On January 6, 2025, Parliament was prorogued by proclamation from the Governor General on the advice of the Prime Minister, putting an end to the parliamentary session.

Three significant bills dealing with privacy, cyber security and online harms died on the Order Paper following prorogation:

  • Bill C-27, the Digital Charter Implementation Act
  • Bill C-26, the Critical Cyber Systems Protection Act
  • Bill C-63, the Online Harms Act

A snap federal election was called on March 23, 2025, with an election to be held on April 28, 2025, resulting in further uncertainty about the timing and substance of federal privacy law reform.

Bill C-27: The Digital Charter Implementation Act

Through Bill C-27, Parliament sought to reform private sector privacy protections by modernizing how regulated organizations handle personal information. The Bill proposed three new Acts:

  • The Consumer Privacy Protection Act ("CPPA")
  • The Personal Information and Data Protection Tribunal Act ("PIDPTA")
  • The Artificial Intelligence and Data Act ("AIDA")

The CPPA would have replaced Part I of the Personal Information Protection and Electronic Documents Act (PIPEDA). The CPPA sought to improve organizational accountability and individual privacy rights by requiring privacy management programs, introducing new consent requirements, providing for specific rules for protection of children’s information and giving clearer meaning to “anonymization” of personal information. The CPPA also proposed expanded powers for the Office of the Privacy Commissioner of Canada (OPC).

The PIDPTA would have established a new Personal Information and Data Protection Tribunal. The Tribunal would be responsible for hearing appeals of OPC decisions, compliance orders, and recommended penalties under the CPPA. The Tribunal would have distinct enforcement powers, including order-making and penalty-imposing powers.

AIDA sought to regulate international and interprovincial trade and commerce in AI systems by establishing common requirements applicable across Canada for the development and deployment of AI systems in the private sector. AIDA included prohibitions against certain conduct in relation to AI systems that may result in “serious harm” to individuals or their interests.

Bill C-27 passed second reading in the House of Commons and was under consideration by the Standing Committee on Industry and Technology (INDU). The INDU study ceased upon prorogation.

Bill C-26: The Critical Cyber Systems Protection Act

Bill C-26 represented a significant step toward protecting critical cyber infrastructure. The Bill gave the federal government power to enforce cyber security standards in industries critical to national security and public safety.

Bill C-26 would have amended portions of the federal Telecommunications Act to authorize the government to impose obligations on telecommunications service providers to "secure the Canadian telecommunications system."

The Bill separately introduced the Critical Cyber Systems Protection Act (CCSPA), which would empower the government to designate services or systems as “vital” and to impose data protection obligations on their operators, require mandatory reporting of cyber security incidents, and facilitate threat information exchange "between relevant parties."

Before prorogation, the Senate sent Bill C-26 back to the House of Commons with proposed amendments. The House of Commons did not consider those amendments prior to prorogation.

Bill C-63: The Online Harms Act

Bill C-63 aimed to promote Canadians’ online safety by imposing duties on regulated service providers, including social media services, to act responsibly and implement measures to mitigate exposure to prescribed categories of “harmful content.”

The Bill proposed to establish new regulatory bodies, including the Digital Safety Commission of Canada, the Digital Safety Ombudsperson and a Digital Safety Office. The Digital Safety Commissioner would have the power to issue guidelines and codes of conduct; make regulations; investigate public complaints that content on a regulated service is content that sexually victimizes a child or revictimizes a survivor or intimate content communicated without consent; and issue compliance orders.

Bill C-63 separately introduced amendments to the Criminal Code to increase penalties for distributing hateful content online.

The Bill reached second reading at the House of Commons before Parliament prorogued.

The path ahead

Regardless of which party forms government, Parliament is expected to address privacy, cyber security and online harms following the election. However, it remains unclear where these issues will rank among competing policy priorities, and what shape new bills may take.

All parties have expressed agreement that PIPEDA is in need of modernization, but Bill C-27 faced considerable scrutiny with respect to its provisions on consent, children’s privacy, the introduction of a new tribunal, and the nature of AI protections contained in AIDA. A new bill may build on Bill C-27, but changes will be necessary for the legislation to receive broad support. Any AI legislation is likely to be presented in a separate, standalone bill.

Bill C-26 was close to completing its journey through the legislative process at the time of prorogation, and a similar bill may emerge in the next Parliament. However, evolving threats to Canadian national security may give some lawmakers pause as they consider how best to protect Canada’s critical infrastructure.

Parties have presented competing visions with respect to online harms, with the opposition Conservatives introducing their own private members bill on the issue in the last Parliament, in a direct challenge to Bill C-63. Online harms legislation is a clear policy priority for many parliamentarians, but federal legislation may take a different shape in light of concerns expressed about the broad scope of Bill C-63 and accusations of censorship arising from the Bill’s proposed enforcement scheme. The next online harms bill may take a more targeted approach.