Ottawa’s Privacy Bill Needs a Regulator-Creep Test

Privacy rights are overdue. But Canadians should not have to accept a new black-box digital regulator to get them.

The Liberal government introduced another attempt to rewrite Canada’s private-sector privacy law on June 15. On paper, several promises sound sensible: recognize privacy as a fundamental right, require meaningful consent, force plain-language explanations of how personal information is handled, create stronger rules around children’s data, and give Canadians a right to request deletion of information companies should no longer hold.

Those are not fringe concerns. Canadians live in an economy where apps, banks, retailers, insurers, employers and platforms collect data constantly. Artificial intelligence, deepfakes, surveillance pricing and algorithmic decision-making make yesterday’s privacy rules look dangerously thin. A conservative accountability standard can acknowledge that reality without giving the government a blank cheque.

The red flag is institutional. The Canadian Press reported that the new bill would be administered by a new Digital Safety and Data Protection Commission of Canada. That same regulator would also be responsible for Ottawa’s recently introduced digital safety provisions, while the federal Privacy Commissioner would no longer oversee private-sector privacy and would remain focused on the Privacy Act covering government.

That is a major machinery-of-government shift. The Liberals are not merely adding enforcement powers to the existing privacy watchdog. They are moving private-sector privacy into a broader digital-safety bureaucracy that is already tied to online harms, platform rules, children’s safety and chatbot regulation. Maybe the government can justify that. But it has to prove the new structure protects Canadians from corporate abuse without becoming a centralized internet-control office.

Start with independence. Who appoints the commissioners? What can cabinet direct? What decisions are appealable, and to which court or tribunal? If the regulator can issue binding orders and levy fines that can reach $25 million or five per cent of global revenue for the most serious offences, Canadians need clear procedural safeguards before those powers are used.

Then build the firewall. Privacy enforcement is about data collection, consent, deletion, breach response and automated decision-making. Digital safety enforcement can involve content, platform design, user access and online speech-adjacent rules. Those files should not casually bleed into each other. A privacy complaint should not become a back door for platform censorship, and a child-safety investigation should not become an excuse for sweeping identity checks across ordinary online life.

Finally, publish the implementation ledger: the bill text, transition plan from the Privacy Commissioner, budget, staffing model, penalty guidelines, appeal routes, consultation record and annual reporting requirements. The Privacy Commissioner praised parts of the bill, including fundamental-right recognition, children’s interests, privacy impact assessments and stronger enforcement powers. Good. Now Parliament should test whether those powers belong in this new super-regulator.

Privacy rights are not the problem. Regulator creep is. If Ottawa wants Canadians to trust this bill, it should separate rights from bureaucracy, enforcement from censorship, and public protection from Liberal “trust us” governance.