Legitimate Interest: The Consent Exception in Bill C-36

Canada's proposed privacy law would let a business collect, use or disclose personal information without the person knowing or agreeing, where it has a legitimate interest that outweighs the foreseeable harm. Health researchers said this week that the clause leaves too much to the company. For a business using AI on customer data, the fine print matters more than the headline.

What the bill says

Bill C-36 would enact the Protecting Privacy and Consumer Data Act, replacing the private-sector privacy rules businesses know as PIPEDA. It was introduced at first reading on 15 June 2026. It is a bill, it has not passed, and the wording below is the first-reading text. Our earlier overview is in what Bill C-36 means for how your business uses AI.

The starting rule is consent. Section 15 says an organization must obtain valid consent to collect, use or disclose personal information unless the Act provides otherwise. Section 18 then sets out two exceptions that matter to ordinary businesses.

The first covers listed business activities: what is necessary to provide a product or service the individual asked for, and what is necessary for the security of your systems or the safety of your product. The second is broader. Under subsection 18(3), an organization may collect, use or disclose personal information without knowledge or consent for an activity in which it has a legitimate interest that outweighs any reasonably foreseeable adverse effect on the individual.

The conditions attached

The exception is not a free pass, and the conditions are in the same section.

The second condition is the one most likely to catch a business using AI on customer data. An activity whose purpose is to influence what an individual does or decides cannot rely on legitimate interest. Personalised offers, targeted messaging and recommendation engines are aimed at behaviour by design, so on this reading they point back toward consent.

What the critics say

On 9 November CBC News reported on a commentary in the Canadian Medical Association Journal arguing that the bill, in the words CBC quotes, contains critical gaps that leave sensitive health data exposed. Co-author Dr. Sheryl Spithoff of Women's College Hospital told CBC that what concerns her is that it is the company that makes the decision.

The specific objections reported are that organizations assess their own legitimate interest without telling a regulator in advance, that there is no higher standard for sensitive information such as health data, and that the European equivalent sets a higher bar. The office of AI Minister Evan Solomon told CBC that organizations relying on the exception would be subject to safeguards, including requirements to assess privacy risks and take steps to mitigate them.

A second concern is about scope. The bill defines de-identified information as data from which a person cannot be directly identified although a risk remains, and anonymized information as irreversibly modified so that no reasonably foreseeable risk remains. Subsection 6(5) says the Act does not apply to anonymized information. The commentary, as reported, argues that anonymized data used to train AI systems can still carry bias that harms groups of people.

What a business should take from this

Do not design a project around this exception. The bill is at an early stage, the requirements for the privacy impact assessment are left to regulations that do not exist yet, and this clause is the one drawing public criticism. A provision under that much attention is a candidate for amendment.

Do the documentation anyway. Whatever happens to the wording, the direction is clear: if you use personal information without asking, you will need to show why, what you assessed, and what you did about the risks. That is the same work as a privacy impact assessment for an AI project, and doing it under the current law costs you nothing.

Sort your uses now. Anything necessary to deliver what the customer asked for sits in one group. Anything aimed at changing what the customer does sits in another, and that group should be planning for consent. The uncertain middle is where to spend an hour with a privacy lawyer.

And know what you hold. You cannot assess a use of data you have not inventoried, which is the argument in records management before search finds everything. Put the open question on your risk register with an owner, so it gets revisited when the bill moves.

This is a summary of a bill and of reporting on it, and it is not legal advice. Current obligations remain those in PIPEDA and the applicable provincial laws.

Frequently Asked Questions