Made in Canada at Global Privacy Rights. A response to State of Digital Governance in Canada 2026: extending digital sovereignty to consent, autonomy and the right to choose how we are identified online, across borders.
The Digital Governance Council’s State of Digital Governance in Canada 2026 defines digital sovereignty as “the capacity to choose”. We agree, and we think the definition is stronger than its application. The report asks whether organisations and institutions can preserve and exercise meaningful choice. The same question applies to every person who uses a digital service: whether they can choose to be identified, by whom, for what purpose, and under which country’s rules.
Our response extends sovereignty from the organisation to the person, through consent and autonomy. The right to choose whether, when and by whom to be digitally identified online, including when the identification crosses a border, is where national digital sovereignty becomes something a person can actually hold. Consent is the instrument that does it. It is the digital sovereignty superpower: the one power that makes every other sovereignty claim real for the person it is about.
Two groups make this urgent. Children, because the systems built to protect them online increasingly do it by identifying them. And the environment, because the claims that protect it (where a product came from, what it contains, who stands behind it) are only as trustworthy as the record that carries them. In both cases the answer is the same instrument: a notice before identification, a record the person keeps, and a controller who can be found.
Provenance: this response is based on the Council’s announcement of 22 October 2026. The full report was not linked from the announcement and has not been read.
The announcement sets out three connected developments. Access to technology, infrastructure and markets is increasingly used as strategic leverage. Digital sovereignty depends on whether organisations can preserve and exercise meaningful choice. Canada’s ability to respond rests on how well its institutions connect expertise, authority and implementation across sectors and jurisdictions.
It makes a point that much of the sovereignty debate misses. Ownership and data location do not determine control. Data can remain in Canada while the technology that manages it is governed elsewhere, and a contractual right to change supplier is worth little without the operational capability to do it.
It then asks practical questions. Can essential services continue if a critical dependency changes? Can information move between systems? Who can authorise access or assign authority to automated systems? And it names standards, interoperability and evidence of conformity as the common foundations for working across institutional boundaries.
Each of these questions has a version that belongs to the individual. The report asks them on behalf of organisations. We ask them on behalf of people.
A country is sovereign over its digital economy when it can choose its dependencies and act on that choice. A person is sovereign online on the same terms: when they can choose what they disclose, to whom, and for what, and can act on that choice later by withdrawing it. That capacity has a name in privacy law. It is consent, and behind consent, autonomy.
Canada already recognises sovereignty held by people rather than by states. The First Nations principles of ownership, control, access and possession (OCAP®) treat data about a community as subject to that community’s own decisions. The principle generalises: sovereignty that cannot be exercised by the people the data describes is control held on their behalf, not by them.
Identification is the decision that comes first and is hardest to undo. Once a service links a person’s activity to an identifier, every later choice is made inside that linkage. So the first choice a person needs is whether to be identified at all, and if so, with what: an attribute (over 18, resident in Quebec) rather than an identity, a pseudonym rather than a name.
That choice can only be informed if the person can read the terms before they are identified. This is the principle of notice before identification: the controller’s identity, the purpose and the person’s rights are disclosed first, and are inspectable without logging in, signing up or being tracked.
A choice that leaves no record is a choice the person cannot later prove they made, and cannot withdraw with confidence. Sovereignty for an organisation depends on evidence it can act on; the same is true for a person. The instrument is a notice receipt: a record, held by the person, of the notice they were shown, the version, the purpose and the controller. It is the individual’s evidence of conformity, and it is evidence the organisation cannot rewrite.
Identification crosses borders far more easily than the rights that should come with it. A Canadian identified by a service governed elsewhere takes on that jurisdiction’s terms, often without being told. Cross-border sovereignty for the person means three things: being told before data or identity leaves the country, being able to confirm or refuse it, and holding a record of that confirmation that a regulator in either jurisdiction can rely on.
Children are where the cost of getting this wrong is highest and where the current direction is most at risk.
Age assurance is spreading across jurisdictions as the main way to protect children online. Its common forms work by identifying or profiling the person to estimate or verify their age. A safeguard built that way exposes the child it is meant to protect: it creates identity and behavioural records about children, often held by third-party providers in other jurisdictions.
Sovereignty of choice changes the design question. Instead of “how do we identify the child?”, it asks “what is the least a service needs to know, who learns it, and what record does the child and their guardian keep?”
Protecting children online should not require identifying them more thoroughly than adults. A transparency-first design, where the notice comes first, only the attribute is disclosed and the record stays with the family, protects them without building the profile that puts them at risk.
The environmental case rests on the same mechanism, applied to things as well as people.
Claims about where a product came from, what it contains, how it was made and who is responsible for it are disclosures by an identified party, about a purpose, to someone who needs to rely on them. Digital product passports, which the European Union is introducing for products sold in its market, are structured notices of exactly this kind. A passport is only as trustworthy as the ability to identify who issued it, to know which version was shown, and to detect when it changed.
The instruments are the same ones a person needs: a controller who can be identified, a versioned and resolvable notice, and a public log of changes. A provenance claim that cannot be traced to an accountable party is greenwashing with better formatting.
The Council’s point that ownership does not determine control applies directly to supply chains. A Canadian organisation can own the resource and still depend on records about it that are held and governed elsewhere. Whoever controls the provenance record controls what can be claimed about the resource, and to which markets it can be sold. Choice over environmental claims is a sovereignty question in the report’s own terms.
Every unnecessary identification produces data that is stored, copied, processed and kept. Designing for the minimum disclosure, an attribute instead of an identity and a receipt instead of a profile, reduces the records held and the infrastructure needed to hold them. Data minimisation is a privacy principle that also reduces the footprint of digital services.
| The Council asks, for organisations | The same question, for the person |
|---|---|
| What decisions remain within our control? | Can I choose whether, and how, I am identified? |
| Can information move between systems? | Can I take my records with me, and withdraw consent where they are held? |
| Who can authorise access or assign authority to automated systems? | Who is the controller, and who authorised the system acting on my data? |
| Can essential services continue if a dependency changes? | Can I still use a service if I refuse to be identified beyond what it needs? |
| What evidence of conformity exists? | What record of the notice I was shown do I hold? |
| Where does economic value accumulate? | Who benefits from what is inferred about me, and was I told? |
Canada is drafting the instrument that would carry this right. Bill C-36, the Protecting Privacy and Consumer Data Act, is at second reading in the House of Commons. It takes real steps: inferred information is personal information (s.2(1)), purposes must be determined and recorded at or before collection (s.12(3)), and consent is invalid unless five items are provided before it is sought (s.15(3)).
Three gaps remain for sovereignty of choice:
The Bill also offers a route to close them. Sections 92 to 96 create approved codes of practice and certification programs, open to any entity, with independent verification and public approval. A Canadian code of practice for operational transparency, covering controller identification, notice before identification, receipts and cross-border notice, fits that route and needs no new legislation.
Transparency Lab runs these instruments on its own services, so they can be inspected rather than described:
These are working examples of the report’s own call for standards, interoperability and evidence of conformity, applied to the person.
We would welcome the chance to contribute to the Council’s work on sovereignty and evidence of conformity, and to offer the Lab’s notice and records as a worked case for the question “who can authorise access”. We propose three areas for joint attention:
Digital sovereignty is the capacity to choose. Consent is how a person exercises it, and it is complete when it reaches every person, made in Canada and recognised across borders.
Transparency Lab is the research lab of Global Privacy Rights in Montréal. It runs the instruments this paper describes on its own services, so they can be inspected rather than described: a notice readable before identification, receipts held by the person, and a public log of every change.
Contact: info@transparencylab.ca