In June 2026, the federal government introduced Bill C-36, which would effectively replace the existing Personal Information and Electronic Documents Act (“PIPEDA”) with a new Protecting Privacy and Consumer Data Act (“PPCDA”).
This bill contemplates a new statutory right of action that appears to be available to any individuals affected by a contravention of PPCDA, subject to certain conditions.
This proposed right of action, which appears to go much further than the existing right to make an application for damages under PIPEDA, may fuel putative privacy class actions based on contraventions of PPCDA affecting many individuals. In some ways, this proposed right of action, and the class action risk it carries, may pose an even greater threat than PPCDA’s massive potential administrative monetary penalties.