Canada remains at the ‘wrong end of the data vacuum,’ says Sen. Colin Deacon as Liberals preview AI, privacy legislation reboot
As the new artificial intelligence minister signals his government’s plans to reboot its previous attempt to update the country’s privacy regime and regulate AI, CSG Senator Colin Deacon says Canada remains at the “wrong end of the data vacuum” as the increasingly ubiquitous and poorly regulated technology continues to hoover up massive amounts of private information.
On Sept. 16, following the Liberals’ cabinet meeting, AI and Digital Innovation Minister Evan Solomon (Toronto Centre, Ont.) hinted that the government is planning to introduce privacy and data legislation sometime this fall after the Liberal government’s previous two attempts died on the Order Paper.
The Liberals’ most recent attempt, Bill C-27, which was first introduced in 2022, aimed to repeal parts of the Personal Information Protection and Electronic Documents Act (PIPEDA), and to establish the Consumer Privacy Protection Act (CPPA) alongside the Artificial Intelligence and Data Act (AIDA). The Liberals’ first attempt to amend PIPEDA came in 2020 through Bill C-11, the Digital Charter Implementation Act, which died on the Order Paper following Parliament’s dissolution ahead of the 2021 election.
Speaking with reporters, Solomon clarified that the reintroduced bill would not be a complete revival of Bill C-27, “but part of it,” particularly the first two parts of the previously proposed legislation concerning privacy and data protections. He said the hope is to table something addressing both aspects by “late fall.”
But regarding legislation dealing with AI—included as part 3 of Bill C-27—Solomon did not provide a clear timeline for its arrival, nor whether it would be included in a separate bill. He noted, though, plans to roll out AI policies “specifically around … the adoption side,” as well as “on the sovereign cloud and sovereign data side.”
Deacon (Nova Scotia), who sponsored both of the previous two bills in the Senate, told The Hill Times that despite the lack of a concrete timeline, he hopes that once the signalled legislation is introduced, all parties will work with urgency to pass the bill. He also said he hopes that the current government has rid itself of the “political indifference” toward the issue that thwarted previous committee studies.
“I was carefully following what was happening with C-27 in the House for the year and a half it was waiting to get to committee,” Deacon said. “It was incredibly frustrating.”
Bill C-27 arrived at the House Industry and Technology Committee for study in September 2023, but Deacon said that despite agreement amongst witnesses and experts on the needed fixes and amendments to the legislation, the following year of meetings examining the bill descended into unproductive “bickering and gamesmanship.”
“I don’t know if AIDA would have made it through because that was the most challenging part, but if there had been any political willingness and less bickering there’s no question PIPEDA would have been successful,” Deacon explained. “There were solutions on the table that made sense, but they just ignored them entirely last fall.”
Despite meeting 40 times between September 2023 and May 2024, the committee only sat for three meetings in September 2024, and scheduled no further meetings to study the legislation before Parliament was prorogued last March.
Deacon said that the lack of prioritization for the bill during the last Parliament and the government’s decision to withhold its own written amendments until after the House committee completed witness testimony clearly demonstrated the government’s lack of urgency.
At the outset of the House study in September 2023, now-Finance Minister François-Philippe Champagne (Saint-Maurice–Champlain, Que.), who at the time was minister of innovation, science, and industry, appeared to provide a verbal summary of the suggested amendments, but said written details would not be provided until after the legislation reached the clause-by-clause review stage at the committee.
Champagne told the committee those amendments would have included the recognition of privacy as a fundamental right; the obligation to protect children’s personal data online; would strengthen and clarify the role of the proposed artificial intelligence and data commissioner, as well as enable it to share information and co-operate with the federal privacy commissioner and the Competition Bureau; and define specific obligations for “high-impact” generative systems, as well as general purpose ones like ChatGPT.
In response, civil liberties advocates described the appearance as a “mixed bag” as the proposed amendments were encouraging, but were undercut by a lack of clarity on the process.
The day after Champagne’s appearance, the Canadian Civil Liberties Association (CCLA), International Civil Liberties Monitoring Group (ICLMG), and more than 40 other Canadian civil liberties groups, experts, and academics issued an open letter to the minister highlighting their main concerns with the proposed draft of AIDA. Specifically, the signatories express concern that “shoehorning” AI regulation into Bill C-27 would hinder proper examination of AIDA and divert focus from the bill’s privacy provisions. They also proposed key changes they argued were needed for AIDA, such as recognizing privacy as a fundamental human right; committing to more meaningful consultation with a broader range of stakeholders “beyond industry leaders”; expanding AI regulation to cover both the public and private sectors, including government security agencies; and removing AI regulation from Innovation, Science, and Economic Development Canada’s sole jurisdiction.
At the time, ICLMG told The Hill Times that, despite the amendments proposed by Champagne at the committee, its view was that AIDA needed to be “withdrawn, reworked, and reintroduced” as a separate piece of legislation from C-27.
In an interview with The Hill Times last week, the CCLA’s Tamir Israel said that while civil liberties groups hope to see legislation tabled this fall to address all aspects of reform, their priority is PIPEDA.
Specifically, Israel said the CCLA is hoping to see the exceptions to the previous legislation’s consent requirement curtailed or removed entirely, including the broad latitude it gave to corporations to pursue their interests over the privacy rights of Canadians.
“If there is no need for consent, then there’s no disincentive for using Canadians’ data in a way they’re not comfortable with,” Israel explained. “The primary overarching framework of PIPEDA needs to be updated to reflect that privacy is a fundamental right, not something that needs to be balanced with business objectives.”
Additionally, Israel said that the new legislation needs greater monetary penalties for those in contravention of PIPEDA to incentivize compliance.
“Given the amount of revenue that can be derived from personal information these days, the penalties for misusing it or not having consent need to be on par or you won’t get compliance,” Israel explained. “Right now, there is no incentive to comply, and that’s been a major gap in PIPEDA since it was first adopted.”
While the CCLA has more concerns with the artificial intelligence aspect of C-27—and still believes that whatever new legislation is introduced should be tabled separately from the PIPEDA and CPPA components—Israel said one of the major concerns in the previous bill was the exception it provided for the use of AI tools for national security purposes.
“That is just not an effective starting point for AI legislation,” Israel said, noting that the exception covered not just AI tools used by the government, but any tool used in a broadly defined national security context.
Alongside removing that exception, Israel added that he hopes the government will take its lead from the European Union’s AI regime, including the limitations imposed on facial recognition and other forms of biometric data collection in public spaces.
Deacon said that he believes that Canada should “take its time to get it right” on AI regulation, but said updating PIPEDA is of the utmost importance as regulating the collection and use of personal data is already downstream of the technology.
“We’re at the wrong end of the data vacuum, and it’s being used against us as a country,” Deacon said. “The amount of data that is hoovered off us every single second of every day is just astonishing, and we can’t afford to lose control of it.”
The Hill Times
LICENSING
PODCAST
ALERTS
