TL;DR
Canada’s Bill C-36 would replace PIPEDA, capping control prices and creating a regulator that could fine companies up to C$25 million or 5% of revenue.
The Canadian government introduced the bill on Monday revising the country’s private-sector privacy laws, including new restrictions on businesses using personal information to charge higher prices to individual consumers. Bill C-36, the Privacy and Consumer Information Protection Act, would replace the Privacy and Electronic Documents Act, a law first passed in 1998 that was widely criticized as outdated in an era of algorithmic pricing and large-scale data collection.
Artificial Intelligence and Digital Innovation Minister Evan Solomon said the bill targets the practice of using a consumer’s browsing history, location, device type or purchasing behavior to set personalized prices, called control pricing. “Companies should not be able to use your behavior, location, profile, vulnerabilities or personal information to get unfair prices,“Suleyman told reporters.”Your personal information should not be used against you for price gouging.“
The bill does not outright ban surveillance pricing. Solomon said the legislation aims to prohibit the use of data to target consumers with personalized pricing when the harms outweigh the benefits, but the government does not want to prevent companies from rewarding consumers with better prices through loyalty programs or promotional discounts. According to BetaKit, control pricing is not specifically mentioned in the bill’s text, and Solomon will instead ask the new regulator to draft guidance on the issue once it takes office.
💜 of EU technology
The latest rumblings from the EU tech scene, a story from our wise founder Boris and some questionable AI art. Free in your inbox every week. Register now!
This regulatory gap is significant. The bill creates a new body, the Digital Safety and Data Protection Commission, to oversee compliance with both privacy legislation and the Digital Safety Act, which aims to protect children online. The Office of the Privacy Commissioner of Canada will be responsible for overseeing the government’s compliance with federal privacy laws, but the new commission will oversee the private sector.
Penalties are huge on paper. The commission can impose fines of up to C$10 million ($7.1 million) or 3% of global revenue, whichever is greater, for non-compliance. The most serious violations can face fines of up to C$25 million or 5% of global revenue. Whether these penalties are ever imposed will depend on whether the bill passes Parliament and how aggressively the commission interprets its mandate.
Aside from price controls, the bill introduces several consumer protections that bring Canada closer to the European Union’s General Data Protection Regulation. Canadians will have the right to have their personal information deleted under certain conditions. Organizations will be required to disclose more information about automated decisions that affect consumers. Children’s information will be classified as sensitive and a higher standard of care will be required from any business that collects it.
Canada is not acting in isolation. The Manitoba provincial government introduced Bill 49 in March, which prohibits retailers from using personal information to raise prices for individual consumers, both online and in stores. In the US, Maryland Governor Wes Moore signed HB 895, becoming the first state to ban grocery retailers larger than 15,000 square feet and third-party delivery services from using personal information to inflate prices for individual shoppers. That law comes into force on October 1.
Public opinion in Canada strongly favors action. An Abacus Data poll in early March polled 1,931 Canadians and found 52% said observation pricing should be banned outright, while 31% said it should be allowed but more heavily regulated. The bill’s restrictive rather than prohibitive approach brings the government closer to minority opinion Carney’s $2.3 billion broader national AI strategy had already hinted that the new privacy legislation was coming without specifying how far it would go.
The privacy bill comes two weeks and days after the AI ​​strategy was launched Carney warned at the G7 about the systemic risks of relying on artificial intelligence. The timing suggests that the government is simultaneously trying to create a coherent regulatory framework for AI investment, data sovereignty and consumer protection. Whether those pieces fit together or conflict with each other, spending $2.3 billion to accelerate AI adoption by limiting how AI-based pricing can use consumer data, will depend on the details the new commission ultimately produces.
The bill still needs to go through parliament. An attempt to modernize Canada’s previous privacy framework, the Artificial Intelligence and Data Act under Bill C-27, never made it through the legislative process and was never reinstated. If Bill C-36 meets the same fate, the country will continue to operate under a privacy law that was written before smartphones existed. other jurisdictions are moving forward with enforcement own digital protection modes.
