The Carney government wants you to believe it is saving your children from the dark corners of the internet. They want you to believe that their sudden, frantic rush to regulate the digital frontier is an act of pure, benevolent guardianship. But if you peer past the press release headlines and look directly at the legal machinery being built in the basement of Parliament, a very different picture emerges. This isn't a safety campaign. It is an administrative power play designed to strip independent oversight out of digital governance and replace it with a centralized, cabinet-controlled enforcement engine.
Over the course of five days in June, the federal government quietly tabled two massive pieces of legislation that structurally reshape how data, privacy, and free speech are governed in this country. First came Bill C-34, the Safe Social Media Act, introduced on June 10, 2026, by Minister of Canadian Identity and Culture Marc Miller. Five days later, on June 15, Minister of Artificial Intelligence and Digital Innovation Evan Solomon tabled Bill C-36, the Protecting Privacy and Consumer Data Act.
Separately, each bill is pitched as a modern solution to modern anxieties. Bill C-34 promises a sweeping "Duty to Protect Children," a hard ban on social media accounts for minors under 16, and strict 24-hour takedown windows for harmful content. Bill C-36 arrives as the long-overdue modernization of private-sector privacy, formally codifying data protection as a fundamental right and sweeping away the rusted gears of the old Personal Information Protection and Electronic Documents Act.
But when you stitch these two bills together, the true architecture reveals itself. The government is creating a unified super-regulator: the Digital Safety and Data Protection Commission of Canada. And the most damning detail is not what this new Commission would do, but who gets to hold the leash.
The Death of the Independent Watchdog
To understand how radical this shift is, look at how Canada has traditionally handled your privacy. For decades, the Office of the Privacy Commissioner has operated as an independent Agent of Parliament. That distinction matters. An Agent of Parliament does not report to a minister, nor do they serve at the pleasure of the Prime Minister’s Office. They are independent watchdogs who answer directly to the House of Commons, insulated from political volatility and executive interference.
If passed, Bills C-34 and C-36 would systematically dismantle this structural wall. The new framework would completely strip the independent Privacy Commissioner of their historic commercial, private-sector jurisdiction. In their place would stand a centralized board of five commissioners who will run the new Digital Safety and Data Protection Commission. Every single one of these five commissioners will be appointed behind closed doors by direct executive order of the federal Cabinet.
The official rationale for this consolidation is simple efficiency. Minister Solomon framed the overhaul as a necessary step to support "coherence and consistency" in regulating cross-cutting issues like age assurance and artificial intelligence. The government's core argument is that modern data problems require an agile, multi-mandate regulator that can move quickly without being bogged down by fragmented jurisdictions.
Let us test that logic. If the goal is truly an efficient, consistent, and rule-of-law-bound regulatory environment, the success of this model depends on its ability to provide predictable enforcement and maintain absolute public trust. But a basic analysis of the structural architecture reveals a glaring contradiction: by replacing an independent parliamentary officer with a cabinet-appointed board, the government injects raw political volatility into the very heart of the digital economy.
If an executive-led body can dictate the terms of digital speech and data compliance today, the exact same mechanism can be weaponized to suppress opposing viewpoints or reward friendly corporate interests tomorrow. This is not structural modernization; it is a structural coup. The independent watchdog is being replaced by an executive corporate board.
The Constitutional Collision with the Provinces
Ottawa’s centralization scheme does not just crush federal checks and balances; it runs headfirst into a constitutional brick wall. Under the Constitution Act, 1867, property and civil rights fall squarely within provincial jurisdiction. For a quarter-century, Canada's privacy landscape has operated under a delicate federal-provincial balance. While the federal government managed cross-border and commercial data via PIPEDA, provinces like British Columbia, Alberta, and Quebec maintained their own independent private-sector privacy acts (PIPA) and regulatory bodies, such as Quebec's Commission d'accès à l'information.
By establishing a cabinet-appointed federal super-regulator with unprecedented, heavy-handed enforcement powers, the Carney government is forcing an aggressive centralization that ignores provincial autonomy. Businesses will find themselves caught in a direct jurisdictional crossfire.
A commercial enterprise in Vancouver or Montreal could find its local operations perfectly compliant with provincial legislation, yet face multi-million-dollar investigations from Ottawa's new hand-picked commissioners over identical data management programs. Instead of the "coherence" promised by Minister Solomon, this heavy-handed federal intrusion ensures a chaotic patchwork of overlapping authorities, conflicting compliance notices, and constitutional court battles over where federal commercial regulation ends and provincial civil rights begin.
The Judge, the Jury, and the Corporate Tollbooth
The concentration of power inside this new super-regulator goes beyond its political appointment process. The text of Bill C-36 reveals an internal control environment that resembles a closed loop. The Commission would be granted binding order-making authority and the power to levy historic financial penalties—Administrative Monetary Penalties up to $10 million or 3 percent of an organization’s gross global revenue for standard infractions, escalating to a maximum tier of $25 million or 5 percent of gross global revenue for the most severe statutory offenses, such as obstructing a Commission investigation.
Yet, the framework houses both the investigators and the adjudicators under the exact same roof. While the legislation purports to establish internal divisions to separate these roles, it contains a staggering loophole: board members within the same regulatory ecosystem are explicitly not disqualified from participating in the subsequent review of penalties issued by their own departments. The Commission effectively acts as the investigator, the prosecutor, the judge, and the jury, validating its own actions within a regulatory black box.
Independent legal experts have already sounded the alarm on this dangerous concentration of power. Dr. Michael Geist, Canada Research Chair in Internet and E-commerce Law at the University of Ottawa, publicly characterized the decision to push the Privacy Commissioner out of the private-sector loop and hand it to an overloaded digital safety commission as the framework's "biggest mistake." Geist warns that this dual-mandate structure completely undercuts the value of modernized enforcement powers by placing them with a politically exposed, cabinet-appointed body rather than an independent Agent of Parliament, ensuring years of litigation over the Commission's basic independence.
The 18-Month Regulatory Abyss
While the government beats its chest about protecting children today, internal federal projections acknowledge that the actual infrastructure for this super-regulator will take at least 18 months to structurally set up. Independent legal analysis is far more pessimistic, indicating that the full operational rollout of the privacy transition and data migration will drag toward 2030 due to the extensive phased implementation timelines built directly into the text of Bill C-36.
By blowing up the existing ombuds-model before the new asset is even built, the government is plunging Canadian digital commerce into a multi-year regulatory abyss. The Commission will be forced to build base-level privacy expertise completely from scratch while simultaneously trying to enforce complex new age-assurance limits and 24-hour content takedown windows. It is an overextended, multi-mandate monster designed for maximum bureaucratic expansion and minimum rule-of-law predictability.
We are told this is all done in the name of safety and trust. But true public trust requires transparency, predictability, and independent oversight. By structural design, this new Commission offers none of them. It trades the predictable, independent boundaries of the rule of law for the absolute discretion of a five-member star chamber answerable only to the Prime Minister’s Cabinet.
The federal government is substituting accountability with alignment. In the Carney administration's digital future, you don't need a neutral arbiter when a political board can simply decide what is safe for you.
The Hammer will be watching.
