Canadians to Have More Control over Personal Information under Newly Proposed Privacy Bill
In Canada, the federal Liberals announced privacy legislation to offer Canadians greater control over how their personal data is used by businesses, levy fines on non-compliant businesses and establish new guidelines for the use of artificial intelligence (AI).
If passed, this law would replace the Personal Information Protection and Electronic Documents Act.
This newly proposed legislation is a long-awaited move forward in Canadian Innovation Minister Francois-Philippe Champagne’s mission to create the digital charter, a set of principles designed to increase consumer privacy rights and steer the digital economy’s development.
As reported, the minister said that it is one of the most “stringent frameworks” among G7 countries.
The bill, dubbed the Digital Charter Implementation Act of 2022, contains the same name and most of the same elements as a prior bill proposed by the Liberals in late 2020, but never passed.
As per the reports, while some privacy advocates had hoped for a more formal declaration of privacy as a fundamental right, the updated bill’s preamble states that protecting privacy interests is critical to individual autonomy and dignity, as well as the full enjoyment of fundamental rights and freedoms. It declares an intention to align Canadian regulations with international standards.
Furthermore, the bill, also known as Bill C-27, would establish a Consumer Privacy Protection Act to provide Canadians more control over their personal information and how digital platforms manage it. In simple terms, when firms no longer require personal information from Canadians, they could request that it be destroyed.
However, according to the new law, companies must acquire the consent of the individual whose information they seek in a language that the person might reasonably be expected to comprehend.
Individuals would have to be able to safely move their data from one organisation to another or have their data permanently deleted if they withdraw their consent for its usage, under the proposed laws.
Additionally, the minors’ personal information has been reclassified as “sensitive information,” with fewer exceptions for deletion at their request or that of their parents.
However, it was also reported that the federal privacy commissioner would have the authority to investigate complaints, issue orders for corporations to comply, and suggest fines if they did not. The recommendations would then be reviewed by a tribunal with the jurisdiction to issue court orders, and penalties would be imposed.
Non-compliant corporations would face the harshest penalty, which would be 5% of their global revenue or $25 million, whichever is greater.
AI and Data Act
Now, for the first time, the bill establishes guidelines for the responsible development of AI systems and criminal sanctions for individuals who abuse these technologies. The companies would be required to disclose their rationale for creating AI and report on their compliance with the precautions outlined in a proposed AI and Data Act.
The proposed AI and Data Act is intended to safeguard Canadians by ensuring that AI systems are created and deployed in a way that recognises, assesses, and mitigates the risks of damage and bias.
A commissioner for AI and data would be able to conduct independent audits of corporations’ operations as they develop the technology, and the minister would be able to file compliance orders with the courts. Organisations creating AI could face criminal charges if they use illegally obtained data with the purpose to inflict substantial injury or financial loss.
Moreover, making an AI system available for use while knowing or being “reckless” about whether it could inflict serious physical or psychological harm or substantial property damage would also be a criminal offence.
The bill’s consequences are being studied by key groups. Before being asked to speak before parliamentary committees, they will have time to formulate their remarks. But it would be unlikely that the bill would face intensive debate before the fall.
Meanwhile, the Canadian Chamber of Commerce released a statement welcoming the long-awaited reforms.
It said: “Canada needs 21st-century privacy legislation to help get the job done. It’s time to get down to work and get Bill C-27 passed without further delay.”
Even Canadian Marketing Association (CMA) said that the legislation is “an important and welcome step towards modernizing Canada’s private sector privacy law”.
