Privacy bill sets out rules on use of personal data, artificial intelligence

The federal Liberals introduced privacy legislation on Thursday that would give Canadians more control over how their personal data is used by commercial entities, impose fines for non-compliant organizations and introduce new rules for the use of artificial intelligence.

It's the first major update in this policy area since before the advent of Facebook, Twitter or even Pinterest, a platform that Innovation Minister Francois-Philippe Champagne mentioned more than once at an afternoon news conference.

The proposed law, Bill C-27, is a much-anticipated step toward Champagne's mandate to advance the digital charter, a series of principles intended to strengthen consumer privacy protections and guide the development of the digital economy.

He told reporters it is "one of the most stringent frameworks you would find among G7 nations."

"We're racing to the top," said Justice Minister David Lametti.

The bill, called the Digital Charter Implementation Act 2022, shares its name and the bulk of its provisions with a previous bill the Liberals introduced in late 2020 which did not become law.

Though some advocates were hoping for a more formal enshrining of privacy as a fundamental right, the updated bill's preamble says that the protection of privacy interests is "essential to individual autonomy and dignity and to the full enjoyment of fundamental rights and freedoms," and states an intention to align Canadian regulations with international standards.

It would create a Consumer Privacy Protection Act to increase Canadians' control over their personal information and how it is handled by digital platforms.

That includes a requirement that companies obtain the consent of the individual whose information they are seeking, using plain language that the person "would reasonably be expected to understand."

Under the new rules, individuals would need to be able to have their data safely transferred from one organization to another, or have their data permanently deleted if they withdraw their consent for its use.

The personal information of minors is newly defined in the bill as "sensitive information" and its deletion at their request or that of their parents would be subject to fewer exceptions.

Though the Liberal government's earlier attempt at new private-sector privacy rules was criticized by some as too weak, the new version doesn't go much further in the powers it affords the federal privacy commissioner.

The commissioner would be able to investigate complaints, order companies to comply and recommend fines should they fail to do so.

A tribunal with the authority to make court orders would then review the recommendations and impose penalties. The severest penalty would see non-compliant companies pay five per cent of their global revenue or $25 million, whichever amount is greater.

What the bill does do for the first time is create rules on the responsible development of artificial intelligence systems and criminal penalties for those who misuse emergent technologies.

A proposed Artificial Intelligence and Data Act would require companies to document their rationale for developing AI and report on their compliance with the safeguards it sets out.

A commissioner for artificial intelligence and data would have the authority to order independent audits of companies' activities as they develop the technology, and the minister would have the power to register compliance orders with courts.

Organizations developing AI could be criminally prosecuted for using unlawfully obtained data, and where there is intent to cause serious harm or economic loss.

It would also be a crime to make an AI system available for use knowing it could cause serious physical or psychological harm or substantial property damage.

Businesses organizations welcome changes

The Canadian Chamber of Commerce said in a statement Thursday that the changes are a welcome but long overdue development.

"The law has not kept up with the pace of change, nor with Canada's international competitors," said the organization's senior vice-president Mark Agnew.

"The so-called lines between `digital' and `traditional' business no longer exist and Canada's laws must be equipped for this reality, or else our businesses risk falling behind their international counterparts."

In a media statement, the Canadian Marketing Association (CMA) called the legislation "an important and welcome step towards modernizing Canada's private sector privacy law."

"An updated privacy framework is urgent to ensure that consumers have updated protections, and that the businesses that are fuelling our economic recovery have clear and consistent privacy rules that enable innovation and growth," Sara Clodman, CMA vice-president of public affairs and thought leadership, said in the statement.

The CMA said it will study the bill and provide input to Parliamentarians in the weeks ahead.

With the House of Commons soon rising for a summer break, it is unlikely the bill will see much debate until the fall.

New privacy commissioner appointed

Daniel Therrien, who long pushed for reforms as federal privacy commissioner, criticized the previous bill as "a step back overall" from the current law.

It would give consumers less control and organizations more flexibility in monetizing personal data without increasing their accountability, he said in May of last year, before the legislation expired upon the general election call.

Therrien, whose term as commissioner recently ended, also said the legislation put commercial interests ahead of the privacy rights of people, and he advocated adopting a framework that would entrench privacy as a human right.

Philippe Dufresne, the government's nominee to replace Therrien, told a House of Commons committee this week the coming bill must recognize privacy as a "fundamental right."