Canada’s Bill C-36 tackles AI privacy. Is it enough?
Canada’s new privacy bill promises stronger protections for children, but experts say it still misses risks in AI world. Vancouver, Canada: In an era of
Canada’s new privacy bill promises stronger protections for children, but experts say it still misses risks in AI world. Vancouver, Canada: In an era of artificial intelligence, deepfakes and data-driven decision-making, Canada is moving to revise its privacy laws through Bill C-36, the Protecting Privacy and Consumer Data Act. Announced in June, Bill C-36 is Canada’s first major overhaul of private-sector privacy legislation in more than 25 years. The bill explicitly recognises privacy as a fundamental right and also aims to give children’s personal information stronger protections, enhance deletion rights and require greater transparency where automated systems make significant decisions about people. The reforms also arrive amid growing scrutiny of AI after incidents such as British Columbia’s Tumbler Ridge shooting in February raised greater questions about AI chatbots, vulnerable users and the responsibilities of technology companies. The 18-year-old shooting suspect allegedly used ChatGPT before the attack. The victims’ families are now suing OpenAI, stating the company’s AI safety team identified violent prompts but did not alert law enforcement. This week, the province of British Columbia also announced it is “preparing legal action” against the AI company. Meanwhile, Canada’s federal government plans to modernise private-sector consumer privacy rules via Bill C-36. Evan Solomon, Canada’s minister of AI and digital innovation, told Al Jazeera that the government’s responsibility is “to protect Canadians online and to ensure Canadians can benefit from artificial intelligence and emerging technologies. These goals are not mutually exclusive”. “Bill C-36 establishes a framework for the responsible use of de-identified data. It includes safeguards designed to reduce the risk of re-identifying individuals while supporting important public-interest activities, including research, accountability and innovation.” But as AI systems become more capable of predicting, profiling and influencing people, experts say the challenge is no longer just what data companies collect — it is what AI can infer from users. The question is whether privacy legislation can keep pace with technology designed to predict, profile and influence human behaviour. Inferred information The biggest issue is that AI is changing where privacy harms occur, according to Ignacio Cofone, professor of law and regulation of AI at the University of Oxford. “Older privacy law assumes the danger is in what a company collects from you. The danger now is in what a company infers about you from data you never handed over, and in what it does with that AI inference.” In other words, today’s AI systems don’t necessarily need someone to disclose sensitive information voluntarily.
The BriefWire