More Than an IP Question: How Canada's Changing Data Rules May Affect Innovation

IP practitioners and their clients have traditionally focused on the asset itself: patentability and claim scope, trade-mark distinctiveness, copyright protection, trade secret controls and ownership. That focus remains essential. But a growing share of the innovations they create, protect, commercialize, value and enforce are built on data. Machine learning models trained on personal information, diagnostic tools generating inferences about individuals and platforms combining user behaviour with proprietary algorithms are now common across development, transactions, licensing and disputes.

The question for clients and their counsel is no longer only whether an asset is protectable, but whether the data foundations of that asset can withstand scrutiny from regulators, counterparties and opposing parties.

Why IP Counsel Should Be Paying Attention

Canada's federal privacy framework is in transition. The Personal Information Protection and Electronic Documents Act (PIPEDA) remains current law, governing how private-sector organizations collect, use and disclose personal information. Bill C-27, which would have introduced the Consumer Privacy Protection Act and the Artificial Intelligence and Data Act (AIDA), died in early 2025.

In June 2026, however, the federal government introduced Bill C-36 at first reading. If enacted, it would replace the private-sector privacy core of PIPEDA with the Protecting Privacy and Consumer Data Act. Bill C-36 is not law and remains subject to parliamentary debate and possible amendment. But it signals the direction we are likely heading in, and that direction carries real consequences for data-dependent innovation.

Canada's 2026 AI Strategy does not revive a standalone AI statute. Instead, the federal government is relying on privacy reform, voluntary standards and existing laws to govern AI. For clients developing AI-enabled products, the rules will come from multiple directions, with privacy legislation likely playing a central role.

What Bill C-36 Would Change

Several features of Bill C-36 are particularly relevant to innovation and IP built on personal information.

Bill C-36 would expressly include inferred information within the definition of personal information. Inferred information is information derived or predicted about an individual from other data, even where the individual never provided it. For AI systems generating risk scores, behavioural predictions or health assessments, this would mean that outputs, not only inputs, may attract privacy obligations.

Bill C-36 would also distinguish de-identified data from anonymized data. De-identified data, where re-identification remains possible, would stay regulated. Anonymized data would fall outside the statute, provided the standard of irreversibility is met. A dataset described commercially as "anonymous" may not meet that standard. If it does not, privacy obligations would continue to apply to the data as it is used to train, improve or operate a product.

The Bill would also introduce or expand rights relating to disposal or deletion, data mobility, and explanations for certain automated decisions with significant effects, along with a right to request human review. It would require privacy impact assessments before cross-border transfers and introduce binding orders, administrative monetary penalties and a conditional private right of action.

Broad Pressure Points for Innovation

These developments are not abstract compliance concerns. For clients, they may affect whether a data-dependent product can continue to be used, whether its outputs can be explained, and whether the asset can be licensed, financed or sold.

The practical significance lies in the full lifecycle of an IP asset. At creation, the legal basis for collecting and using training data matters. If rights to the data are unclear or insufficient, that uncertainty can flow through to ownership, confidentiality and enforceability. At deployment, inferred personal information may trigger transparency, deletion or human-review requirements. In a licence, financing or sale, counterparties may seek evidence that data provenance, permitted uses and cross-border flows support continued use, sharing and transfer of the asset.

Data practices already attract regulatory attention under current law. Bill C-36 would raise the stakes, introducing binding enforcement powers, financial penalties and the ability for individuals to bring civil claims. For data-dependent products, those consequences may affect the commercial value of the asset itself.

The Issue-Spotting Role of IP Counsel

In this changing landscape, the strength of a data-dependent asset may turn on questions outside the traditional IP file. Whether advising on protection, licensing, an acquisition or a dispute, IP counsel can help clients identify the data dimension early and recognize when privacy expertise is needed. The goal is to consider these issues before a gap becomes a barrier to protection, commercialization or enforcement. Counsel should also be mindful of the confidentiality and privilege implications of using public AI tools in active matters, as information entered into these platforms may not remain confidential.

Effective issue-spotting requires enough familiarity with the evolving framework to ask: Where did the data supporting the innovation come from, and what rights govern it? Is it personal information, inferred information, de-identified or anonymized? Could changing data rules constrain its continued use, protection, licensing, acquisition or treatment in a dispute?

Looking Ahead

Bill C-36 remains in its early stages, but the policy direction it represents is unlikely to reverse. As innovation becomes more data-dependent, the strength of an IP asset may turn not only on who owns it, but on how it was built, how it may be used and whether those foundations can withstand scrutiny.