OPC launches consultation on privacy and AI
The Office of the Privacy Commissioner of Canada (OPC) today launched a consultation paper soliciting comments on its proposals for strengthening private sector privacy law to address risks associated with the use of artificial intelligence (AI).
The paper sets out a number of recommendations to Government and Parliament to ensure appropriate regulation of AI, namely:
- Incorporate a definition of AI within the law that would serve to clarify which legal rules would apply only to it, while other rules would apply to all processing, including AI.
- Adopt a rights-based approach in the law, whereby data protection principles are implemented as a means to protect a broader right to privacy—recognized as a fundamental human right and as foundational to the exercise of other human rights.
- Create a right in the law to object to automated decision-making and not to be subject to decisions based solely on automated processing, subject to certain exceptions.
- Provide individuals with a right to explanation and increased transparency when they interact with, or are subject to, automated processing.
- Require the application of Privacy by Design and Human Rights by Design in all phases of processing, including data collection.
- Make compliance with purpose specification and data minimization principles in the AI context both realistic and effective.
- Include in the law alternative grounds for processing and solutions to protect privacy when obtaining meaningful consent is not practicable.
- Establish rules that allow for flexibility in using information that has been rendered non-identifiable, while ensuring there are enhanced measures to protect against re-identification.
- Require organizations to ensure data and algorithmic traceability, including in relation to datasets, processes and decisions made during the AI system lifecycle.
- Mandate demonstrable accountability for the development and implementation of AI processing.
- Empower the OPC to issue binding orders and financial penalties to organizations for non-compliance with the law.
The deadline for stakeholder feedback is Friday, March 13, 2020. Written feedback can be sent to OPC-CPVPconsult1@priv.gc.ca.