Bill C-27, the Digital Charter Implementation Act Overview
In June 2022, the Canadian government introduced Bill C-27, the Digital Charter Implementation Act 2022. Since the Bill’s introduction, Artificial Intelligence (AI) has risen to the top of headlines, political agendas, and dinner table conversations. The spike in interest in AI can be accredited to the launch of its most prolific chatbot, Chat GPT. Meanwhile, Bill C-27 has passed both readings in the House of Commons and as of 24 April 2023, the Bill is awaiting discussion in the Standing Committee on Industry and Technology (INDU) Let’s take a look at how this piece of legislation intends to respond to the drastically changing digital world.
THE OBJECTIVES OF EACH ACT AS OUTLINED IN BILL C-27
There are three proposed acts under the Bill C-27 umbrella: the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act (PIDPTA), and the Artificial Intelligence and Data Act (AIDA). In response to a motion made by the NDP, the Speaker ruled on 28 November 2022 that parts 1 and 2 of the Bill would be voted on together, while part 3 will be voted on separately. While all three parts are broadly related by the theme of the use and protection of personal information (defined by the CPPA), there aren’t enough cross-references between parts 1 and 2 and part 3 for them to be voted on together.
CPPA would replace the 20-year-old Personal Information Protection and Electronic Document Act (PIPEDA), which will now exclusively oversee electronic documents. The fines for non-compliance in CPPA are higher, the legal claims for privacy breaches are newer, provisions around data collection are more fine-tuned, and the Privacy Commissioner of Canada is given new order-making powers, such as ordering companies to stop collecting and using personal information.
The Tribunal established by PIDPTA would act like a superior court of record. The Tribunal would enforce CPPA, review the penalties imposed by the Privacy Commissioner of Canada, and provide individuals and organizations reviews of the Commissioner’s decisions. The Commissioner and Tribunal can also make findings on whether or not individuals have been affected by a contravention of the Act.
Finally, AIDA is the first act of its kind in Canada to comprehensively regulate international and interprovincial trade and commerce AI systems. It lays out key requirements such as the assessments of the system’s ability to cause a “high-impact” and to develop risk mitigation plans. AIDA would apply to individuals, trusts, partnerships, unincorporated associations and legal entities that develop or manage AI systems.
Moreover, AIDA lays the ground for the Minister of Innovation, Science and Industry to order the production of records, audits, or to cease “high-impact” AI systems. Monetary penalties are also written into the Bill and they are imposed by the Commissioner. The penalties would come into effect when data is unlawfully obtained in AI development, when the deployment of AI causes harm, or when fraudulent intent triggers financial loss.
WHEN WILL THE BILL COME INTO FORCE?
The Bill, excluding sections 2, 35, 36 and 39, would come into force on a day fixed by the Governor in Council. The excluded sections deal with the disclosure of personal information without an individual’s knowledge or consent, such as for the purpose of research. For a better idea of when the Bill will become law, the Minister has previously indicated that 18 months after the Bill receives Royal Assent would be sufficient enough time for the industry to prepare and for regulations to come into force.
CONCLUSION
While Bill C-27 updates out-dated legislation and attempts to regulate AI development, it lacks fine-tuning. Experts highlight that many key definitions, such as “high-impact” and “material harm” are left unaccounted for. Additionally, the Bill will have to consider extraterritorial application if parts of global AI systems are developed in Canada. CPPA has also been criticized for its lack of privacy safeguards because it relies on the de-identification model when using personal information. To no surprise, the concept of “de-identification” in the Bill is also poorly defined. On the legislative side, the NDP has also signalled that they wish to see a Special Joint Committee of Parliament, which would consider the ongoing regulation of AI. These concerns will likely be fleshed out in the INDU committee when the house resumes sitting on September 18.
