Bill C-27 summary: Digital Charter Implementation Act, 2022

The Government of Canada has tabled Bill C-27, the Digital Charter Implementation Act, 2022 to strengthen Canada's private sector privacy law, create new rules for the responsible development and deployment of artificial intelligence (AI), and continue advancing the implementation of Canada's Digital Charter. As such, the Digital Charter Implementation Act, 2022 introduces three proposed acts: the Consumer Privacy Protection Act, the Artificial Intelligence and Data Act, and the Personal Information and Data Protection Tribunal Act.

The proposed Consumer Privacy Protection Act will address the needs of Canadians who rely on digital technology and respond to feedback received on previous proposed legislation. This law will ensure that the privacy of Canadians will be protected and that innovative businesses can benefit from clear rules as technology continues to evolve. This includes:

  • increasing control and transparency when Canadians’ personal information is handled by organizations;
  • giving Canadians the freedom to move their information from one organization to another in a secure manner;
  • ensuring that Canadians can request that their information be disposed of when it is no longer needed;
  • establishing stronger protections for minors, including by limiting organizations’ right to collect or use information on minors and holding organizations to a higher standard when handling minors’ information;
  • providing the Privacy Commissioner of Canada with broad order-making powers, including the ability to order a company to stop collecting data or using personal information; and
  • establishing significant fines for non-compliant organizations—with fines of up to 5% of global revenue or $25 million, whichever is greater, for the most serious offences.

The proposed Artificial Intelligence and Data Act will introduce new rules to strengthen Canadians’ trust in the development and deployment of AI systems, including:

  • protecting Canadians by ensuring high-impact AI systems are developed and deployed in a way that identifies, assesses and mitigates the risks of harm and bias;
  • establishing an AI and Data Commissioner to support the Minister of Innovation, Science and Industry in fulfilling ministerial responsibilities under the Act, including by monitoring company compliance, ordering third-party audits, and sharing information with other regulators and enforcers as appropriate; and
  • outlining clear criminal prohibitions and penalties regarding the use of data obtained unlawfully for AI development or where the reckless deployment of AI poses serious harm and where there is fraudulent intent to cause substantial economic loss through its deployment.

Bill C-27 also proposes to establish the Personal Information and Data Protection Tribunal, which would play a role in the enforcement of the Consumer Privacy Protection Act. In particular, the Tribunal would review recommendations by the Privacy Commissioner of Canada to impose administrative monetary penalties for certain contraventions of the Act. The Tribunal would provide an accessible mechanism for organizations and individuals to seek a review of Privacy Commissioner decisions.

Finally, Bill C-27 would establish part of the existing privacy law that governs the use of electronic documents by the federal public sector as stand-alone legislation under the Electronic Documents Act.