C-36An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts

What it does

• Creates rules for personal information collected, used or disclosed in commercial activities, and for employee or applicant information in federally regulated works, undertakings or businesses.
• Requires organizations to appoint a responsible person, keep a privacy management program, limit collection to stated purposes, and usually get valid consent in plain language.
• Allows some uses and disclosures without consent, including transfers to service providers, de-identifying information, certain business transactions, emergencies, law enforcement, legal duties, and publicly available information.
• Requires organizations to protect data, keep it only as long as needed, report serious breaches, notify affected individuals, and respond to access, correction, disposal and data mobility requests.
• Creates the Commission, Commissioner and Division powers to investigate complaints, resolve disputes, audit organizations, issue orders, and approve codes of practice and certification programs.
• Repeals Part 1 of the Personal Information Protection and Electronic Documents Act, renames that Act the Electronic Documents Act, and makes related amendments to other Acts.