Regulation on the Rocks: Why Canada’s First AI Law Looks Likely to Fail

Introduction

In June of 2022, the Government of Canada tabled Bill C-27, the Digital Charter Implementation Act,[1] making it one of the earlier countries in the world to commence work on a national level Artificial Intelligence (AI) regulatory framework. Unfortunately, due to a complex array of factors—including criticisms of its scope, legislative delays and political instability—the bill now faces a significant risk of failure.

Bill C-27 is an omnibus bill that contains three pieces of legislation including the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act (PIDPA) and the Artificial Intelligence Data Act (AIDA). The CPPA and the PIDPA are aimed at modernizing Canada’s private-sector privacy law framework while the AIDA is intended to create new legal rules for the safe development and implementation of artificial intelligence.[2] AIDA seeks to regulate high impact AI systems deployed for commercial use in Canada by prioritizing risk management, transparency, and accountability.

As discussed in earlier columns, I am generally very supportive of the risk management approach of AIDA however, it has been the subject of significant criticisms from a variety of stakeholders. Recent amendments proposed by the Minister of Innovation, Science and Industry reflect an effort to address stakeholder criticisms, but they have not alleviated widespread concerns about the bill’s viability in its current form. Additionally, combining AIDA with the broader privacy and data governance mandates of the CPPA and PIDPA may have diluted its focus, complicating the legislative process and heightening opposition among lawmakers. With an impending federal election and increased political volatility, Canada’s ability to implement its first comprehensive AI law remains uncertain. Unfortunately, Canada is currently at risk of falling behind global counterparts, potentially losing its competitive edge in AI innovation and leaving open the possibility of unregulated AI technologies impacting privacy, safety, and public trust.

Background

Bill C-27 is not Canada’s first recent attempt to update its privacy laws. A previous attempt, Bill C-11, introduced in November 2020, died on the order paper in April 2021 when Parliament dissolved. The two privacy law acts in Bill C-11 were subsequently combined with a new attempt to regulate AI in Bill C-27. Introduced in June 2022, Bill C-27 has slowly made its way through the legislative process, with a second reading introduced in April 2022. It has since been referred to the Standing Committee on Industry and Technology (INDU), which has begun its review. The INDU Committee minutes reveal slow progress and contentious discussions on the bill’s contents.

Notably, the Minister of Innovation, Science and Industry appeared before the Committee and indicated that he would be providing proposed amendments to both the CPPA and AIDA. These proposed amendments came by way of letter from the Minister in October and November 2023 respectively, and in the case of the AIDA, included significant changes to address some of the key concerns addressed by stakeholders.[3] These included amending the definition of “Artificial Intelligence” to align with other international AI regulatory efforts as well as identifying a list of seven initial classes of “High Impact” AI systems. Despite what I see as the positive impact of these changes, they have unfortunately failed to significantly enhance the bill’s chances of passage.

Current Status

In light of the slow progress through the INDU Committee, commentators have begun to publicly doubt whether Bill C-27 will pass before the next election is called or the current government falls to a non-confidence vote. As an example, a recent opinion piece by Kris Klein, the managing director for Canada for the International Association of Privacy Professionals noted in regards to the INDU Committee’s recent return to their clause-by-clause review of the Bill that “…not one of its members showed any interest in actually getting that job done. It was classic delays, and I don’t think any one party or member is to blame. So, in Parliament, zero happened on privacy or AI.”[4] Indeed, the minutes of the most recent meeting to consider the Bill on September 26, 2024 contain some insight into the political disfunction around the bill, with the proposal of the following motion.

Rick Perkins moved, — That, with regard to the committees ongoing study of Bill C-27, and given Minister Champagne has accused opposition parties of slowing down consideration of the bill, but given that:

(i) the Minister delayed consideration of the bill for a year by leaving it on the order paper, preventing its consideration in second reading; and given

(ii) liberal members of the industry committee have continuously filibustered consideration of the bill for five out of the ten meetings held on clause-by-clause, to prevent the passage of amendments recommended by the Privacy Commissioner;

the committee therefore express its disagreement with Minister Champagne comments, and orders the clerk of the committee to draft a letter to the Minister requesting that his members stop their filibuster of Bill C-27.

After debate, by unanimous consent, the motion was withdrawn.[5]

The reasons behind the delay in moving this bill through the legislative process are likely numerous but in my opinion primarily rest on two factors; the complexity of combining two significant regulatory reforms into one bill and the unstable political environment in the country at this time. By combining both privacy and AI regulation into a single piece of legislation, the government has taken on an immense regulatory burden that would be challenging to manage even without additional political friction.

Privacy advocates and tech experts alike have expressed concern that the inclusion of AI regulation as a secondary component detracts from C-27’s primary mandate of updating privacy protections. This dual approach risks spreading resources and political capital too thin, ultimately compromising the efficacy of both the privacy and AI components. A narrower focus on privacy reform, or separate, more specialized legislation for AI, might have been more achievable given the current political climate and timeline constraints. The current real threat to Bill C-27’s survival is Canada’s political instability, with the potential for a successful non-confidence vote or the call of an election before the passage of the bill. Political opposition is likely to grow in the run up to the election and the Conservative Party has voiced concerns about regulatory overreach, questioning the bill’s implications for Canadian businesses. If this party were to form government in the future, it is conceivable that they would seek to overhaul, or even scrap, the bill, leaving Canada without a regulatory framework for AI and updated privacy standards.

Conclusion

As Canada grapples with the complexities of AI legislation amid a challenging political landscape, other nations are moving forward with their regulatory frameworks. Notably, the European Union enacted its AI Act on August 1, 2024, setting a global standard and intensifying pressure on Canada to implement comparable regulations. Domestically, industry leaders and advocacy groups alike are calling for clearer regulatory guidelines on AI, citing concerns not only about compliance expectations but also about the risks of harm to vulnerable populations in an unregulated environment. AI technology is rapidly permeating everyday life in Canada, while efforts to regulate its impact remain stalled.

Canada stands at a critical juncture: if Bill C-27 fails as I and other commentators believe it will, the next government will inherit both the regulatory urgency and the need to rebuild trust and momentum with stakeholders. As the global AI regulatory landscape advances, so does the urgency for Canada to enact effective AI legislation. However, ensuring that such legislation succeeds may require a more targeted and streamlined approach than what Bill C-27 currently offers. At present, the likelihood of Bill C-27 becoming law is uncertain and it is growing increasingly certain that Canada may soon find itself forced to restart its efforts to regulate AI from the ground up.

Disclosure: Generative AI was used in the development of this post.

_________________

[1] Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, 1st Sess, 44th Parl, 2022​.

[2] Canada, Innovation, Science and Economic Development Canada, The Artificial Intelligence and Data Act (AIDA) – Companion Document, 2022, online: https://ised-isde.canada.ca/site/innovation-better-canada/en/artificial-intelligence-and-data-act-aida-companion-document.

[3] See Canada, House of Commons, Standing Committee on Industry and Technology, Submission from the Minister of Innovation, Science and Industry, 44th Parl, 1st Sess, (20 October 2023), online: https://www.ourcommons.ca/content/Committee/441/INDU/WebDoc/WD12633023/12633023/MinisterOfInnovationScienceAndIndustry-2023-10-20-e.pdf. and Canada, House of Commons, Standing Committee on Industry and Technology, Submission from the Minister of Innovation, Science and Industry, 44th Parl, 1st Sess, (20 October 2023), online: https://www.ourcommons.ca/content/Committee/441/INDU/WebDoc/WD12633023/12633023/MinisterOfInnovationScienceAndIndustry-2023-10-20-e.pdf.

[4] Kris Klein, “Notes from the IAPP Canada: Lack of Bill C-27 progress ‘frustrating'” (20 September 2024), online: International Association of Privacy Professionals (IAPP) https://iapp.org/news/a/notes-from-the-iapp-canada-Lack-of-Bill-C-27-progress-frustrating-.

[5] Canada, House of Commons, Standing Committee on Industry and Technology, Minutes of Proceedings, Meeting No 136 (26 September 2024), 44th Parl, 1st Sess, online: https://www.ourcommons.ca/DocumentViewer/en/44-1/INDU/meeting-136/minutes.