CCLA looks forward to a deep dive into the legislation tabled today, a Bill lengthily titled “An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts.”
We’re hoping for significant improvements to the previous attempt, tabled in the last Parliament as Bill C-11. That bill, pitched as a way to strengthen privacy protections against private sector incursions and an internet business model increasingly dependent on unconstrained flows of personal information, largely failed to live up to that goal. Indeed, CCLA shared the opinion of then Privacy Commissioner of Canada Daniel Therrien that the bill in fact weakened both privacy protections and accountability for those organisations hungry for our information. At the time, I wrote that C-11 was “inadequate to address the reality that 21st century business models cast us as not just consumers but as the consumed” and further, that it failed to address those loopholes in the law that left recent scandals involving personal information—the Facebook/Cambridge Analytica case attempting to undermine democratic elections, the provision of Clearview AI facial recognition tools to police across the country, the non-consensual use of facial analytics by Cadillac Fairview—have been prevented–unpunished and unpunishable.
So, what are some of the things we watching and hoping for?
1. Recognition of privacy as a human right, not simply an individual interest to be balanced against competing business interests. This one is unlikely but profoundly important.
2. Better enforcement powers for the Office of the Privacy Commissioner of Canada, that include the ability to issue administrative penalties for consent violations which were left out of the regime proposed in Bill C-11.
3. Narrowing of the “business activities” justification for collecting and using data that, in C-11, gutted the concept of consent without commensurate safeguards around what a “reasonable business activity” might be.
4. Explicit principled protection for sensitive forms of information including biometrics (think facial recognition) and genetic information, with a prohibition on any form of non-consensual collection.
5. The right not just to be told (i.e. transparency) when automated decisions are being made about us by AI and how those decisions are being made, but the right to recourse when the AI gets things wrong, including for discriminatory decisions.
6. “No go” zones for behavioural manipulation based on granular profiling and targeting.
7. Explicit guidance around the de-identification/anonymization/pseudonymization of personal information and a framework to bring all of these categories within the scope of the law with appropriate protections.
8. Special privacy protection for children.
9. Explicit coverage of Canadian political parties, as CCLA and many others have called for, including, most recently, Elections Canada.
This is the short list. Stay tuned.
