Ottawa is moving to modernize Canada's privacy laws with the introduction of Bill C-36, the Protecting Privacy and Consumer Data Act. The proposed legislation, tabled by Artificial Intelligence Minister Evan Solomon, would grant Canadians the fundamental right to request that companies delete their personal data. This significant update seeks to address the evolving digital landscape, which current laws, enacted before the widespread use of AI and the internet as we know it, have failed to keep pace with.
The bill aims to provide Canadians with more control over their digital footprint, allowing them to request the removal of their information, including AI-generated deepfakes that use their likeness. While the right to deletion is a key provision, there are exceptions where companies may deny such requests, such as when data is needed for fraud prevention, potential litigation, or if it can be anonymized. The government has indicated that the new rules will apply to all companies operating in Canada, including foreign entities.
Bill C-36 also introduces enhanced protections for children's data, classifying it as sensitive and requiring a higher standard of care from organizations. Furthermore, the legislation proposes greater transparency in how companies use artificial intelligence and automated decision-making processes, particularly for significant decisions affecting consumers, like credit scoring or mortgage approvals. Enforcement will be managed by a new Digital Safety and Data Protection Commission of Canada, which will have the power to impose substantial penalties, up to $25 million or three percent of global revenue, for non-compliance. This initiative is part of a broader strategy to build trust in the digital economy and ensure Canadians' privacy rights are robustly protected.
