Bill C-27, “Digital Charter Implementation Act, 2022”, was introduced yesterday that would

• enact the “Consumer Privacy Protection Act” directed to the use of personal information, replacing portions of PIPEDA.
• establish a tribunal for hearing appeals of decision made by the Privacy Commissioner and impose penalties.
• enact the “Artificial Intelligence and Data Act” regulating the use of artificial intelligent systems, particularly those with a ‘high-impact’.

The legislation (link to text) was introduced after a previous iteration, Bill C-27 died on the order paper last fall.

An article, “Canada introduces legislation to regulate artificial intelligence systems“, I wrote on the AI aspects expands on this further, but the Artificial Intelligence and Data Act broadly defines AI systems to include those that use “a genetic algorithm, a neural network, machine learning or another technique”. Significant monitoring and record keeping apply for ‘high-impact’ systems, although the definition of such systems will only follow in the accompanying regulations.

Any person responsible for an artificial intelligence system (with ‘high-impact’ or not, that processes or makes available anonymized data (including for designing and developing) an artificial intelligence system will be required to establish measures regarding the manner in which the data is anonymized and the use or management of that data. The details of the requirements for those measures will follow in subsequent regulations. Each responsible person will also be required to keep records, available for inspection, on those measures.