Canada proposes sweeping digital safety and privacy regulator

In June the Liberal government introduced two tech‑policy bills: Bill C‑34, aimed at digital safety, and Bill C‑36, focused on privacy. Bill C‑34 would require social‑media platforms to temporarily block access for users under 16 and impose a duty of responsibility on AI‑chatbot providers. Bill C‑36 raises standards for organisations handling children’s data, gives Canadians a right to request deletion of their information and mandates transparency about automated decision‑making that significantly affects individuals.

Both measures would be overseen by a new Digital Safety and Data Protection Commission of Canada, a five‑member body appointed by the cabinet and expected to be operational within about 18 months. The commission would have authority to issue binding orders and levy fines of up to $10 million or 3 % of an organisation’s global revenue, rising to $25 million or 5 % for the most serious offences. It would decide on the effectiveness of age‑verification methods, exemptions to the under‑16 ban and other implementation details.

University of Ottawa law professor Michael Geist has called the body a “digital super‑regulator,” noting its “astonishing powers that may be unmatched anywhere in the democratic world.” The dual‑mandate approach differs from other jurisdictions, such as Australia, which separate privacy and safety regulators.