How the federal government’s proposed digital regulator would work

In June, the Liberal government introduced two major pieces of tech policy legislation: Bill C-34, which focuses on digital safety, and Bill C-36, which focuses on privacy.

Bill C-34 would force social media platforms to at least temporarily block access for kids under 16 and regulate the companies behind AI chatbots by imposing on them a duty to act responsibly, among other measures.

Bill C-36 includes setting higher standards for organizations when they manage children’s data, giving Canadians the right to ask for their information to be deleted, and requiring organizations to be transparent about their use of automated decision-making for significant decisions about individuals.

Both bills would be administered by the new Digital Safety and Data Protection Commission of Canada. It will have five members who are appointed by cabinet.

Government officials have said the new regulator is expected to take about 18 months to set up.

What powers would be the new regulator have?

The commission will have authority to issue binding orders to organizations and levy fines of up to $10 million or three per cent of the organization’s gross global revenue. For the most serious offences, such as when companies obstruct the commission’s work, the fines can go up to $25 million or five per cent of global revenue.

The regulator will be in charge of making decisions about important elements of how to implement the new digital safety rules. That includes deciding whether age-verification methods used by companies are effective and respect people’s privacy and whether social media platforms qualify for exemptions to the age ban.

University of Ottawa law professor Michael Geist has dubbed the commission a “digital super-regulator.”

“A single commission of five Governor in Council appointees will now be responsible both for regulating online speech and content moderation across the country’s largest platforms (including standard setting, guidelines, audits, formal, law-enforcement-style investigations, hearings, and adjudicative powers) and for overseeing how every organization in Canada collects, uses, and discloses personal information,” he wrote in a blog post shortly after the legislation was introduced.

How unusual is the new proposed set-up?

Geist said the new regulator would have “astonishing powers that may be unmatched anywhere in the democratic world.”

Heidi Tworek, a professor of history and public policy at the University of British Columbia, said Canada is taking an unusual approach compared to its international counterparts by giving the new body dual responsibilities.

“In other places we see a separation of the privacy regulator and the online safety regulator,” she said in an interview.

Tworek pointed out when Australia brought in its social media ban for kids under 16 — the first country to do so — it already had a safety commission in place.

“That’s different in the case of Canada, where it’s also a case of standing up the commission as well as implementing the legislation,” Tworek said.

The case for a strong regulator

Government officials said in a background briefing the idea behind having one commission for both digital safety and privacy legislation was to give Canadians who are engaging with private-sector companies a single entity focused on issues like children’s safety and data.

Teresa Scassa, a law professor at the University of Ottawa and Canada research chair in information law and policy, said in an interview the government likely “sees overlap and synergies between different digital regulation issues and wants to deal with it all in a single shop.”

Taylor Owen, founding director of the Centre for Media, Technology and Democracy at McGill University, said he’s “not sure creating a super regulator is pejorative.”

“I think it’s a powerful regulator, and that might be what we need. The idea that we’re not going to have a powerful regulator and regulate the largest companies in the world, and most powerful companies in world, seems misguided to me,” Owen said in an interview.

What’s the issue with the new commission taking powers from the privacy commissioner?

Under the new privacy bill responsibility for the private sector, including tech companies, would go to the Digital Safety and Data Protection Commission. The privacy commissioner would only be responsible for the Privacy Act, which covers government.

Florian Martin-Bariteau, research chair in technology and society at the University of Ottawa, said he is in favour of strong regulators — but that merging the privacy commissioner’s responsibilities with the new regulator is a big mistake.

The bills are different and operate under different logic, while the office of the privacy commissioner is working well, and has a stellar reputation, he said in an interview.

Scassa said in an interview the government is likely concerned that the privacy commissioner is an independent agent of Parliament — which means there is a limit to how much the government can direct their actions.

In comparison, the government can have “much more” control over the approach and policy direction taken by the new commission.

Scassa said there are a number of reasons it’s a bad idea to take powers away from the privacy commissioner.

That office has built a “tremendous amount of experience” domestically, as well as an international reputation, she said, adding that “there’s just a lot of capital there that I think will be squandered.”

Tearing that down and handing over power to a new body that is not yet set up means “there’s going to be a transition period and a period of chaos in which privacy and privacy rights are simply not well served,” Scassa said.

This report by The Canadian Press was first published July 11, 2026.

Anja Karadeglija, The Canadian Press

by The Canadian Press

How the federal government’s proposed digital regulator would work

What's Trending