Canada privacy bill tests AI rules on inferred data and children

Canada’s federal government is moving to rewrite private-sector privacy rules through Bill C-36, a proposal Ottawa calls the country’s first major update in more than 25 years. The bill matters because it seeks to address how artificial intelligence systems use personal data, especially when automated tools make decisions about people.

The Protecting Privacy and Consumer Data Act, announced in June, would recognise privacy as a fundamental right, strengthen protections for children’s information, broaden deletion rights and require more openness when automated systems make significant decisions, according to the government’s description of the bill.

The debate is unfolding amid closer scrutiny of AI companies after a February shooting in Tumbler Ridge, British Columbia. Families of the victims are suing OpenAI, alleging that the 18-year-old suspect used ChatGPT before the attack and that the company’s safety team had identified violent prompts but did not notify police. British Columbia has also said it is preparing legal action against OpenAI.

Evan Solomon, Canada’s minister of AI and digital innovation, told Al Jazeera the government wants to protect people online while allowing them to benefit from AI and other new technologies. He said Bill C-36 sets rules for the use of de-identified data, with safeguards intended to reduce the risk that people could be identified again while still allowing research, accountability and innovation.

AI inferences raise new privacy questions

Ignacio Cofone, a University of Oxford professor who studies AI law and regulation, told Al Jazeera that older privacy laws focus too heavily on what companies collect directly. He said AI creates risks when systems infer sensitive details from information a person did not knowingly provide.

Those inferences can come from shopping records, browsing behaviour, location information or other online activity. Cofone said a model may make decisions that disadvantage a group without identifying a specific person who can challenge the result.

Bill C-36 would expand the definition of personal information to include inferred information and would require organisations to explain some automated decisions. Cofone said that shift moves regulation closer to the point where AI-related harm can occur: the prediction and the decision made from it.

Children’s data gets special treatment

The bill would treat personal information belonging to anyone under 18 as sensitive and would give young people stronger rights to have data deleted. Stephany Oliveros, an ethical AI lecturer and chief executive of the AI talent-matching platform Just Lyra, told Al Jazeera that consent and privacy should give users more control over how their data is used.

Cofone said the child-focused provisions would help, but only to a limited degree. He said stronger protections for children online would also require age-appropriate design and limits on what platforms can do with young users.

Jill Ma, a tech founder working on children’s AI products, told Al Jazeera that algorithmic fairness is also part of privacy. She said children should not be boxed in by judgments drawn from early digital records.

Martin Haucke, a Vancouver parent and school teacher, told Al Jazeera that children’s internet access has become too permissive. Ottawa has also introduced separate legislation that would restrict access to platforms such as TikTok for users under 16, while Australia passed similar under-16 social media restrictions last year.

Data access and public interest

Experts also raised concerns about how Bill C-36 handles de-identified data. Cofone said the bill preserves exemptions for journalistic, artistic and literary work, but that research rules depend on where lawmakers draw the line between de-identified and anonymised data.

Oliveros said journalists and human rights groups may need detailed data to expose environmental racism, algorithmic bias or predatory lending. She warned that privacy rules could shield companies from scrutiny if they block access too broadly.

Eric Wishart, a journalism ethics author and professor at the University of Hong Kong, told Al Jazeera that privacy law should not prevent reporters from investigating wrongdoing or holding power to account. He cited journalists’ use of Planet Labs satellite imagery to track damage from attacks on Iran after limited information was released by the Pentagon, before the company said it withheld imagery at the request of the US government.

Bill C-36 would mark a major shift in Canadian privacy law, but the experts cited by Al Jazeera said AI regulation will also have to address safety, fairness and accountability as automated systems become more capable of profiling people and shaping decisions.

This story draws on original reporting from Al Jazeera.