Canada’s Privacy Reform Faces Senate Tests

The main change is a sharper framing of the reform package: Bill C-36 is now tied to a fundamental-rights model and explicit AI/inference protections, while Bill C-4’s political-party regime has advanced with a Senate-approved sunset clause. The story also adds a clearer next-phase policy debate around data sovereignty and cross-border transfer risk assessments.

The story has sharpened from a broad privacy-law rewrite into two concrete legislative tracks, with Bill C-36 now the main private-sector reform vehicle and Bill C-4 the focal point for political-party privacy rules. The emphasis has also shifted toward institutional design and enforcement, especially whether authority stays with the Privacy Commissioner or moves to new access/enforcement bodies.

• Bill C-36 is the main private-sector reform track.
• AI, inference, and de-identified data are now part of the debate.
• Proposals may shift authority away from the Privacy Commissioner.
• Access-to-information complaint handling may become slower and less protective.
• Senate amendments and sunset clauses are affecting political-party privacy rules.

The story has broadened from a focused dispute over political-party privacy exemptions to a much larger federal privacy overhaul centered on private-sector data governance. The party exemption fight remains unresolved, but it is now secondary to a stronger legislative push on consent, enforcement, and AI-related privacy obligations.

• Major private-sector privacy overhaul with stronger consent and penalties.
• New commission-led enforcement model reduces privacy commissioner’s role.
• New obligations on children’s data and automated decision-making.
• More formal rules for cross-border transfers and de-identification.
• Party privacy exemption remains unresolved in Senate debate.

Canada is actively revising how political parties handle personal data, with Bill C-4 creating a privacy exemption for parties, limited oversight requirements, and a sunset clause after Senate scrutiny. The debate is driven by concerns about voter profiling, breach notification, and whether parties should be held to the same standards as other data controllers.