How Should AI be Regulated in Canada? Speak now, or forever hold your peace!

How Should AI be Regulated in Canada? Speak now, or forever hold your peace!

Many organizations recognize the potential benefits that artificial intelligence (“AI”) can bring to their business.  However, regulators as well as privacy and human rights activists are pushing for laws to govern this controversial technology. Recent developments in Canada and worldwide suggest that regulations may be developed sooner rather than later.

For example, in October 2018, the 40th International Conference of Data Protection & Privacy Commissioners (in which the OPC participated) endorsed a “Declaration on Ethics and Data Protection in Artificial Intelligence”, which sets out “guiding principles” to preserve human rights in the development of artificial intelligence. In addition, in May 2019, the Organisation for Economic Co-operation and Development (OECD) adopted the first set of intergovernmental policy guidelines on artificial intelligence, which have now been adopted by 42 countries including Canada.

Last month the Office of the Privacy Commissioner of Canada (the “OPC”) took another step forward, by launching its “Consultation on the OPC’s Proposals for ensuring appropriate regulation of artificial intelligence” (the “Consultation”).  Accordingly, organizations that have an interest in shaping AI regulations now have the opportunity to be heard.

The consultation fits within the OPC’s larger policy analysis of potential legislative reforms to both the Personal Information Protection and Electronic Documents Act and the Privacy Act.  In this context, the OPC has identified AI as being worthy of particular attention due to its potential for rapid adoption, and the nature of AI which often involves processing large amounts of personal information in a manner that can have privacy and human rights implications. The OPC, amongst others, has also recognized that the current framework for privacy and data protection in Canada gives rise to some challenges associated with AI, including the apparent inconsistencies between the practical realities of AI and certain fundamental principles of privacy laws such as data minimization, purpose specification, informed consent, and openness.

Accordingly, in the Consultation, the OPC describes 11 “Proposals for Consideration” (the “Proposals”), as follows:

Proposal 1:  Incorporate a definition of AI within the law that would serve to clarify which legal rules would apply only to it, while other rules would apply to all processing, including AI

Proposal 2:  Adopt a rights-based approach in the law, whereby data protection principles are implemented as a means to protect a broader right to privacy—recognized as a fundamental human right and as foundational to the exercise of other human rights

Proposal 3:  Create a right in the law to object to automated decision-making and not to be subject to decisions based solely on automated processing, subject to certain exceptions

Proposal 4:  Provide individuals with a right to explanation and increased transparency when they interact with, or are subject to, automated processing

Proposal 5:  Require the application of Privacy by Design and Human Rights by Design in all phases of processing, including data collection

Proposal 6:  Make compliance with purpose specification and data minimization principles in the AI context both realistic and effective

Proposal 7:  Include in the law alternative grounds for processing and solutions to protect privacy when obtaining meaningful consent is not practicable

Proposal 8:  Establish rules that allow for flexibility in using information that has been rendered non-identifiable, while ensuring there are enhanced measures to protect against re-identification

Proposal 9:  Require organizations to ensure data and algorithmic traceability, including in relation to datasets, processes and decisions made during the AI system lifecycle

Proposal 10:  Mandate demonstrable accountability for the development and implementation of AI processing

Proposal 11:  Empower the OPC to issue binding orders and financial penalties to organizations for non-compliance with the law

The Consultation includes further discussion of each of these Proposals, often with reference to how other jurisdictions have approached AI, as well as discussion questions for stakeholders’ consideration and input.

The OPC has indicated that it is consulting with experts in the field, in order to validate its understanding of how privacy principles should apply to AI, and assess whether its Proposals would be consistent with responsible development and deployment of AI systems. Accordingly, organizations that are in the process of developing or implementing AI technology would be well-advised to review the Consultation here and consider making submissions to the OPC.

The government relations team at TRC-Sadovod Vantage is available to support your organization’s efforts to draft and submit comments, but can also provide advice and assistance in arranging meetings with elected officials and decision-makers. With a federal minority Parliament, it is imperative to gain broad, multi-party support by effectively briefing key elected officials and their staff so they understand your  organization’s perspective before they receive the OPC’s report on the Consultation.

The deadline for submissions to the OPC is March 13, 2020.

by Lyndsay A. Wasser, CIPP/C, Co-Chair Privacy and Data Protection, Co-Chair Cybersecurity

A Cautionary Note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© TRC-Sadovod LLP 2020