Correction — October 28, 2026: The previous article blurred enacted broadcasting law with Bill C-27’s unpassed privacy and AI proposals. It also asserted data-localization, encryption and secret-order consequences that the cited measures did not establish. We replaced that account with the parliamentary record and specific statutory powers and limits. The original publication date is preserved.
Canada’s Online Streaming Act and the proposed Digital Charter Implementation Act were different measures with different outcomes. Calling both “digital sovereignty laws” obscures the first question a reader needs answered: which obligations actually became law?
C-11 received royal assent
The parliamentary record for Bill C-11, in the 44th Parliament’s first session, identifies the Online Streaming Act and records royal assent on April 27, 2023. It amended the Broadcasting Act to address online broadcasting undertakings.
This is broadcasting legislation. It should not be presented as though its title alone establishes a general privacy law or a requirement that all Canadian personal information be stored inside Canada.
Bill numbers are reused between parliamentary sessions. When discussing C-11 or C-27, the Parliament, session and title matter. Otherwise a reference can point readers to a different proposal with the same number.
C-27 did not complete Parliament
The record for Bill C-27 identifies the Digital Charter Implementation Act, 2022. It proposed the Consumer Privacy Protection Act, a tribunal statute and the Artificial Intelligence and Data Act.
The session ran from November 22, 2021 to January 6, 2025. The bill completed second reading and referral to committee on April 24, 2023. The record shows committee consideration not completed, with report stage, third reading and Senate stages not reached.
The proposed AIDA powers therefore cannot be described as operative law enacted by that bill. Criticism of the proposal can still be relevant historical analysis, but it needs to be labelled as criticism of a proposal. A provision discussed during committee study is not an obligation already imposed on Canadians.
Discoverability powers have express limits
Section 9.1 of the Broadcasting Act permits conditions concerning how programs are presented for public selection, including showcasing and discoverability of Canadian programs.
That is a real regulatory power affecting presentation. But subsection 9.1(8) expressly bars an order under that provision requiring a specific computer algorithm or source code. The distinction leaves room to scrutinise discoverability requirements and their effects without claiming the CRTC can simply prescribe any recommendation algorithm it wants.
The same section requires proposed orders to be published with an opportunity for representations, and final orders to be published on the Commission’s website. The earlier article’s blanket description of secret compliance orders was inconsistent with those provisions.
Section 4.1 excludes user-uploaded social-media programs, subject to stated exceptions, including programs prescribed by regulation. Describing all individual creators as regulated solely because they compete with broadcasters skips that legal structure.
What this record does not establish
The sources above do not establish the previous article’s claimed general Canadian data-localization requirement or a requirement to give authorities plaintext access. Nor do they support presenting a VPN as a remedy for obligations supposedly created by these two measures.
For a particular service, identify the actual rule, decision or data-handling policy at issue. Ask what information the service collects, where it processes it and which authority it cites. Those concrete questions are more useful than inferring surveillance powers from the phrase “digital sovereignty.” Broadcasting policy, privacy protections and AI regulation deserve scrutiny on their own terms, with the legal status of each measure made clear.