January 20, 2023 | By Avneet Nehel and Craig Zawada

This year will be big for privacy law around the world. While Europe and UK are planning new legislation on Artificial Intelligence (“AI”) to promote responsible innovation, Canada is coming out with its own legislation to strengthen privacy laws and create a better environment for development of AI in Canada.

A comprehensive Act known as the Digital Charter Implementation Act was introduced by the federal government in 2022 and is likely to come into effect in 2023. It introduces three proposed acts, namely, the Consumer Privacy Protection Act, the Artificial Intelligence and Data Act, and the Personal Information and Data Protection Tribunal Act.

The Consumer Privacy Protection Act (“CPPA”) aims to govern the protection of personal information of individuals while considering the need of an organization to collect, use or disclose that information during their commercial activities. The previous federal legislation, the Personal Information Protection and Electronic Documents Act (“PIPEDA”) has been in place for over 20 years. While it was one of the world’s earlier legislative responses, it has been overtaken by more recent statutes such as the EU’s General Data Protection Regulation, and the California Consumer Privacy Act.

The CPPA repeals Part 1 of PIPEDA and changes its title to the Electronic Documents Act (“EDA”). The EDA will govern the use of electronic documents by the federal public sector in addition to supplementing existing privacy laws.

The CPPA addresses the current needs of Canadians relying on digital technology and substantially increases privacy obligations. It aims at ensuring the privacy of Canadians is protected and innovative businesses can benefit from clear rules as technology evolves. The federal government aims to achieve this through:

• increasing control and transparency of personal information being handled by organizations;
• providing Canadians the freedom to move information from one organization to another in a secure manner;
• ensuring that Canadians can request destruction of their information when it is no longer needed;
• establishing a robust system to protect minors, including ensuring organizations’ right to collect or use information on minors is limited, and organizations are held to a higher standard when handling minors’ information;
• providing the Privacy Commissioner of Canada with broader powers, including passing orders prohibiting a company from collecting data or using personal information; and
• introducing heavy fines for non-compliant organizations, including a maximum fine of 5% of global revenue of $25 million, whichever is greater.

The Artificial Intelligence and Data Act (“AIDA”) comes as the AI field is advancing at a face pace. AIDA will introduce rules to strengthen Canadian trust in the development and use of AI systems including:

• developing rules that identify, assess and mitigate the risk of harm and biased output related to high-impact AI systems, ensuring that Canadians are protected and at the same time does not hinder the development and use of AI systems;
• establishing an AI and Data Commissioner who will support the Ministry of Innovation, Science and Industry to fulfill their objectives, including corporate compliance, third party audits, and sharing information with other regulators and enforcers as appropriate; and
• prohibiting the use of data obtained unlawfully for AI developments by implementing criminal prohibitions and penalties or where the user is reckless in their use of AI posing serious harm and has a fraudulent intent to cause substantial economic loss through such use.

AIDA is not well defined at the moment. It will depend on regulations and other fine tuning to develop specific rules surrounding the regulation of AI in Canada.

The Personal Information and Data Protection Tribunal Act is being established to help enforce the CPPA. The Tribunal will review the recommendations that the Privacy Commissioner of Canada proposes on an entity and decide whether to impose the administrative monetary penalties for contravention of the CPPA. The Tribunal will also provide a mechanism to organizations and individuals seeking review of the decisions of Privacy Commissioner.

With AI developing in almost every sector, including clean technology and healthcare, there is a need to ensure this technology is built on safety and trust, and that private information is not misused. The federal government recognises the information of Canadians, particularly younger residents, needs to be protected, as more and more Canadians rely on digital technology to connect work and innovate. The government is focusing on harmonizing with international laws to ensure the standards for international and interprovincial trade in AI systems are aligned with international requirements, supporting international market access for Canadian businesses.

2023 will be an exciting year for privacy. There is lots more to talk about in this area. Be on the lookout for more updates on our website.

Do not hesitate to contact a member of our team to learn more and talk about what services we offer.

Disclaimer

This publication is provided as an information service and may include items reported from other sources. We do not warrant its accuracy. This information is not meant as legal opinion or advice. Contact Procido LLP (www.procido.com) if you require legal advice on the topic discussed in this article.