Bill C-36: How Canada’s Proposed Privacy Law Could Increase Proposed Class Action Filings

In June 2026, the federal government introduced Bill C-36, which would effectively replace the existing Personal Information and Electronic Documents Act (“PIPEDA”) with a new Protecting Privacy and Consumer Data Act (“PPCDA”).

This bill contemplates a new statutory right of action that appears to be available to any individuals affected by a contravention of PPCDA, subject to certain conditions.

This proposed right of action, which appears to go much further than the existing right to make an application for damages under PIPEDA, may fuel putative privacy class actions based on contraventions of PPCDA affecting many individuals. In some ways, this proposed right of action, and the class action risk it carries, may pose an even greater threat than PPCDA’s massive potential administrative monetary penalties.

Bill C-36 and follow-on proposed class actions: What organizations need to know

• The proposed PPCDA appears to create a new statutory private right of action broader than the current right to make an application under PIPEDA.
• This new private right of action could increase proposed class action filings.
• Organizations should approach privacy complaints, investigations, and compliance agreements with potential class actions in mind.

How Bill C-36’s proposed right of action would work

If passed, PPCDA would change the privacy class action landscape by introducing a new private right of action. Specifically, s. 132 appears to give any individual affected by an organization’s contravention of PPCDA a right of action for damages for loss or injury suffered as a result of the contravention, subject to certain conditions.

This proposed right of action appears to go much further than the existing right to make an application for damages under s. 14 of PIPEDA in at least four important ways:

• Who can sue. Under s. 14 of PIPEDA, only a complainant, meaning an individual who had first filed a complaint with the privacy commissioner and received a report or notice of discontinuance, could apply for relief. Section 132 of the PPCDA is broader: it appears to be available to any individual affected by the contravention, whether or not that individual filed the underlying complaint. This provision may lend itself more readily to proposed class actions, which could arguably be brought by any affected individual (whether or not they complained) on behalf of a wider class.
• Which court. Section 14 of PIPEDA limits the forum of applications to the Federal Court. Section 132(5) of the PPCDA is expressly broader: an affected individual can invoke the proposed right of action in Federal Court or in provincial superior court. That matters because proposed privacy class actions based on breaches of federal privacy legislation have historically been unable to proceed in provincial superior court, which instead could hear proposed privacy class actions based only on common law or provincial statute. Under the PPCDA, however, it appears plaintiffs could simultaneously advance federal privacy claims and provincial privacy claims in provincial superior court, increasing the scope of claims that can be advanced in a single forum.
• Type of proceeding. Section 14 of PIPEDA is framed as a right of application—a procedural vehicle presumptively suited to summary determination on a documentary record. Section 132 is framed as a right of action. It is a broader vehicle contemplating full pleadings, discovery, and trial. That framing may make a claim alleging a contravention of PPCDA easier to integrate into class actions, including actions that combine PPCDA claims with other claims. Section 132(3) appears to confirm that the right of action does not limit an individual’s other rights and remedies.
• Scope of qualifying contraventions. Section 14 of PIPEDA limits the damages remedy to contraventions of specified provisions of PIPEDA—namely, certain clauses of Schedule 1 and specified provisions of the operative part of the Act. Section 132 of PPCDA is not so limited: it appears to apply to any act or omission that constitutes a contravention of PPCDA, provided the individual concerned is affected by it. That appears to materially expand the range of underlying conduct that can support a damages claim.

The chart below provides a comparison at a glance.

PIPEDA vs. PPCDA: What would change?

What constraints does Bill C-36 put on the private right of action?

The right is not without limit. At least two important filters limit class action exposure.

1. The right would become available only after specified events in the enforcement process have occurred—namely, the Commissioner finds a contravention, the Federal Court finds a contravention on appeal, a final decision finds a contravention after all rights of appeal have been exhausted, or the Commissioner enters into a compliance agreement with no damages component. Thus, individuals cannot start by invoking the private right of action and launching a class action; other steps must be completed first, and those steps must culminate in a finding of a contravention or a compliance agreement—a key filter that limits the availability of the private right of action.
2. No claim can proceed as a class action unless it satisfies the requirements for class certification, which is an important hurdle. A Commissioner’s finding is not a certification order. Plaintiffs will still need to satisfy the familiar tests: an identifiable class, a viable cause of action, common issues, a preferable procedure, and an adequate representative plaintiff. Recent Canadian jurisprudence confirms that plaintiffs bringing privacy class actions still bear a meaningful evidentiary and legal burden to secure certification.

From privacy complaint to proposed class action: how the follow-on pathway could work

The practical effect of s. 132 is that any privacy complaint under the PPCDA now carries potential follow-on class action exposure. In effect, the regulator finds a contravention, and the class action seeks to monetize it—much as follow-on class actions in the securities and competition contexts have long done in Canada.

As a result, even a single complaint by a single individual about a single practice can potentially become the first step in a putative class action with substantial exposure to a very large class. Accordingly, every complaint should be managed with possible class-action exposure in mind.

That reframing has significant consequences for how organizations may engage with the regulator. Under PIPEDA, a privacy commissioner’s report is often understood, in practical terms, as a statement of the privacy commissioner’s views, backed by the possibility of a s. 14 application, reputational consequences, and increasingly detailed guidance and expectations.

Under the PPCDA, however, a Commissioner’s finding does something more: it functions as the gateway to statutory damages exposure and to a follow-on proposed class action. That change in downstream consequences may sharpen how organizations frame their submissions in regulatory investigations, how they contest notices of contravention on review by the Commission, and how they consider Federal Court appeals under s. 128.

Compliance agreements could create a strategic choice

Under s. 132(1)(d), a compliance agreement will not trigger the private right of action if it provides for damages. Where a matter is heading toward some form of resolution with the Commissioner, counsel will need to consider carefully whether to negotiate for a damages component—accepting a defined payment in exchange for closure of the s. 132 pathway—or accept a compliance agreement without a damages component and live with the residual private-litigation risk.

This trade-off may be difficult and highly fact-specific. A modest, defined payment now may forestall a much larger and less predictable class action later. But a damages component:

1. requires the organization to concede exposure in a way it may not otherwise concede;
2. may create precedent-setting expectations for future matters, both with the Commissioner and with claimants; and
3. does not, by itself, foreclose civil claims outside s. 132.

Careful strategic analysis will be required in every case where a compliance agreement is on the table.

How courts will treat Commissioner’s findings remains an open question

Under PIPEDA, applications to the Federal Court have been treated as de novo hearings, with the court making its own findings and not owing deference to the privacy commissioner’s views. PPCDA does not expressly address the standard of review or weight that a court hearing a s. 132 action should accord to the Commissioner’s underlying findings. Whether those findings give rise to issue estoppel, whether they attract deference, and whether (and, if so, on what terms) the underlying evidentiary record is admissible in the civil action will be important questions in the first wave of s. 132 litigation.

How organizations can prepare for Bill C-36

Bill C-36 is a significant piece of privacy reform legislation. It is also a significant piece of litigation legislation. Section 132 imports into the federal privacy regime a follow-on private right of action architecture familiar from other statutory contexts in Canada. If the bill becomes law substantially in its current form, that architecture will materially expand the class action risk profile associated with federal privacy compliance.

For organizations that do business in Canada, the message is that the class action risk associated with Bill C-36 is not merely a downstream consequence of higher penalties. It is a distinct risk that warrants its own analysis and strategy.

Organizations that adapt fastest to the new architecture—by recalibrating complaint handling, sharpening regulatory engagement, and integrating class actions considerations into privacy governance—will be best positioned when the first wave of s. 132 class actions arrives.

More on Bill C-36:

• Bill C-36: What organizations need to know about Canada’s new privacy reform
• Canada’s new privacy regulator: Why Bill C-36’s institutional shift is a game changer

For updates on privacy, data, and technology law, subscribe to TechLex (below).

To discuss how Bill C-36 could impact your organization, contact our Cyber/Data Group.

To view the original article click here

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.