Ottawa unveils new rules for use of personal data, AI in privacy bill

Bill C-27, or the Digital Charter Implementation Act, 2022, that was tabelled by Innovation Minister François-Philippe Champagne in the House of Commons on Thursday, aims to build on the government’s previous attempts to revamp Canada’s private-sector privacy laws.

The proposed legislation includes three new sections around consumer privacy protection, personal information and artificial intelligence (AI).

It also includes a focus on the protection of children online, government officials told reporters during a technical briefing Thursday morning.

The proposed bill includes the Consumer Privacy Protection Act, which features tweaks to items made in the federal Liberals’ previous proposed legislation in 2020 that did not become law.

If passed, it would replace the Personal Information Protection and Electronic Documents Act.

The consumer act proposes to increase Canadians’ control over their personal information and how it is handled by digital platforms. Canadians could request that their information be disposed of when it is no longer needed by companies.

The act also creates stronger protections for minors, officials said, including by limiting organizations’ right to collect or use their information. It also proposes to create new guidelines for organizations to hold them to a “higher standard” when handling minors’ information.

Reformed privacy laws would establish “special status” for minors so they receive “heightened protection” under the law, an official said. They would have an “enhanced” right to request deletion, and parents would have the right to act on behalf of their children.

The privacy commissioner of Canada would also have broader powers under the act, including the ability to order a company to stop collecting data or using their personal information, as well as being able to penalize non-compliant organizations with fines of up to five per cent of global revenue or $25 million, whichever is greater, for the most serious offences.

“I would think some of the most serious offences could be around what people may do with the information with respect to children, and that’s why this act … will have very strict standards as to companies when they’re starting to collect, use and even store data with respect to children,” Champagne told reporters during a news conference Thursday afternoon.

“Yes, we need to give more power to people to have control over their data, but I would think in the case of children, we all are concerned to make sure we protect our children better and certainly that’s one of the things this act is doing today.”

The bill’s Personal Information and Data Protection Act piggybacks off the Consumer Privacy Protection Act, officials said.

The proposed Personal Information and Data Protection Tribunal Act will enable the creation of a new tribunal to facilitate the enforcement of the Consumer Privacy Protection Act, officials said.

The proposed Artificial Intelligence and Data Act is designed to protect Canadians by making sure AI systems are developed and deployed in a way that identifies, assesses and mitigates the risks of harm and bias.

As part of the act, a new AI and data commissioner will be created to support the minister of Innovation, Science and Industry in fulfilling ministerial responsibilities.

For example, they include monitoring company compliance, ordering third-party audits, and sharing information with other regulators and enforcers, the government said.

Furthermore, the commissioner will help outline clear criminal prohibitions and penalties regarding the use of data obtained unlawfully for AI development, or where the reckless deployment of AI poses serious harm and where there is fraudulent intent to cause substantial economic loss through its deployment.

“Organizations would be required to report on efforts to achieve compliance. This will include maintaining detailed records, and reporting general information to the public,” an official said.

“Organizations would need to be transparent about their use of these technologies to ensure the consumers get the right information on how such systems may impact them. Finally, organizations would also need to report on incidents of imminent or actual harm.”

It’s “long overdue” for Canada’s private-sector privacy laws to be overhauled, said Mark Agnew, senior vice president of policy and government relations with the Canadian Chamber of Commerce.

Without updated privacy legislation, businesses are at a disadvantage, he said in a statement.

“The current privacy regime came into force about 20 years ago. While there have been tweaks since then, it should go without saying that the digital world we live in today is vastly different from when Y2K was a top concern. The law has not kept up with the pace of change, nor with Canada’s international competitors,” Agnew said.

“Our educated workforce and advanced digital infrastructure give Canada a strong foundation to be a leader in the global digital future, but our international competitors are on the move. As virtual activities continue to increase, businesses and their customers must be confident that their data is protected. We also must also have laws in place that help companies innovate to meet the digital needs of our world.”