Areas of
Practice
Innovation, Science and Industry Minister François-Philippe Champagne

New federal privacy bill outlines rules for personal data use, AI in private sector

Friday, June 17, 2022 @ 11:41 AM | By Ian Burns


Ottawa has unveiled long-awaited rules for the use of Canadians’ personal data by the private sector, which includes the power to request information be destroyed, hefty fines for non-compliance and new provisions governing the use of artificial intelligence.

The Digital Charter Implementation Act, 2022, also known as Bill C-27, would advance the implementation of Canada’s digital charter by replacing the Personal Information Protection and Electronic Documents Act (PIPEDA) with a new Consumer Privacy Protection Act. It follows up on the original Digital Charter Implementation Act, which was introduced in 2020 but later died on the order paper when the 2021 federal election was called.

The new legislation would give people the freedom to move their information from one organization to another securely and ensures they can request that their information be disposed of when it is no longer needed. It also establishes stronger protections for minors, including by limiting organizations’ right to collect or use information on minors and holding organizations to a higher standard when handling minors’ information.

Innovation, Science and Industry Minister François-Philippe Champagne

Innovation, Science and Industry Minister François-Philippe Champagne

At a press conference unveiling the bill June 16, Innovation, Science and Industry Minister François-Philippe Champagne said it is about “giving more power to the people to protect their data and their children.”

“The digital transformation is completely changing the way that Canadians access information, buy goods and services and connect with each other. For us to prosper and benefit from this new digital landscape, we need to ensure that Canadians have confidence that their data is safe, that their privacy is being respected and that companies are deploying new technologies responsibly,” he said. “[The bill] will do just that for Canadians. It will not only modernize Canada’s privacy regime, but it will also introduce new measures to support the responsible development of artificial intelligence in our country.”

The bill would also provide the Privacy Commissioner of Canada with broad order-making powers, including the ability to order a company to stop collecting data or using personal information, and sets up an administrative tribunal to play a role in the enforcement of privacy laws. It also establishes significant fines for non-compliant organizations, with fines of up to five per cent of a company’s global revenue or $25 million, whichever is greater, for the most serious offenses.

Justice Minister David Lametti said Canadians expect the nation’s privacy laws to keep pace with technological and social change.

“While this shift to the digital world comes with a great benefit to Canadians, it’s our duty to ensure that we appropriately manage the risks posed by digital technologies,” he said. “This includes safety, security and privacy risks.”

Ellie Marshall, Blake Cassels & Graydon LLP

Ellie Marshall, Blake Cassels & Graydon LLP

Ellie Marshall, a consumer protection and privacy lawyer with Blake, Cassels & Graydon LLP, said the government’s 2020 legislation was criticized for the exceptions it carved out to the requirement to obtain an individual’s consent to the collection, use and disclosure of their personal information.

“I think [the new bill] demonstrates the government was responsive to the concerns they heard from both the business community and privacy advocates — they definitely listened to some of the concerns about the consent regime for sure,” she said. “One thing that stands out that will be helpful for businesses is there is a new exception for consent where the organization has a legitimate interest that outweighs adverse effects on the individual, and I think that is going to be the type of clarity that will help reduce compliance costs and help businesses of all sizes understand what their obligations actually are.”

The bill would also bring in an Artificial Intelligence and Data Act (AIDA) to regulate responsible development of AI in the Canadian marketplace. The new rules on artificial intelligence would ensure “high-impact” AI systems are developed and deployed in a way that identifies, assesses and mitigates the risks of harm and bias. New criminal prohibitions and penalties would be brought in surrounding the use of data obtained unlawfully for AI development, or where the reckless deployment of AI poses serious harm and where there is fraudulent intent to cause substantial economic loss through its deployment.

Marshall said she was interested to see the conversation which will arise from the AI legislation, expressing some concern that the definition of a number of terms, such as “high-impact artificial intelligence,” are being left to regulation.

“In this day and age, it is not uncommon to see governments leaving a lot to regulation, but as a lawyer wanting to advise my clients what is coming obviously we would prefer to have more clarity on what they mean,” she said. “I am always anxious to get those regulations, and hopefully we get more guidance on their intentions — let’s flesh out what they are actually intending to regulate, especially as it concerns AI.”

If you have any information, story ideas or news tips for The Lawyer’s Daily please contact Ian Burns at Ian.Burns@lexisnexis.ca or call 905-415-5906.