Canada’s Bill C-36 tackles AI privacy. Is that enough? | | Privacy Policy

Vancouver, Canada: In an era of artificial intelligence, analytics and data-driven decision-making, Canada is preparing to overhaul its privacy laws through Bill C-36, the Protecting Privacy and Consumer Data Act.

Announced in June, Bill C-36 is Canada’s first privacy law reform in more than 25 years. The bill recognizes privacy as a fundamental right and seeks to give children greater protections, expand the right to erasure and ensure that machines make important decisions about people.

Recommended Articles

list of 4 itemsend of series

The changes also come under greater scrutiny of AI after events such as the Tumbler Ridge shooting in British Columbia in February raised questions about AI chatbots, vulnerable users and the role of technology companies.

The 18-year-old victim of the shooting reportedly used ChatGPT prior to the incident. The The victims’ families are now suing OpenAIabout the company’s AI security team detected attacks but did not alert law enforcement. This week, the province of British Columbia also announced that it is “preparing cases” against the AI ​​company.

Currently, the Canadian government is planning to amend private privacy laws through Bill C-36.

Evan Solomon, Canada’s minister of AI and digital technologies, told Al Jazeera that the government’s role is to “protect Canadians online and ensure that Canadians can benefit from artificial intelligence and emerging technologies. These goals are not mutually exclusive”.

“Bill C-36 establishes a framework for the effective use of anonymized data. It includes safeguards to reduce the risk of re-identification and support important public service activities, including research, accountability and innovation.”

But while AI systems can predict, explain and influence people, experts say the problem is no longer what companies collect — it’s what AI can generate from users.

The question is whether privacy laws can accommodate technology designed to predict, profile and influence people’s behavior.

Inferred information

The main issue is that AI is changing where privacy damage occurs, according to Ignacio Cofone, a professor of AI law and regulation at the University of Oxford.

“The old privacy laws assumed that the risk was what a company gets from you. The risk now is what a company takes from you from data you never provided, and what it does with the concept of AI.”

In other words, today’s AI systems do not require anyone to voluntarily disclose information. Shopping patterns, browsing history, content found or online activity can be enough for algorithms to make incredibly accurate predictions about a person’s health, finances or behavior.

“A type trained on (anonymity) can make decisions that can harm a group of people without pointing to a person who might complain,” Cofone told Al Jazeera.

Bill C-36 responds by expanding the definition of personal information to include information that has only been provided and requiring organizations to disclose certain personal information only.

But, as Cofone points out, the real challenge is to ensure that law enforcement targets the bad use of AI rather than just data collection.

“The model can predict your health, your sexuality, or your beauty from things that are unrelated to the predictions, without losing data or breaking routines,” he said.

“This is very important because it allows the law to reach the point where the problem of AI occurs, the perception and the decision, instead of just leaving the collected data.”

Protecting children online

Protecting children’s privacy is one of the themes of Bill C-36’s amendments. The law states that the personal data of anyone under the age of 18 is private and gives young people a strong right to have their personal data deleted.

For Stephany Oliveros, AI trainer and CEO of Just Lyra, an AI talent matching platform, data privacy and consent are all about users.

“It’s one thing to give away my data for cancer research, but it’s another thing if tech companies get my child’s blood type and behavior. Like, why does Facebook need to know this?”

Cofone added that the changes that come with Bill C-36 are helpful but only solve part of the problem.

The bill does two things for children: It considers the child’s information, which gives consent and the protection that the organization should have, and it gives children the right to withdraw. All of these are useful.

But, he said, the main problem lies elsewhere.

“The greater protections people need with children online are age-appropriate and limit what they can do.”

According to Jill Ma, a technology entrepreneur who works in AI products for children, beyond privacy, the next frontier is algorithmic justice.

“Privacy is not just about data management, it’s also about not being misunderstood by policy,” he said. “A child’s digital start shouldn’t be a sign of a lifetime. Our job as (creators) is to teach AI to respect people, not just collect their data.”

For concerned parents like Martin Haucke, a Vancouver-born father of one, the biggest issue is the culture surrounding children’s tolerance for the Internet.

“Physical things are more secure than ever, and the internet is the biggest threat to children’s safety,” he said.

Earlier this year, Ottawa introduced separate legislation challenging restrictions on the use of social networking sites such as TikTok for users under the age of 16. Other governments around the world have also begun to respond in this way. Last year, Australia passed a law restricting access to certain social media sites by children under the age of 16.

“It’s going backwards,” said Haucke, who is also a teacher at the school. All we need are phones at school. To have more time to spend with people.”

Privacy is only one part of the answer

Privacy is only one aspect of controlling AI. Experts say future AI regulations will need to regulate user safety, journalism and public interest.

“As technologies continue to evolve,” Solomon said. “We will continue to engage with researchers, journalists, privacy experts, government agencies and other stakeholders to ensure that Canadian privacy remains effective, relevant and responsive to the expectations of Canadians.”

One example of such problems is the bill’s treatment of anonymous data, an issue that has sparked debate among privacy experts, researchers and the media.

Although the law aims to prevent organizations from reconstructing public information from anonymous sources, experts such as Cofone of Oxford law say that this is based on how organizations and researchers should be allowed to use anonymous data.

“I would separate these two concerns. In terms of journalism, the bill preserves the freedom of journalism, art and writing,” he said. “Investigative journalism is protected, as it was under the old law. The most pressing issue is investigative reporting, which reverses how the bill draws the line between anonymous and anonymous data.”

Oliveros, an AI culture educator who has also collaborated with the United Nations, says that this debate goes beyond the definition of privacy and should end accountability. Restricting access to data would make it harder for journalists and human rights organizations to expose wrongdoing, he said.

“Management cannot rely on the company’s summary,” Oliveros told Al Jazeera. “In order to uncover environmental discrimination, bias or criminal lending, journalists and human rights groups need access to multiple pieces of information line by line. If Bill C-36 seals this data under confidentiality, it inadvertently protects powerful corporations from public accountability. Confidentiality should not be a corporate secret.”

But there can be no easy answers.

“If the definition of a public interest investigator is too loose, the law fails. But if it is too strict, it shuts down independent journalists and non-governmental organizations that work to promote human rights,” said Oliveros.

Although the law focuses on protecting personal information, Eric Wishart, a journalist ethics writer and professor at the University of Hong Kong, says that privacy laws must preserve the ability of journalists to hold those in power accountable and the public’s right to information.

He pointed to the United States-Israel conflict with Iran as one example.

“There was little information that the Pentagon released about the attack on Iran, so the media relied on pictures from Planet Labs to track the damage. It was the main source showing the bombed areas, but Planet Labs announced that it was withholding pictures of the war at the request of the US government.”

“We need to balance the need to protect people’s privacy with the freedom of the press to do investigative work that will benefit the public,” he said. “Laws designed to address the privacy concerns of individuals, including children, should not prevent the media from investigating wrongdoing that law enforcement officials may commit or prosecute.”

Bill C-36 may represent privacy reform in Canada for years, but the challenge for governments will be to ensure that laws are changing as quickly as AI technology will be able to predict behaviour, change decisions and change everyday life.

For Oliveros, the conflict comes down to who has power in an AI-driven world.

“Data privacy rights change power, so the power is back to you,” he said. “You have something – your identity.”