Bill 194 – AI Overview
Today, Ontario’s Minister of Public and Business Service Delivery Todd McCarthy tabled Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act.
The bill is intended to strengthen digital systems and services throughout the Ontario Public Service (OPS) and the non-OPS public entities.
The new legislation includes the creation of a new statute, the Enhancing Digital Security and Trust Act (EDSTA), and amendments to the Freedom of Information and Protection of Privacy Act (FIPPA).
Under the EDSTA, the government would create policy levers for the Minister to set requirements for cyber security, artificial intelligence, and children’s data protection including:
- Establishing regulation making authority and directive making authority to create requirements to strengthen cyber security across the public sector with clear accountabilities. This would include creating requirements for cyber security incident reporting, program leads, and maturity progress reporting schedules. In the near term the ministry of Public and Business Service Delivery will be looking at implementing these changes in hospitals, school boards, colleges and universities, and with children’s aid societies.
- Defining Artificial Intelligence for consistency, and establishing requirements surrounding guardrails covering transparency, accountability, and risk management
- Establishing regulation and directive making authority to prevent the misuse of children’s data. These provisions will apply to school boards and children’s aid societies.
The EDSTA also proposes several key definitions including:
- A definition for an Artificial Intelligence System:
“artificial intelligence system” means,
(a) a machine-based system that, for explicit or implicit objectives, infers from the input it receives in order to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments, and
(b) such other systems as may be prescribed; (“système d’intelligence artificielle”)
Artificial intelligence system (2) For greater certainty, for the purposes of this Act, use of an artificial intelligence system by a public sector entity includes use of a system that is,
(a) publicly available;
(b) developed or procured by the public sector entity; or
(c) developed by a third party on behalf of the public sector entity
- A definition for Cyber Security
“cyber security” means the security, continuity, confidentiality, integrity and availability of digital information and the infrastructure housing and transmitting digital information, and includes the body of technologies, processes, practices and response and mitigation measures designed to protect networks, computers, programs and information from attack, damage or unauthorized access; (“cybersécurité”)
A definition for Digital Information
Digital information (3) For greater certainty, for the purposes of this Act, the collection, use, retention or disclosure of digital information by a public sector entity includes collection, use, retention or disclosure of digital information by a third party on behalf of the public sector entity.
Bill 194 Ammendents to FIPPA
Bill 194 also includes amendments to FIPPA which would modernize the role of the Information and Privacy Commissioner and enable ServiceOntario to provide enhanced digital services to individuals who “opt in” and provide consent. The intent behind these changes is to improve online customer service delivery through the creation of a “tell us once” feature so users will not have to repeatedly enter their information when accessing digital services.
The amendments to FIPPA would only apply to organizations already prescribed by FIPPA such as the Government of Ontario, agencies and commissions. The focus of these amendments will be to create privacy breach notifications, privacy impact assessments, and whistleblower protections.
Next Steps:
Bill 194 has only passed First Reading. The next steps for the bill will be passing second reading following debate in the legislature followed by referral to a standing committee, where stakeholders will have the opportunity to provide written or in-person depositions to provide feedback on the bill. The government has also released a consultation document on the Ontario Regulatory Registry seeking stakeholder feedback by June 11, 2024.
After the passage of the bill, the government has signalled an intention to create regulations in 2024-25 which focus on the sectors listed above.
The government is also contemplating creating regulations for municipalities, but will do so at a later date.