a summer 2021 consultation on the possibility of bringing a private sector privacy law to Ontario for the first time, Ontario is expected to continue to rely on federal law for private sector privacy protection.

British Columbia: A Special Committee of the Legislative Assembly consulted on reforming BC’s private sector privacy law, the Personal Information Protection Act (BC PIPA), in summer 2021. In December 2021, it released a report with 34 recommendations for reform, highlighting a number of important recommendations from the CMA

Alberta: In summer 2021, Alberta launched a brief survey on the need to reform its own Personal Information Protection Act (AB PIPA). The survey did not include detailed proposals for reform, and more consultations are expected.

See the CMA’s responses to the above consultations here.

Quebec: Most provisions of Quebec’s new privacy law - Law 25 - came into effect in September 2023. The new law, which includes significant enforcement penalties, new GDPR-like rights for consumers, and stringent consent and transparency requirements, has had important consequences for companies that do business in Quebec and those that handle the personal information of Quebec residents.

The Quebec Privacy Regulator (“the CAI”)’s official guidance on consent practices under Law 25 was released in November 2023. CMA members can access an English version of the CAI’s new consent guidelines (electronically translated) here.

The CMA provided feedback on an earlier draft version of the guidance here.

The GDMA Global Privacy Principles serve as an ethical framework and best practice guidance for the global data and marketing industry.

A key aim of the new principles is to establish best practice guidance that the global data and marketing industry can use to strengthen existing self-regulatory privacy initiatives and codes worldwide. The principles will help organizations cultivate consumer trust and deliver a better customer experience by adhering to strong privacy principles – from being clear and transparent to respecting individual choices with respect to personal information.

The CMA is a champion of Data Privacy Week, an international effort to empower individuals and encourage businesses to respect privacy, safeguard data and enable trust.

For questions or comments about privacy law reform, marketers are encouraged to reach out to Fiona Wilson, CMA’s Director, Public Policy and Chief Privacy Officer.