Bill C-27 – Canada’s proposed Artificial Intelligence and Data Act
Kevin Landry, Charlotte Henderson, and James Pinchak
The governance of Artificial Intelligence (AI) is entering a new era since the Canadian Government first announced a digital charter in 2019 as part of a larger-scale overhaul of Canada’s data privacy landscape (see our article about the announcement here). Recently, the White House announced a Blueprint for an AI Bill of Rights, and on June 16, 2022, Bill C-27, the Digital Charter Implementation Act, 2022 (“C-27“) was introduced to parliament here in Canada.
Bill C-27 contains three parts. The first will replace Part 1 of the Personal Information Protection and Electronic Documents Act with the Consumer Privacy Protection Act (“CPPA“), making CPPA the governing statute for data privacy at the federal level. The second part will establish a tribunal specializing in privacy and data protection. Part three of C-27, and the focus of this article, purports to enact the Artificial Intelligence and Data Act (“AIDA“), which would be Canada’s first AI legislation and one of few that has been enacted globally.
Purpose
The purpose of the AIDA is to establish common requirements throughout Canada with respect to the design, development, and use of Artificial Intelligence in the private sector and to prohibit conduct in relation to AI systems that could result in serious harm to individuals or their interests. The AIDA will operate in conjunction with the CPPA and Canada’s Anti-Spam Legislation to protect consumer interests in the digital space.
Requirements
Under the AIDA, any “person” (i.e. any legal entity, except certain government institutions) that carries out specified activities must establish various procedural and security measures with respect to the use and processing of anonymized data in an Artificial Intelligence system. This includes risk assessment and mitigation, public disclosure, and record-keeping requirements, including a requirement to keep records describing the measures established.
The specified activities to which AIDA applies are called “regulated activities”. This includes various activities carried out during international or interprovincial trade and commerce such as:
- Processing or making available for use any data related to human activities to develop an Artificial Intelligence system; or
- Designing, developing, or making an Artificial Intelligence system available for use or managing its operations.
Currently, the AIDA is only expected to apply to persons that engage in inter-provincial or international commerce. In other words, any person that exists in and operates solely out of a single province will not be subject to AIDA. This creates considerable room for provincial governments to begin implementing their own Artificial Intelligence-focused legislation.
AIDA also imposes additional, more stringent requirements on persons that are responsible for “high-impact” Artificial Intelligence systems. While the qualification criteria for high-impact systems will be established in yet-to-be drafted regulations, the persons responsible for these systems will have to take additional actions such as:
- Establishing measures to identify, assess, and mitigate risks associated with the use of the Artificial Intelligence system as well as procedures to monitor compliance with such measures; and
- Publishing a description of the system on a public website which includes, among others, an explanation of the intended use of the Artificial Intelligence system and the mitigation measures established in respect of it.
Ministerial Orders
The AIDA grants the Minister many investigatory powers including the ability to:
- Compel disclosure of records in which a person is required to maintain pursuant to the AIDA;
- Compel a person to conduct an audit to review its compliance and implement measures to address any issues flagged during the audit;
- Compel a person who is responsible for a high-impact system to cease use of it; and
- Compel a person to make information with respect to the Requirements and/or an audit publicly available.
Administrative Monetary Penalties and Offences
As written, the AIDA creates a variety of Administrative Monetary Penalties. In some cases, these penalties can rise to the greater of $10,000,000 or 3% of the person’s gross global revenues in its previous financial year, or, in the case of an individual, a fine at the discretion of the court. AIDA also creates criminal offences related to:
- The possession or use of Personal Information knowing or believing that such information was obtained as a result of the commission of an offence;
- Making an Artificial Intelligence system available for use knowing that it is likely to cause serious harm to an individual or their property and the use of the system actually causes such harm; and
- Making an Artificial Intelligence system available for use with the intent to defraud the public and to cause substantial economic loss to an individual and it actually causes such loss.
This update is intended for general information only. If you have questions about the above, please contact the authors.
Click here to subscribe to Stewart McKelvey Thought Leadership.
Archive
On April 21, 2015, the Nova Scotia government declared that the new Pension Benefits Act (passed in 2011) and new Pension Benefits Regulations will come into effect on June 1, 2015. The new Regulations follow the new Act and draft Regulations summarized in…
Read MoreAn uninsured driver strikes another vehicle, injuring its occupants. These injured persons obtain a settlement from their own motor vehicle insurer (pursuant to Section D of the standard policy), and they assign their action against…
Read MoreThe Editors’ Corner Michelle Black and Sean Kelly Hello! We are very pleased to be the new Atlantic Employers’ Counsel (AEC) editors. We look forward to bringing you what we hope you will find to be interesting…
Read MoreFollowing several Supreme Court of Canada decisions in the late 1990s and early 2000s, the law of constructive dismissal was well defined – or so many thought. The Court’s decision in Potter v. New Brunswick Legal…
Read MoreIn our May 20, 2014 client update, we reported on significant changes affecting automobile insurance in Prince Edward Island, including changes to no-fault benefits available under section B and changes to the damages cap for minor…
Read More2014 LABOUR AND EMPLOYMENT ATLANTIC CANADA LEGISLATIVE UPDATE As we move forward in 2015, we know our region’s employers will want to be aware of new legislation that has passed or could soon pass that…
Read MoreOn January 28, 2015, the Office of the Superintendent of Insurance issued a bulletin in Nova Scotia. The 2015 minor injury cap has been set at $8,352, an increase of 1.7 per cent over 2014.…
Read MoreIn preparing for the 2015 proxy season, you should be aware of some regulatory changes that may impact disclosure to and interactions with your shareholders. This update highlights what is new in the 2015 proxy…
Read MoreDuring the Fall 2014 legislative sitting, the Province of Prince Edward Island passed legislation that results in significant changes to the Lands Protection Act. The amendments have just been proclaimed and were effective January 1, 2015.…
Read MoreThe Editor’s Corner Clarence Bennett This issue focuses on the family and the interaction between employment and family obligations. As 2014 comes to a close, I would like to extend Seasons Greetings to all of…
Read More