Bill C-27 – Canada’s proposed Artificial Intelligence and Data Act

Kevin Landry, Charlotte Henderson, and James Pinchak

The governance of Artificial Intelligence (AI) is entering a new era since the Canadian Government first announced a digital charter in 2019 as part of a larger-scale overhaul of Canada’s data privacy landscape (see our article about the announcement here). Recently, the White House announced a Blueprint for an AI Bill of Rights, and on June 16, 2022, Bill C-27, the Digital Charter Implementation Act, 2022 (“C-27“) was introduced to parliament here in Canada.

Bill C-27 contains three parts. The first will replace Part 1 of the Personal Information Protection and Electronic Documents Act with the Consumer Privacy Protection Act (“CPPA“), making CPPA the governing statute for data privacy at the federal level. The second part will establish a tribunal specializing in privacy and data protection. Part three of C-27, and the focus of this article, purports to enact the Artificial Intelligence and Data Act (“AIDA“), which would be Canada’s first AI legislation and one of few that has been enacted globally.

Purpose

The purpose of  the AIDA is to establish common requirements throughout Canada with respect to the design, development, and use of Artificial Intelligence in the private sector and to prohibit conduct in relation to AI systems that could result in serious harm to individuals or their interests. The AIDA will operate in conjunction with the CPPA and Canada’s Anti-Spam Legislation to protect consumer interests in the digital space.

Requirements

Under the AIDA, any “person” (i.e. any legal entity, except certain government institutions) that carries out specified activities must establish various procedural and security measures with respect to the use and processing of anonymized data in an Artificial Intelligence system. This includes risk assessment and mitigation, public disclosure, and record-keeping requirements, including a requirement to keep records describing the measures established.

The specified activities to which AIDA applies are called “regulated activities”. This includes various activities carried out during international or interprovincial trade and commerce such as:

• Processing or making available for use any data related to human activities to develop an Artificial Intelligence system; or
• Designing, developing, or making an Artificial Intelligence system available for use or managing its operations.

Currently, the AIDA is only expected to apply to persons that engage in inter-provincial or international commerce. In other words, any person that exists in and operates solely out of a single province will not be subject to AIDA. This creates considerable room for provincial governments to begin implementing their own Artificial Intelligence-focused legislation.

AIDA also imposes additional, more stringent requirements on persons that are responsible for “high-impact” Artificial Intelligence systems. While the qualification criteria for high-impact systems will be established in yet-to-be drafted regulations, the persons responsible for these systems will have to take additional actions such as:

• Establishing measures to identify, assess, and mitigate risks associated with the use of the Artificial Intelligence system as well as procedures to monitor compliance with such measures; and
• Publishing a description of the system on a public website which includes, among others, an explanation of the intended use of the Artificial Intelligence system and the mitigation measures established in respect of it.

Ministerial Orders

The AIDA grants the Minister many investigatory powers including the ability to:

• Compel disclosure of records in which a person is required to maintain pursuant to the AIDA;
• Compel a person to conduct an audit to review its compliance and implement measures to address any issues flagged during the audit;
• Compel a person who is responsible for a high-impact system to cease use of it; and
• Compel a person to make information with respect to the Requirements and/or an audit publicly available.

Administrative Monetary Penalties and Offences

As written, the AIDA creates a variety of Administrative Monetary Penalties. In some cases, these penalties can rise to the greater of $10,000,000 or 3% of the person’s gross global revenues in its previous financial year, or, in the case of an individual, a fine at the discretion of the court. AIDA also creates criminal offences related to:

• The possession or use of Personal Information knowing or believing that such information was obtained as a result of the commission of an offence;
• Making an Artificial Intelligence system available for use knowing that it is likely to cause serious harm to an individual or their property and the use of the system actually causes such harm; and
• Making an Artificial Intelligence system available for use with the intent to defraud the public and to cause substantial economic loss to an individual and it actually causes such loss.

This update is intended for general information only. If you have questions about the above, please contact the authors.

Click here to subscribe to Stewart McKelvey Thought Leadership.