There are three proposed acts under the Bill C-27 umbrella: the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act (PIDPTA), and the Artificial Intelligence and Data Act (AIDA). In response to a motion made by the NDP, the Speaker ruled on 28 November 2022 that parts 1 and 2 of the Bill would be voted on together, while part 3 will be voted on separately. While all three parts are broadly related by the theme of the use and protection of personal information (defined by the CPPA), there aren’t enough cross-references between parts 1 and 2 and part 3 for them to be voted on together.
CPPA would replace the 20-year-old Personal Information Protection and Electronic Document Act (PIPEDA), which will now exclusively oversee electronic documents. The fines for non-compliance in CPPA are higher, the legal claims for privacy breaches are newer, provisions around data collection are more fine-tuned, and the Privacy Commissioner of Canada is given new order-making powers, such as ordering companies to stop collecting and using personal information.
The Tribunal established by PIDPTA would act like a superior court of record. The Tribunal would enforce CPPA, review the penalties imposed by the Privacy Commissioner of Canada, and provide individuals and organizations reviews of the Commissioner’s decisions. The Commissioner and Tribunal can also make findings on whether or not individuals have been affected by a contravention of the Act.
Finally, AIDA is the first act of its kind in Canada to comprehensively regulate international and interprovincial trade and commerce AI systems. It lays out key requirements such as the assessments of the system’s ability to cause a “high-impact” and to develop risk mitigation plans. AIDA would apply to individuals, trusts, partnerships, unincorporated associations and legal entities that develop or manage AI systems.
Moreover, AIDA lays the ground for the Minister of Innovation, Science and Industry to order the production of records, audits, or to cease “high-impact” AI systems. Monetary penalties are also written into the Bill and they are imposed by the Commissioner. The penalties would come into effect when data is unlawfully obtained in AI development, when the deployment of AI causes harm, or when fraudulent intent triggers financial loss.