Model Privacy Policy templates coming soon!
PRIVACY AND AI
Canada:
Bill C-27, “Digital Charter Implementation Act, 2022”, was introduced yesterday that would
- enact the “Consumer Privacy Protection Act” directed to the use of personal information, replacing portions of PIPEDA.
- establish a tribunal for hearing appeals of decision made by the Privacy Commissioner and impose penalties.
- enact the “Artificial Intelligence and Data Act” regulating the use of artificial intelligent systems, particularly those with a ‘high-impact’.
The legislation (link to text) was introduced after a previous iteration, Bill C-27 died on the order paper last fall.
SUMMARY
Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act. It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act, which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act.
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.
An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts
Personal Information Protection and Electronic Documents Act
Access to Information Act
Aeronautics Act
Canada Evidence Act
Canadian Radio-television and Telecommunications Commission Act
Competition Act
Canada Business Corporations Act
Telecommunications Act
Public Servants Disclosure Protection Act
Chapter 23 of the Statutes of Canada, 2010
Transportation Modernization Act
https://www.parl.ca/DocumentViewer/en/44-1/bill/C-27/first-reading
Any person responsible for an artificial intelligence system (with ‘high-impact’ or not, that processes or makes available anonymized data (including for designing and developing) an artificial intelligence system will be required to establish measures regarding the manner in which the data is anonymized and the use or management of that data. The details of the requirements for those measures will be set in the regulations to the Act. Each responsible person will also be required to keep records, available for inspection, on those measures.
