Notes from the IAPP Canada: Loss of Bill C-27 presents an opportunity

It was a long time coming, but as my colleague Kris Klein, CIPP/C, CIPM, FIP, pointed out in last week's digest, Bill C-27, which would have replaced the Personal Information Protection and Electronic Documents Act with the Consumer Privacy Protection Act, is dead. While many will likely take this as a setback to Canadian privacy modernization — and it is — I'd like to focus on the opportunity it presents.

You see, C-27, which would have also created the Artificial Intelligence and Data Act, was introduced to Parliament in June 2022 — five months before. Well, before the world changed, if we're being honest. You see, a little app known as ChatGPT was unveiled to the public in November 2022. One can't help but wonder if our legislators may have done a few things differently had they first seen the power of the artificial intelligence tools unleashed in ChatGPT's wake and the privacy issues they present.

The CPPA's death is a disappointment, to be sure. PIPEDA is antiquated, cumbersome, and in many ways, not fit for purpose in our current information economy. But while the CPPA was a step forward, it was not without its flaws.

No privacy bill will please everyone, but valid criticisms were levied from all sides — practitioners, business groups, scholars and privacy advocates alike. They ranged from those concerning the CPPA's deidentification provisions, its attempt at introducing a right to be forgotten and more.

This is without yet mentioning AIDA's many critiques. Skinny on details in the act itself, most of the AIDA was left to be filled in by regulations. The next government will benefit from these issues already having been raised and being able to consider them when drafting C-27's successor.

With two years of ChatGPT now under our belts, excellent thought leadership emerging on AI and privacy — see Daniel Solove's draft 2024 article "Artificial Intelligence and Privacy," for example — and the results of important privacy commissioner investigations on generative AI and youth privacy expected in the near future, one can't help but think our legislators will be in a better position to draft a bill that is up to the privacy challenges of our time when they take their next swing at privacy reform. Let's just hope they're up to the task.

Dustin Moores, CIPP/C, is counsel at nNovation.