New privacy bill would give Canadians right to request companies delete AI deepfakes

New privacy bill would give Canadians right to request companies delete AI deepfakes

Liberal bill would empower new regulator to issue hefty fines, require deletion with some exceptions

The federal Liberal government has introduced a new piece of legislation it says will tighten privacy rules and regulations for companies handling Canadians' data.

Bill C-36, dubbed the Protecting Privacy and Consumer Data Act, would give Canadians the right to request that their personal information is deleted, though there would be some exceptions that would allow a company to deny such a request.

"Our primary purpose here is to give control back to Canadians over their own personal information and to require by law — with enforcement — that companies treat the information very sensitively," Artificial Intelligence Minister Evan Solomon told reporters Monday on Parliament Hill.

Government officials briefing reporters on the legislation said it would cover any company that has a "substantial connection" to Canada.

'The moment is here' to modernize Canada's privacy laws: AI minister

The right to request a deletion would include things such as AI-generated deepfakes that use an individual's likeness.

Some exceptions that would allow a company to deny a deletion request would include if the data can be anonymized or if there are retention rules in place for things like fraud prevention, the government officials said.

The bill proposes higher standards for how companies handle children's data, Solomon said.

The legislation is also aiming to create more transparency around how a company uses personal information in automated decision-making, where a company replaces human judgement with algorithmic judgement. A government official used the example of a decision around mortgage approvals.

Under the bill, Canadians would be able to ask what information was specifically used in an automated decision and request a review in cases where, for example, the information may have been out of date.

New commission proposed to enforce rules

This is the Liberal government's third attempt to update privacy regulations, after introducing bills in 2020 and in 2023 that did not become law.

This latest bill comes after the government introduced separate legislation last week that would also restrict access to social media for kids under the age of 16, crack down on online harmful content and put in some controls around artificial intelligence chatbots.

That bill also proposed to set up a Digital Safety Commission that the government says will be responsible for enforcing the new privacy rules. Government officials said there would be a specific wing of this commission that would cover privacy.

Proposed digital safety commission would 'give some teeth' to social media ban, Miller says

The commission would be able to launch investigations, make recommendations and issue fines up to $25 million or five per cent of global revenue, whichever is greater.

Officials estimate it could take 18 months to set up the new regulator after the online harms bill becomes law.

The new commission would be separate from the existing federal privacy commissioner. That office oversees how the federal government handles private information, though it can accept complaints about private companies and launch investigations based on those complaints.

But the current privacy commissioner doesn't have much in the way of enforcement powers and is primarily limited to making recommendations to private companies, government officials said.

Darren Major is a senior writer for CBC's parliamentary bureau in Ottawa. He previously worked as a digital reporter for CBC Ottawa and a producer for CBC's Power & Politics. He holds a master's degree in journalism and a bachelor's degree in public affairs and policy management, both from Carleton University. He also holds a master's degree in arts from Queen's University. He can be reached at darren.major@cbc.ca.

With files from The Canadian Press