Ottawa is poised to usher in a monumental shift in how online spaces are governed, proposing a sweeping new our engagement guidelines. This initiative, aiming to establish a powerful new digital regulator, seeks to intertwine online safety and privacy oversight, wresting control from the current privacy commissioner and consolidating power under one roof. Critics are already branding it a “super-regulator,” while proponents argue that such a robust body is not merely necessary but essential to combat the relentless proliferation of online harms.
The federal government, in a bold move this past June, tabled two pivotal pieces of tech policy legislation: Bill C-34, a comprehensive framework for digital safety, and Bill C-36, which zeroes in on privacy concerns. Bill C-34 is designed to mandate social media platforms implement temporary age blocks for users under 16 and impose a duty of responsible conduct on companies developing AI chatbots. Meanwhile, Bill C-36 elevates data management standards for children, grants Canadians the explicit right to request data deletion, and demands transparency from organizations utilizing automated decision-making processes for significant individual choices.
The Far-Reaching Powers of the Digital Regulator
Both legislative proposals fall under the purview of the new Digital Safety and Data Protection Commission of Canada, a five-member body appointed by the cabinet. This new commission, anticipated to be operational within 18 months, is slated to wield considerable authority. It will possess the power to issue binding directives to organizations and impose substantial fines: up to $10 million or three percent of an organization’s gross global revenue for general infringements, escalating to $25 million or five percent of global revenue for severe offenses, such as obstructing the commission’s work.
This formidable digital regulator will also be the ultimate arbiter on crucial implementation details for digital safety rules. Its decisions will dictate the efficacy and privacy compliance of age-verification methods employed by companies, alongside determining which social media platforms might qualify for exemptions from the proposed age ban.
University of Ottawa law professor Michael Geist aptly characterized the commission as a “digital super-regulator.” He highlighted its unprecedented scope: “A single commission… will now be responsible both for regulating online speech and content moderation… and for overseeing how every organization in Canada collects, uses, and discloses personal information.”
Internationally, Canada’s strategy stands out. Heidi Tworek, a professor at the University of British Columbia, notes that other nations typically maintain a distinct separation between privacy and online safety regulators. Australia, for instance, already had a safety commission in place before introducing a social media ban for minors. Canada, by contrast, is simultaneously establishing this commission and implementing its foundational legislation. Despite these concerns, government officials advocate for a single entity, citing the synergy between digital safety and privacy, particularly when addressing issues like children’s online well-being and data handling.
The debate intensifies concerning the new commission’s absorption of responsibilities previously held by the privacy commissioner. Florian Martin-Bariteau, a research chair in technology and society, argues that while strong regulators are beneficial, merging these distinct responsibilities is a grave error. The Privacy Commissioner’s office, with its stellar reputation and well-established operations, functions under different logical frameworks than the proposed new bills. Furthermore, critics like Teresa Scassa, a law professor, suggest the government prefers the new commission because, unlike the independent privacy commissioner, its actions and policy direction can be more directly influenced. Undermining an office with a “tremendous amount of experience” both domestically and internationally, Scassa warns, risks a period of profound chaos, leaving privacy rights underserved during the transition to this new digital regulator.
About the Author
