January 28, 2020 - Private Sector

OPC launches consultation on privacy and AI

The Office of the Privacy Commissioner of Canada (OPC) today launched a consultation paper soliciting comments on its proposals for strengthening private sector privacy law to address risks associated with the use of artificial intelligence (AI).

The paper sets out a number of recommendations to Government and Parliament to ensure appropriate regulation of AI, namely:

  1. Incorporate a definition of AI within the law that would serve to clarify which legal rules would apply only to it, while other rules would apply to all processing, including AI.
  2. Adopt a rights-based approach in the law, whereby data protection principles are implemented as a means to protect a broader right to privacy—recognized as a fundamental human right and as foundational to the exercise of other human rights.
  3. Create a right in the law to object to automated decision-making and not to be subject to decisions based solely on automated processing, subject to certain exceptions.
  4. Provide individuals with a right to explanation and increased transparency when they interact with, or are subject to, automated processing.
  5. Require the application of Privacy by Design and Human Rights by Design in all phases of processing, including data collection.
  6. Make compliance with purpose specification and data minimization principles in the AI context both realistic and effective.
  7. Include in the law alternative grounds for processing and solutions to protect privacy when obtaining meaningful consent is not practicable.
  8. Establish rules that allow for flexibility in using information that has been rendered non-identifiable, while ensuring there are enhanced measures to protect against re-identification.
  9. Require organizations to ensure data and algorithmic traceability, including in relation to datasets, processes and decisions made during the AI system lifecycle.
  10. Mandate demonstrable accountability for the development and implementation of AI processing.
  11. Empower the OPC to issue binding orders and financial penalties to organizations for non-compliance with the law.

The deadline for stakeholder feedback is Friday, March 13, 2020. Written feedback can be sent to OPC-CPVPconsult1@priv.gc.ca.