Artificial Intelligence and Digital Innovation Minister Evan Solomon during Question Period on Monday.Adrian Wyld/The Canadian Press
Companies will be required to take on new responsibilities to protect data on children and to delete the personal information of Canadians if requested, under a new bill introduced in the House of Commons on Monday that aims to update the country’s privacy laws.
The bill would also give a new federal regulator the power to combat surveillance pricing, where retailers charge Canadians different prices for the same item using information about their shopping habits.
While launching the bill on Monday, Evan Solomon, Minister of Artificial Intelligence and Digital Innovation, told reporters it “takes aim at surveillance pricing to stop price gouging.”
But he said he did not want the new rules to interfere with data used in a beneficial way, for example for loyalty cards, which can utilize data on consumers’ behaviour to offer deals.
The bill does not explicitly mention surveillance pricing, but in an interview Mr. Solomon said he plans to ask the new regulator when it is set up to issue guidance to companies about the practice.
Social-media bill forces companies to label AI content, harmful material pushed by bot farms
The privacy bill would create a higher standard for the protection of data relating to children and is likely to lead to rules requiring companies to obtain express consent from parents to retain it, and to ensure that it is retained for a shorter time period than for adults.
“The bill requires companies to treat children’s personal information as sensitive. That means stronger protection when companies collect, use or share information about children,” Mr. Solomon told reporters.
Canadians would be able to ask companies to delete their data and information – including deepfakes, when AI uses someone’s likeness to create a synthetic image of them doing or saying things they did not do or say.
There would be exceptions to the deletion rule, including if an organization is retaining information that does not directly identify someone, and for personal data being used by law enforcement.
The Canadian Press
The bill would enhance transparency on how companies are using Canadians’ data. Consumers would, for example, be able to ask which personal data were used in reaching a decision on a mortgage or credit rating.
It would also require companies to be transparent about their use of AI and other forms of automated decision making, with little or no human input, when it comes to significant decisions about people.
Mr. Solomon said in the interview people want “visibility inside how decisions are made by AI.”
Canadians want to see companies apply a higher standard when dealing with the personal information of those younger than 18, he added.
“Canadians have reached the point where they say, look, ‘We know our data is important, we know our kids’ data is important. We want to protect it, we want some controls – just take care of our kids’ information, it’s something that is very valuable,’” he said. He added that it was not controversial to tell companies to treat the information that they are collecting “with a higher degree of responsibility. Don’t resell it and have some transparency.’”
Ottawa introduces bill to restrict social media for teens, regulate AI chatbots
The legislation, known as Bill C-36, would give the power to oversee Canada’s expanded privacy regime to a new digital safety regulator first announced when the federal government tabled its Safe Social Media bill on June 11.
Called the Digital Safety Commission in the earlier bill, the privacy bill would rename the regulator, which would have a dual mandate, the Digital Safety and Data Protection Commission of Canada.
The new regulator would be able to impose penalties of up to $10-million or 3 per cent of global revenue, whichever is greater, on companies that don’t uphold their duties under the bill.
In a statement on Monday, Privacy Commissioner of Canada Philippe Dufresne, who will retain the responsibility for overseeing privacy in government and the public sector, said the privacy bill “represents a pivotal step for privacy in Canada” and that he was pleased many of his recommendations had been accepted.
“In particular, I welcome proposals to recognize privacy as a fundamental right, an explicit recognition of the best interests of children, requirements to conduct privacy impact assessments, and stronger enforcement powers,” he said.
The privacy bill updates the existing Personal Information Protection and Electronic Documents Act (PIPEDA), which sets out rules for how businesses – including tech companies, and federally regulated companies such as airlines and banks – collect and use their customers’ personal information.
The current law is more than 25 years old and was written before the advent of AI and deepfakes, and before children’s data were widely collected online.
The new bill would make it easier for people to transport data from one business to another. After receiving a request to transfer personal information it has collected, a business would have to comply as soon as feasible.
The bill would require consent to be sought for the use of personal information with explanations in clear language on how it would be handled. People would be able to withdraw their consent for their data to be used.
Businesses would only be able to collect, use or disclose personal information for a purpose that “a reasonable person would consider appropriate in the circumstances.”
A business would have to take into account a number of factors including the sensitivity of the personal information, and whether there are less intrusive ways of achieving a legitimate business need at a comparable cost and with comparable benefits.
There are a number of exceptions in the bill to the requirement to first get a person’s consent – or in the case of a child, a parent’s consent – to collect personal information. This includes if the collection of someone’s personal data “is clearly in the interests of the individual and consent cannot be obtained in a timely way.”
A business may also use someone’s personal information without their knowledge if there is an emergency threatening the health, life or security of someone.
The bill would require robust privacy safeguards and risk assessments before people’s personal information is transferred outside Canada.
Vass Bednar, managing director of the Canadian Shield Institute, an independent think tank focusing on strengthening Canada’s economic resilience, sovereignty and global competitiveness, said “overall, this bill is a welcome restart, but the test will be whether it gives Canadians meaningful protection in the digital economy.”