François-Philippe Champagne, Canada’s Minister of Innovation, Science and Industry, introduced a new bill last June to reform the Canadian Digital Charter, strengthen consumer privacy protection and establish clear rules to ensure fair competition in the online marketplace. It is within this framework that an AI and Data Commissioner could be appointed, who would then have the power to order third-party audits of companies’ activities.

In May 2019, the Canadian Federal Government introduced the Canadian Digital Charter and announced a set of measures to implement its principles.

In November 2020, it proposed a bill to better protect the personal data of Canadians and regulate its use by private companies. This bill, which implements the principles contained in the Canadian Digital Charter, would also allow Canadians to demand that companies that hold their personal data immediately destroy it when they withdraw their consent.

This consumer privacy bill was aimed primarily at private companies and the use they make of personal data collected from their customers on social networks and the Internet. The government intended to force them to obtain prior consent from their customers for this collection, in understandable and concise terms and no longer via voluminous documents in small print.

However, the bill was not passed by Parliament and was strongly criticized by the federal Privacy Commissioner at the time, Daniel Therrien.

The new bill

In June 2022, the government proposed the “Digital Charter Implementation Act, 2022” to modernize the private sector privacy framework and establish rules for the development and implementation of AI. Among the measures taken are:

• Increase the parameters of control and transparency when businesses handle the personal information of Canadians;
• Giving Canadians the freedom to transfer their information securely from one organization to another;
• Allowing Canadians to request the destruction of personal information they have provided, when they withdraw their consent or the information is no longer needed;
• Impose some of the toughest financial penalties in the G7 for violations of privacy laws. Penalties of up to 5% of revenue or $25 million, whichever is greater, for the most serious violations;
• Ensure that companies meet the highest standards of accountability when developing and implementing artificial intelligence systems in Canada.

Appointment of a Commissioner

The Privacy Commissioner of Canada, currently Philippe Dufresne, will have the power to prevent companies from collecting data, using personal information and sanctioning companies for violations.

To monitor corporate compliance in these areas, an AI and Data Commissioner would be appointed to assist ministers “in the administration and enforcement” of the legislation. This would allow the commissioner to order third-party audits of companies’ activities.

Translated from Canada : Nomination d’un Commissaire à l’IA et aux données dans le cadre du projet de loi 2022 sur la protection des données