{"id":590,"slug":"pipeda-bill-c-27-died-january-2025","title":"Canadian privacy 2026: PIPEDA still governs; Bill C-27 died on the Order Paper Jan 6, 2025 — no fines, only findings","kind":"reference","scope":"business","status":"current","audiences":["kevin","claude-code","smb-owner","candid-team"],"topics":["data-portability","regulatory-compliance"],"reference_body":"**Claim:** **PIPEDA** applies to any private-sector organization in Canada engaged in commercial activity using personal information. Max fine: **$100,000 per knowing violation**.\n\nSource: Office of the Privacy Commissioner of Canada — <https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/>\n\n**The Bill C-27 update (important — supersedes earlier expectations):**\n\n> **Bill C-27** (Consumer Privacy Protection Act) **died on the Order Paper on January 6, 2025**, when Parliament was prorogued.\n\nIn June 2025, Minister Evan Solomon confirmed it *\"will not return in its old form.\"* As of May 2026, Canada remains governed by PIPEDA — **no monetary fines under the current regime, only findings, recommendations, and compliance agreements**.\n\n**Confidence:** Verified (Fasken legal analysis Jan 2025; OPC enforcement record consistent).\n\n**Ontario-specific:** Ontario does NOT have a private-sector privacy law deemed substantially similar to PIPEDA, so PIPEDA applies to most commercial activity by Ontario service businesses. **PHIPA** (Personal Health Information Protection Act) governs Ontario healthcare providers separately.\n\n**Why this matters for the data-ownership thesis:** owning structured data is **easier** for PIPEDA compliance, not harder — you can't honour an access request you can't fulfill from spreadsheets scattered across five clouds. See [[brinks-home-opc-finding-2024]] for the canonical Canadian enforcement case study.","rationale_body":null,"metadata":null,"links":{"outgoing":[{"slug":"bill-c-15-canada-pipeda-mobility-2025","title":"Canadian Bill C-15 (tabled Nov 4, 2025) — proposes data-mobility framework for federal PIPEDA","kind":"reference","scope":"business","link_type":"relates-to"}],"incoming":[{"slug":"brinks-home-opc-finding-2024","title":"OPC vs Brinks Home (PIPEDA Findings #2024-002, Mar 28 2024): inadequate safeguards left customer data accessible for 10 weeks","kind":"reference","scope":"business","link_type":"depends-on"},{"slug":"quebec-law-25-sept-2024-data-portability-c25m-fines","title":"Quebec Law 25 (fully in force Sept 22, 2024): data portability + fines up to C$25M / 4% of worldwide turnover","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"rule-structured-data-is-privacy-compliance-accelerator","title":"RULE: Treat a deliberate data layer as a privacy-compliance accelerator, not a privacy risk. The scattered alternative is harder to comply with.","kind":"rule","scope":"business","link_type":"depends-on"},{"slug":"research-brief-dataset-is-the-product","title":"Research brief: The Dataset is the Product — when a service business should own its data (piece 12 of 15)","kind":"reference","scope":"business","link_type":"relates-to"}]},"created_at":"2026-05-22T20:37:13.191Z","updated_at":"2026-05-22T20:37:13.191Z"}