Bill C-27 – Canada’s proposed Artificial Intelligence and Data Act
Kevin Landry, Charlotte Henderson, and James Pinchak
The governance of Artificial Intelligence (AI) is entering a new era since the Canadian Government first announced a digital charter in 2019 as part of a larger-scale overhaul of Canada’s data privacy landscape (see our article about the announcement here). Recently, the White House announced a Blueprint for an AI Bill of Rights, and on June 16, 2022, Bill C-27, the Digital Charter Implementation Act, 2022 (“C-27“) was introduced to parliament here in Canada.
Bill C-27 contains three parts. The first will replace Part 1 of the Personal Information Protection and Electronic Documents Act with the Consumer Privacy Protection Act (“CPPA“), making CPPA the governing statute for data privacy at the federal level. The second part will establish a tribunal specializing in privacy and data protection. Part three of C-27, and the focus of this article, purports to enact the Artificial Intelligence and Data Act (“AIDA“), which would be Canada’s first AI legislation and one of few that has been enacted globally.
Purpose
The purpose of the AIDA is to establish common requirements throughout Canada with respect to the design, development, and use of Artificial Intelligence in the private sector and to prohibit conduct in relation to AI systems that could result in serious harm to individuals or their interests. The AIDA will operate in conjunction with the CPPA and Canada’s Anti-Spam Legislation to protect consumer interests in the digital space.
Requirements
Under the AIDA, any “person” (i.e. any legal entity, except certain government institutions) that carries out specified activities must establish various procedural and security measures with respect to the use and processing of anonymized data in an Artificial Intelligence system. This includes risk assessment and mitigation, public disclosure, and record-keeping requirements, including a requirement to keep records describing the measures established.
The specified activities to which AIDA applies are called “regulated activities”. This includes various activities carried out during international or interprovincial trade and commerce such as:
- Processing or making available for use any data related to human activities to develop an Artificial Intelligence system; or
- Designing, developing, or making an Artificial Intelligence system available for use or managing its operations.
Currently, the AIDA is only expected to apply to persons that engage in inter-provincial or international commerce. In other words, any person that exists in and operates solely out of a single province will not be subject to AIDA. This creates considerable room for provincial governments to begin implementing their own Artificial Intelligence-focused legislation.
AIDA also imposes additional, more stringent requirements on persons that are responsible for “high-impact” Artificial Intelligence systems. While the qualification criteria for high-impact systems will be established in yet-to-be drafted regulations, the persons responsible for these systems will have to take additional actions such as:
- Establishing measures to identify, assess, and mitigate risks associated with the use of the Artificial Intelligence system as well as procedures to monitor compliance with such measures; and
- Publishing a description of the system on a public website which includes, among others, an explanation of the intended use of the Artificial Intelligence system and the mitigation measures established in respect of it.
Ministerial Orders
The AIDA grants the Minister many investigatory powers including the ability to:
- Compel disclosure of records in which a person is required to maintain pursuant to the AIDA;
- Compel a person to conduct an audit to review its compliance and implement measures to address any issues flagged during the audit;
- Compel a person who is responsible for a high-impact system to cease use of it; and
- Compel a person to make information with respect to the Requirements and/or an audit publicly available.
Administrative Monetary Penalties and Offences
As written, the AIDA creates a variety of Administrative Monetary Penalties. In some cases, these penalties can rise to the greater of $10,000,000 or 3% of the person’s gross global revenues in its previous financial year, or, in the case of an individual, a fine at the discretion of the court. AIDA also creates criminal offences related to:
- The possession or use of Personal Information knowing or believing that such information was obtained as a result of the commission of an offence;
- Making an Artificial Intelligence system available for use knowing that it is likely to cause serious harm to an individual or their property and the use of the system actually causes such harm; and
- Making an Artificial Intelligence system available for use with the intent to defraud the public and to cause substantial economic loss to an individual and it actually causes such loss.
This update is intended for general information only. If you have questions about the above, please contact the authors.
Click here to subscribe to Stewart McKelvey Thought Leadership.
Archive
Jennifer Taylor Introduction Appeal courts in Ontario1 and Nova Scotia2 have now issued decisions about Trinity Western University’s proposed law school (“TWU”) in British Columbia, and at first glance they couldn’t be more different. The Court of Appeal for…
Read MoreJoe Thorne1 and Giles Ayers2 Limitation periods serve a critical function in the civil justice system. They promote the timely resolution of litigation on the basis of reliable evidence, and permit litigants to assess their legal exposure…
Read MoreOn July 14, 2016 the Supreme Court of Canada issued a significant decision affecting federally regulated employers across Canada. In Wilson v. Atomic Energy of Canada Limited the Court held that the purpose of the unjust dismissal…
Read MoreOn April 1, 2016 New Brunswick’s Mortgage Brokers Act came into force, requiring businesses acting as mortgage brokerages or as mortgage administrators in New Brunswick to be licensed. A mortgage brokerage is a business that on behalf…
Read MoreIn May 2016, the Federal Court of Canada confirmed that copyright does not protect facts, even where a book’s author is clearly inspired by the content of a film (Maltz v. Witterick, 2016 FC 524 (CanLII)).…
Read MoreBy Jennifer Taylor “…firms of notaries or lawyers…must not be turned into archives for the tax authorities”1 So says the Supreme Court of Canada in one of two highly anticipated decisions on solicitor-client privilege, offering lawyers…
Read MoreJoe Thorne1 and Clara Linegar2 As joint owners of a business, what do you do when the business relationship falls apart? And what if one owner undermines the business in the process? In Smith v Hillier,3 Justice Paquette…
Read MoreThe Supreme Court of Canada has dismissed the appeals in Bruce Brine v. Industrial Alliance Insurance and Financial Services Inc.1 (with costs) and Luciano Branco, et al. v. Zurich Life Insurance Company Limited, et al.(without costs). Both of…
Read MoreOn May 4, 2016, the Nova Scotia Pooled Registered Pension Plans Act (“PRPP Act”) was proclaimed in force, and finalized Pooled Registered Pension Plan Regulations were released. While there were no major changes from the previously released draft regulations, the proposed rules…
Read MoreBy Level Chan and Dante Manna Pooled Registered Pension Plans (“PRPPs”) are closer to becoming a reality for Nova Scotian employers. PRPPs were established by the Federal government in an effort to address the lack of retirement savings…
Read More