Artificial Intelligence (“AI”) is this year’s new buzzword. Any substantial scrolling on social media reveals threads by entrepreneur influencers on how to use ChatGPT to save time and make money. However, not all users are engaging with AI appropriately. Whether it is a lawyer relying on fake cases generated by ChatGPT, students using ChatGPT to write essays, or a music producer using celebrity voices without the artists’ consent, there are clearly risks as AI capabilities advance. In response to concerns about AI being used for harmful (and illegal) purposes such as fraud, intellectual property infringement, and invading privacy, governments across the world, including Canada, have begun the process of implementing laws to limit the risks associated with AI. This article will examine Canada’s approach to AI, provide selected highlights of Bill C-27, a law proposed to regulate AI in Canada’s private sector, and outline how businesses should approach using AI in preparation for Canada’s potential AI legislation.
Canada’s Approach to AI
In 2017, Canada was the first country in the world to create a national strategy for AI,1 and in May 2019, the government of Canada released its Digital Charter.2 The Digital Charter is a set of principles that provides guidance for how Canadian organizations should responsibly and ethically utilize technology, such as AI. While the Digital Charter is not enforceable law, the Digital Charter signals the government’s commitment to privacy protection as technology advances globally. The principles outlined in the Digital Charter are:
(1) Universal Access
(2) Safety and Security
(3) Control and Consent
(4) Transparency, Portability, and Interoperability
(5) Open and Modern Digital Government
(6) A Level Playing Field
(7) Data and Digital for Good
(8) Strong Democracy
(9) Free from Hate and Violent Extremism
(10) Strong Enforcement and Real Accountability
In March 2020, the Office of the Privacy Commissioner of Canada sought input for the appropriate regulation of AI,3 and later published a proposed regulatory framework.4 The proposal culminated in Bill C-27, aka the Digital Charter Implementation Act, 2022, which was introduced into the House of Commons on June 16, 2022.5
Bill C-27
Bill C-27 introduces three proposed acts, one of which is the Artificial Intelligence and Data Act (the “AIDA”). AIDA would create new rules around the usage of AI in Canada’s private sector, including creating standards for the use of “high-impact AI systems” and creating significant administrative and criminal penalties for contraventions of AIDA.
High-Impact Systems
The government has stated that “high-impact systems” will be defined in future regulations, but various factors are considered when determining if a system is “high-impact”. Some factors include: (i) the risks and severity of risks to health, safety, and/or human rights, (ii) the scale of use, and (iii) whether it is possible to opt out of the system.6
If a particular AI system is classified as “high-impact”, AIDA would require the individual/company controlling the system to:
- Establish measures to identify, assess, and mitigate the risks that could result from the use of the system7;
- Establish measures to monitor compliance and the effectiveness of the aforementioned mitigation measures8; and,
- Publish a publicly available description of the system, including (i) how the system is intended to be used, (ii) the types of content, decisions, recommendations, or predictions the system is intended to generate, and (iii) the aforementioned mitigation measures.9
Oversight + Penalties
The Minister of Innovation, Science, and Industry (the “Minister”) would be responsible for administering and enforcing AIDA. The AIDA would establish certain powers for the Minister, including the powers to:
- Order the production of records10;
- Conduct an audit (internally or through a third party) with respect to a possible contravention of AIDA11;
- Require a person responsible for a high-impact system to cease using it or making it available if there are reasonable grounds to believe that the system gives rise to a serious risk of imminent harm12; and,
- Order a person to publish information about the person’s system, the measures/orders taken against the system, or the harm the system has caused.13
Violations of AIDA could result in administrative or criminal penalties. Administrative penalties for violating AIDA can reach up to $50,000 for individuals, and up to $10,000,000 plus 3% of the gross global revenues for businesses.14 Criminal penalties can reach up to five years imprisonment for individuals and up to $25,000,000 plus 5% of the gross global revenues for businesses.15
To date, the second reading of Bill C-27 has been completed in the House of Commons, but the committee stage, the report stage, the House of Commons’ third reading, and the Senate’s three readings remain before the Bill becomes law. The government of Canada has stated that AIDA may not come into force until at least 2025.16 Nevertheless, the government of Canada’s commitment to developing policies in the context of AI has been encouraging to see, even if Bill C-27 requires revisions before it gets passed.
We are closely monitoring the progress of Bill C-27. For businesses utilizing certain forms of AI, we strongly recommend tracking the progress of Bill C-27 and engaging with counsel to ensure that your business is adequately prepared once Bill C-27 becomes law.
For businesses that do not currently utilize AI, Bill C-27 provides a reminder that businesses engaging with any form of technology should continually review and minimize the risks associated with their chosen technology, be transparent about the use of technology, and attempt to have technology be as least invasive as possible.
Since AI touches on various aspects of business such as privacy, intellectual property, and corporate matters, having competent legal support can be the difference between integrating AI responsibly or engaging in practices that may violate Bill C-27 once/if it becomes law.
If you would like to talk about your business’ AI practices, please don’t hesitate to reach out to zack@gmelawyers.com or jack@gmelawyers.com.
1 Innovation, Science and Economic Development Canada, The Artificial Intelligence and Data Act (AIDA) – Companion Document, March 13, 2023.
2 Innovation, Science and Economic Development Canada, Canada’s Digital Charter, March 13, 2023.
3 Office of the Privacy Commissioner of Canada, Consultation on the OPC’s Proposals for ensuring appropriate regulation of AI, March 13, 2020.
4 Office of the Privacy Commissioner of Canada, A Regulatory Framework for AI: Recommendations for PIPEDA Reform, November 2020.
5 https://www.parl.ca/legisinfo/en/bill/44-1/C-27
6 Government of Canada, The Artificial Intelligence and Data Act (AIDA) – Companion Document, March 13, 2023.
7 Bill C-27, at s39 (8).
8 Bill C-27, at s39 (9).
9 Bill C-27, at s39 (11).
10 Bill C-27, at s39 (13).
11 Bill C-27, at s39 (15)(1).
12 Bill C-27, at s39 (17)(1).
13 Bill C-27, at s39 (18)(1).
14 Bill C-27, at s39 (30)(3).
15 Bill C-27, at s39 (40).
16 Innovation, Science and Economic Development Canada, The Artificial Intelligence and Data Act (AIDA) – Companion Document, March 13, 2023.
Photo from Hemdale Film Corporation
