Privacy bill sets out rules on use of personal data, artificial intelligence

Minister of Innovation, Science and Industry Francois-Philippe Champagne participates in an announcement on proposed legislation that includes a new privacy regime to give Canadians more control over their personal data, on Parliament Hill in Ottawa, on Thursday, June 16, 2022. THE CANADIAN PRESS/Justin Tang

OTTAWA — The federal Liberals introduced privacy legislation on Thursday to give Canadians more control over how their personal data is used by commercial entities, impose fines for non-compliant organizations and introduce new rules for the use of artificial intelligence.

It’s the first major update in this policy area since before the advent of Facebook, Twitter or even Pinterest, a platform that Innovation Minister François-Philippe Champagne mentioned more than once at an afternoon news conference.

The proposed law, Bill C-27, is a much-anticipated step toward Champagne’s mandate to advance the digital charter, a series of principles intended to strengthen consumer privacy protections and guide the development of the digital economy.

He told reporters it is “one of the most stringent frameworks you would find among G7 nations,” with Justice Minister David Lametti adding: “We’re racing to the top.”

The bill, known as the Digital Charter Implementation Act, 2022, shares its name and the bulk of its provisions with a previous bill the Liberals introduced in late 2020, which did not become law.

Though some advocates were hoping for a more formal enshrining of privacy as a fundamental right, the updated bill’s preamble spells out that the protection of privacy interests is “essential to individual autonomy and dignity and to the full enjoyment of fundamental rights and freedoms,” and states an intention to align Canadian regulations with international standards.

It would create a Consumer Privacy Protection Act to increase Canadians’ control over their personal information and how it is handled by digital platforms.

That includes a requirement that companies obtain the consent of the individual whose information they are seeking, using plain language that the person “would reasonably be expected to understand.”

Under the new rules, individuals would need to be able to have their data safely transferred from one organization to another, or to have their data permanently deleted if they withdraw their consent for its use.

The personal information of minors is newly defined as “sensitive information,” and its deletion at their request or that of their parents would be subject to fewer exceptions.

Though the Liberal government’s earlier attempt at new private-sector privacy rules was criticized by some as too weak, the new version doesn’t go much further in the powers it affords the federal privacy commissioner.

The commissioner would be able to investigate complaints, order companies to comply and recommend fines should they fail to do so.

A tribunal with the authority to make court orders would then review the recommendations and impose penalties. The severest penalty would see non-compliant companies paying five per cent of their global revenue or $25 million, whichever amount is greater.

What the bill does do for the first time is create rules around the responsible development of artificial intelligence systems⁠ and criminal penalties for those who misuse emergent technologies.

A proposed Artificial Intelligence and Data Act would require companies to document their rationale for developing AI and report on their compliance with the safeguards it sets out.

A commissioner for artificial intelligence and data would have the purview to order independent audits of companies’ activities as they develop the technology, and the minister would have the power to register compliance orders with courts.

Organizations developing AI could be criminally prosecuted for using unlawfully obtained data and where there is intent to cause serious harm or economic loss.

It would also be a crime to make an AI system available for use knowing or being “reckless” as to whether it could cause serious physical or psychological harm or substantial property damage.

The Canadian Chamber of Commerce said in a statement on Thursday that the changes are a welcome but long overdue development.

“The law has not kept up with the pace of change, nor with Canada’s international competitors,” said Mark Agnew, the organization’s senior vice-president.

“The so-called lines between ‘digital’ and ‘traditional’ business no longer exist and Canada’s laws must be equipped for this reality, or else our businesses risk falling behind their international counterparts.”

Key groups with an interest in the bill are taking the time to study its implications.

They will have time to organize their thoughts before being called upon to testify in parliamentary committees.

With the House of Commons soon rising for a summer break, it is unlikely the bill will see intensive debate before the fall.

This report by The Canadian Press was first published June 16, 2022.

Marie-Danielle Smith and Jim Bronskill, The Canadian Press