Vancouver, Canada: In the era of artificial intelligence, deepfakes, and data-driven decision-making, Canada is reforming its privacy laws through Bill C-36, the Privacy and Consumer Data Protection Act.
Bill C-36, announced in June, is Canada’s first major overhaul of private sector privacy laws in more than 25 years. The bill explicitly recognizes privacy as a fundamental right and aims to provide stronger protections for children’s personal information, strengthen the right to deletion, and require greater transparency when automated systems make important decisions about people.
Recommended stories
list of 4 itemsend of list
The reforms also come amid increased scrutiny of AI after incidents such as the Tumbler Ridge shooting in British Columbia in February, which raised big questions about AI chatbots, vulnerable users, and the responsibility of tech companies.
The 18-year-old shooting suspect is said to have been using ChatGPT before the attack. The victim’s family is now suing OpenAI, alleging that the company’s AI safety team identified the violent prompts but failed to alert law enforcement. This week, British Columbia also announced it was “preparing legal action” against the AI company.
Meanwhile, Canada’s federal government plans to modernize consumer privacy rules for the private sector through Bill C-36.
Evan Solomon, Canada’s Minister of AI and Digital Innovation, told Al Jazeera that the government’s responsibility is to “protect Canadians online and ensure Canadians can benefit from artificial intelligence and emerging technologies. These goals are not mutually exclusive.”
“Bill C-36 establishes a framework for the responsible use of de-identified data, which includes safeguards designed to reduce the risk of re-identifying individuals while supporting important public interest activities such as research, accountability and innovation.”
But as AI systems become more capable of predicting, profiling and influencing people, experts say the challenge is no longer just about the data companies collect, but what AI can infer from users.
The question is whether privacy laws can keep up with technologies designed to predict, profile, and influence human behavior.
Estimated information
The biggest problem, said Ignacio Coffone, professor of AI law and regulation at the University of Oxford, is that AI is changing where privacy violations occur.
“Previous privacy laws assumed the danger was in what companies collected from you. The danger now lies in what companies infer about you from the data you didn’t give them, and what they do with that AI inference.”
In other words, today’s AI systems do not necessarily require someone to voluntarily disclose sensitive information. Shopping habits, browsing history, location data, or patterns of online activity may be enough for algorithms to make surprisingly accurate predictions about a person’s health, finances, or behavior.
“The trained model is [anonymous] Data can generate decisions that disadvantage certain categories of people without pointing to specific individuals who can make complaints,” Cofone told Al Jazeera.
Bill C-36 responds by expanding the definition of personal information to include inferred information and requiring organizations to account for certain automated decisions.
But, as Cofon argues, the real challenge lies in regulating the harmful uses of AI, not just data collection.
“Models can predict your health, sexuality, or creditworthiness from unrelated signatures and act on those predictions. There is no data leak or breach in the traditional sense,” he said.
“This is critical because, rather than keeping the law fixed on collection practices, it moves the law toward where AI harm actually occurs: inference and decision-making.”
protect children online
Protecting children’s privacy is one of the hallmark reforms of Bill C-36. The bill would classify information belonging to individuals under 18 as inherently sensitive and give young people stronger rights to delete their personal information.
For Stephanie Oliveros, ethical AI instructor and CEO of Just Lyra, an AI talent matching platform, data privacy and consent are about user agency.
“It’s one thing to donate my data to cancer research. It’s another thing for a tech company to know my child’s blood type and behavior. Why would Facebook need to know that?”
Cofone added that the changes coming with Bill C-36 are valuable, but only address part of the problem.
“To say the least, while not as much as the framework suggests, this bill does two things for children: it treats children’s information as confidential information, raising standards of consent and security for organizations, and it gives children strong deletion rights. Both are beneficial.”
But the bigger challenge lies elsewhere, he says.
“The stronger protections that people who take their children online need are age-appropriate designs and limits on what platforms can do.”
Beyond privacy, the next frontier is algorithmic fairness, according to Jill Marr, a technology founder who works on AI products for children.
“Privacy isn’t just about controlling your data, it’s about making sure it’s not misjudged by algorithms,” she says. “A child’s early digital footprint should not become a lifelong label; [product] The builder is not just about collecting data, but teaching AI how to respect people. ”
For concerned parents like Vancouver-based father-of-one Martin Hawke, the bigger issue is cultural norms regarding Internet tolerance for children.
“The physical world is the safest it has ever been, but the online world poses the greatest threat to children’s safety,” he said. “Yet we treat the real world as a dangerous place and are cavalier about giving kids cell phones before they start high school.”
Earlier this year, the City of Ottawa introduced another bill proposing restricting social media access to platforms like TikTok by users under 16. Other governments around the world are beginning to respond similarly. Last year, Australia passed legislation restricting access to certain social media platforms for under-16s.
“It’s going backwards,” said Hauke, who is also a schoolteacher. “What we need is no phones in school. More time to socialize outdoors.”
Privacy is only part of the solution
Privacy is just one part of managing AI. Experts say future AI laws need to balance user safety, journalism and the public interest.
“Technology continues to evolve,” Solomon said. “We will continue to work with researchers, journalists, privacy experts, civil society and other stakeholders to ensure Canada’s privacy framework remains effective, balanced and meets the expectations of Canadians.”
One example of such a challenge is the bill’s treatment of de-identified information, an issue that has sparked debate among privacy experts, researchers, and journalists.
The bill aims to prevent organizations from reconstructing people’s identities from anonymized datasets, but experts such as Oxford Law’s Cofone say this ultimately comes down to how organizations and researchers can use anonymized data responsibly.
“I would like to separate these two concerns. When it comes to journalism, this bill maintains exemptions for journalistic, artistic and literary works,” he said. “Investigative journalism is protected, as it was under the old law. The more difficult issue is research, and it focuses on where this bill draws the line between anonymized data and de-identified data.”
Oliveros, who lectures on ethical AI and has worked with the United Nations, said the debate goes beyond the legal definition of privacy and calls for accountability. Restricting access to data could make it harder for journalists and human rights groups to expose wrongdoing, she said.
“Surveillance agencies cannot rely on company profiles,” Oliveros told Al Jazeera. “To spot environmental racism, algorithmic bias, or predatory lending, journalists and human rights groups need access to detailed line-by-line data. If Bill C-36 completely locks down this data under the banner of privacy, it will unwittingly protect powerful companies from public liability. Privacy must not become a legal cover for trade secrets.”
But there may be no easy answer.
“If the definition of public interest researcher is too loose, this law will not work, but if it is too strict, it will crowd out independent journalists and grassroots NGOs who do the heavy lifting in human rights work,” Oliveros said.
While the bill focuses on protecting personal information, Eric Wishart, author of Journalism Ethics and professor at the University of Hong Kong, argues that privacy laws should protect journalism’s ability to hold those in power accountable and the public’s right to know.
He cited the conflict between the United States, Israel, and Iran as an example.
“There was little information released by the Pentagon regarding the attack on Iran, so journalists relied on images from Iran. [satellite imagery platform] Planet Labs is tracking the damage. This was an important source of information showing bombed sites, but Planet Labs announced it would withhold images from the war at the request of the US government. ”
“We need to balance the need to protect people’s privacy with the right of journalists to conduct investigative work in the public interest,” he said. “Laws enacted to address legitimate privacy concerns of private individuals, including children, should not prevent journalists from investigating or holding accountable potential wrongdoing by public figures.”
Bill C-36 may be Canada’s most significant privacy reform in decades, but as AI becomes increasingly capable of predicting behavior, influencing decision-making and reshaping daily life, the challenge for governments will be to ensure regulations evolve as quickly as the technology itself.
For Oliveros, the debate boils down to who will hold power in an AI-driven world.
“The right to data privacy changes the power dynamics, so the power returns to you,” she said. “You own something: your identity.”
