Your Money & Your Data
This section covers the bills touching your personal and financial data most directly — political parties’ data practices, the new open-banking framework, and the bill that would replace Canada’s private-sector privacy law entirely.
Three bills reshaping who holds your data, and who's accountable for it
Bill C-4: Political Parties Don't Have to Follow Privacy Law
Status: Law. The House rejected a Senate amendment in March 2026.
What it does: Part 4 of this affordability bill exempts federal political parties from the privacy laws that apply to every business and charity in Canada — and does so retroactively, immunizing parties’ past data practices all the way back to the year 2000.
Why it’s in this bill: C-4 was originally about implementing tax cuts the Liberals promised during the election, genuinely unrelated to political party privacy. Part 4 was added because of a 2024 BC Supreme Court ruling that found BC’s provincial privacy law (PIPA) does apply to federal political parties, a legal exposure the parties wanted closed. Rather than introduce a standalone bill specifically about political party privacy (which would draw its own dedicated debate and scrutiny), the government attached the fix to C-4, a bill built around popular, fast-moving tax relief.
The government’s case: When the House rejected the Senate’s proposed three-year sunset clause, the government’s position was that Parliament, not privacy regulators, should decide the rules governing how federal parties communicate with Canadians. The government’s promise of “additional privacy provisions” was fulfilled a few months later through Bill C-25 (Email 1), which brought back the requirement for parties to publish a privacy policy and disclose data breaches — though Michael Geist has called the result the “least onerous” privacy obligations possible, still lacking limits on how long parties can keep data or what they can use it for.
Why it matters: In practice, parties collect and use Canadians’ data for campaigning with no legal right for individuals to see, correct, or delete what’s held on them, and no regulator to investigate a complaint. The bill passed third reading in the House by unanimous consent in December 2025, without a recorded standing vote, after second-reading debate ended without a single MP addressing the privacy provisions. It received Royal Assent within hours of the Senate withdrawing its amendment. The Senate’s own committee concluded Part 4 “falls far short of the minimum standards” needed to protect Canadians.
How this could affect you: Any political party you’ve ever given your name, email, or a donation to can keep and use that information for whatever purpose their own self-written privacy policy allows — with no outside body checking whether that policy is reasonable, and no legal right for you to see, correct, or delete what they hold.
Every other organization holding your data answers to you. Political parties do not.
Bill C-15: Your Bank Data Is About to Move Around a Lot More
Status: Law. Received Royal Assent March 26, 2026. The draft open-banking regulations were released for public comment in mid-2026, with the 60-day comment period ending August 26, 2026. The framework is actively being finalized right now.
What it does: Passed inside the federal budget bill, C-15 creates two new financial frameworks: the Consumer-Driven Banking Act, Canada’s first “open banking” regime letting Canadians direct their financial data to flow among banks, credit unions, and fintech companies; and the Stablecoin Act, putting the Bank of Canada in charge of registering and supervising companies that issue private stablecoins, requiring 1:1 backing in high-quality liquid assets and segregated custody.
The government’s case: The Department of Finance frames the goal as promoting safe innovation and competition in financial services while protecting consumers as digital payment options expand. To be clear about what this is not: it is not a government digital dollar. The Bank of Canada paused its own retail central bank digital currency work in 2024, citing privacy and security concerns from public consultation, leaving this privately-issued model as Canada’s approach instead.
Why it matters: As originally introduced, this provision would have let ministers exempt any company, government official, or agency from complying with almost any federal law for up to six years, whenever government believed doing so would encourage innovation or economic growth. It was a scope broad enough that civil liberties advocates raised alarm.
However, committee amendments narrowed the power before the bill passed, and it survived into the final law in that narrower form: restricted to the clean-tech and financial-technology sectors, with a mandatory 30-day consultation period, and a longer list of laws that can’t be overridden. Green Party Leader Elizabeth May, who pushed for those amendments, called the result “a lot less awful” but said she’d still have preferred the power removed entirely.
How this could affect you: Your banking information can only move between institutions when you actively authorize it—this isn’t automatic sharing. The bigger open question is the separate, narrower-than-originally-
Do you know everywhere your banking data could travel under this new framework?
Bill C-36: A Brand-New Regulator for Your Private-Sector Data
Status: Introduced June 15, 2026 — Canada’s third attempt in six years to replace its private-sector privacy law.
What it does: C-36, the Protecting Privacy and Consumer Data Act, would replace PIPEDA, Canada’s 25-year-old private-sector privacy law. Rather than creating a separate regulator, it expands the mandate of the Digital Safety Commission created by Bill C-34 and renames it the Digital Safety and Data Protection Commission—one body that would handle both online-harms enforcement and private-sector privacy enforcement, with stronger investigative and audit powers than the current, ombudsman-style Privacy Commissioner.
Violations would carry administrative penalties up to $10 million or 3% of global revenue, with criminal fines for the most serious offences reaching $25 million or 5% of global revenue. It also elevates privacy in the bill’s purpose clause to a “fundamental right.”
The government’s case: The government frames C-36 as a cornerstone of its national artificial intelligence strategy, intended to give Canadians more confidence in how their data is used and, in turn, encourage broader AI adoption—deliberately separating privacy reform from AI-specific regulation this time, after industry criticized the previous bill’s combined approach as too restrictive.
Why it matters: The Canadian Civil Liberties Association’s press release calls the bill’s protections empty in practice, saying it “grants businesses the ability to ignore consent requirements and retain personal data indefinitely if superficially de-identified.” Legal analysts point out the bill does impose some real restrictions on de-identified data, however, CCLA’s view is that those restrictions are too weak, not that none exist. The bill also does nothing to bring federal political parties under privacy law, and leaves AI-specific harms to a separate, not-yet-passed bill.
Because the bill coming into force is legally tied to C-34’s Commission being established first, it leaves privacy recourse depending on an institution that doesn’t exist yet and is itself still working through Parliament. This applies to private-sector data only; how the federal government itself handles your data remains governed by the separate Privacy Act, unaffected by this bill.
How this could affect you: If this becomes law, the next time a company mishandles your personal data, your complaint would go to a brand-new regulator with no history and no track record—not the private-sector privacy watchdog Canadians have relied on for 25 years.
If a company mishandled your data tomorrow, do you know who would actually be answering for it?
Support Freedom. Strengthen Canada.
Freedom doesn’t protect itself. Your donation helps Freedoms Advocate research legislation, fund legal challenges, publish independent analysis, educate Canadians, and defend the fundamental freedoms of speech, conscience, religion, and privacy.