Using Data Privacy to Introduce AI Regulation: The Canadian Bet
As with all other key aspects of the economy, the global health crisis we are going through is having a deep impact on AI developments in organizations. In an environment compatible with remote work, COVID-19 acts as a catalyst for reinforced data usage: many companies need to develop a strong data-supported understanding of the new normal — and react accordingly. Yet, this shouldn’t overshadow other structuring trends happening in the background, starting with the emergence of a new regulatory framework which will deeply reshape how AI is scaled.
This blog post is the second of a series (check out the first one here) focusing on these directives, regulations, and guidelines — which are on the verge of being enforced — and their key learnings for AI and analytics leads. Today, we are zooming in on the recently introduced Bill C-11, also known as the Canadian Federal Data Privacy and AI Regulation bill. Bill C-11 largely reflects the recommendations of the national Data Privacy Regulator (OPC*) and sets a precedent in the government’s ambition to better manage risks linked to AI. The bill is not law yet, it still needs to proceed through committee review and probably industry consultation throughout the year. Please note that in this blog post, we will not be covering Quebec’s Bill-64 which primarily focuses on replicating the already active European Data Privacy regulation (GDPR).
*OPC: the Office of the Privacy Commissioner (”Commissariat à la protection de la vie privée au Canada”)is the administrative authority responsible for overseeing the compliance of the two federal privacy laws. One for the public sector, thePrivacy Act, which covers the personal information-handling practices of federal government departments and agencies, and one for the private sector, thePersonal Information Protection and Electronic Documents Act (PIPEDA).
The recommendations released by the OPC in November 2020 are the result of a two-year long process driven by the conviction of the OPC that, while AI can drive significant benefits, it also presents fundamental challenges to data privacy principles. One of the outcomes is the decision to revisit Canada’s main data privacy law, known as PIPEDA (Personal Information Protection and Electronic Documents Act), which defines dos and don’ts on the consensual collection, processing, and analysis of personal information for commercial purposes.
Why? As part of their work, the OPC identified that the current data privacy regulation does not satisfactorily apply to AI systems in the private sector. Among key concerns is the very nature of AI systems, or (personal) data intensive systems, can easily contradict with fundamental data principles alike minimization. Similarly to other data regulators around the world, the OPC also expresses concerns on the capacity for AI to drive decisions which can deeply affect citizens, raising privacy risks, unlawful bias, and discrimination.
How? To confirm the initial PIPEDA reform proposals, the OPC initiated a public consultation in January 2020 to collect feedback from both field experts and civil society on how to address AI challenges with regulation. After 86 submissions, two in-person consultations, and a policy report, the OPC published key recommendations on Nov. 13, 2020 for regulating AI systems (details to follow below).
What is the impact? The recommendations of the OPC were later used to support the introduction of the Canadian privacy law reform bill in Parliament, also known as the Bill C-11. This upcoming law enacts the OPC recommendation through the Consumer Privacy Protection Act (CPPA) and the Personal Information and Data Protection Tribunal Act. They both create new regulatory tools to address compliance, remedies for non-compliance, and a tribunal to address appeals to these remedies.
