After 25 years, Ottawa has finally caught up to the data economy, but not yet to the companies running it.
On June 15, the federal government tabled Bill C-36, the first overhaul of Canada’s privacy law in more than 25 years. The statute it replaces, Personal Information Protection and Electronic Documents Act, is older than the technology it now has to govern, written for a web of static pages and dial-up commerce, not targeted advertising and machines that make decisions about people on their own.
For years, corporations have had almost unimpeded access to collect, buy, bargain, and sell the data of unsuspecting Canadians, unchecked by law. That access has bought them an unprecedented, intimate understanding of our shopping habits, our daily routines, our search histories, cross-referenced and resold until the firms holding it know us more completely than we know ourselves.
To say this arrangement is unacceptable is an understatement, and federal regulation protecting Canadians’ private data is years overdue.
Yet, as the old saying goes, better late than never.
Make no mistake, the provisions of Bill C-36 reflect tangible progress. Two provisions in particular, the first being that companies are required to treat the data of Canadians under the age of 18 as sensitive by default, and the second being that Canadians now possess the legal right to demand companies delete their data upon request— will materially provide more protection to Canadians, especially those least equipped to protect themselves
Bill C-36 is also a pointed assertion of Canadian sovereignty. The companies that are the target of Bill C-36 are almost exclusively US-based corporations, with many of their executives openly courting Donald Trump’s circle. In an age where Trump is all too willing to wage economic warfare on Canada, the case for American appeasement, which has traditionally been the stopgap for like-minded legislation in the past, simply doesn’t hold as much weight anymore.
The last time Ottawa moved against American tech, over the digital services tax, Trump called it a “direct and blatant attack,” tore up trade talks, and Canada folded within days. Asserting sovereignty is the easy part, but holding it under pressure is the test, and Canada has failed it once already. Bill C-36 is a notable, and positive, deviation from this trend.
Yet, for all it gets right, Bill C-36 regulates how corporations gather and store our data, not whether that data should be harvested in the first place. The systemic engine, an economy built on extracting and reselling the details of people’s lives, is left running untouched. A bill that polices the terms of collection can only do so much when collection itself is the problem.
Surveillance pricing, where a company quietly charges you more based on what it knows about you, goes effectively unaddressed, and the price gouging that data enables is barely slowed.
No single piece of legislation was ever going to close every gap, and that is the point. C-36 is a start, and the work of protecting Canadians demands far more regulation than this.
The firms on the other side of this legislation are some of the largest on earth, with budgets that dwarf most provinces and infrastructure sitting in the pocket of nearly every Canadian. Against opponents that size, the bill’s penalties barely register. A fine of $10 million or three per cent of global revenue is a figure the biggest of them will pay without blinking, a rounding error weighed against what the data itself is worth. These are companies that have spent decades treating the law as an obstacle to route around rather than a limit to respect, and a single bill does not reverse a power gradient that steep.
So, support the bill and pass it without delay. But see it for what it is, a first concession from an industry that gave up nothing for decades, and a floor to build on rather than a finish to settle for.
– Journal Editorial Board
Tags
Canadian politics, data collection, digital privacy
All final editorial decisions are made by the Editor(s) in Chief and/or the Managing Editor. Authors should not be contacted, targeted, or harassed under any circumstances. If you have any grievances with this article, please direct your comments to journal_editors@ams.queensu.ca.