New privacy bill would give Canadians right to request companies delete AI deepfakes

The federal Liberal government has introduced a new piece of legislation it says will tighten privacy rules and regulations for companies handling Canadians’ data.

Bill C-36, dubbed the Protecting Privacy and Consumer Data Act, would give Canadians the right to request that their personal information is deleted, though there would be some exceptions that would allow a company to deny such a request.

“Our primary purpose here is to give control back to Canadians over their own personal information and to require by law — with enforcement — that companies treat the information very sensitively,” Artificial Intelligence Minister Evan Solomon told reporters Monday on Parliament Hill.

Government officials briefing reporters on the legislation said it would cover any company that has a “substantial connection” to Canada.

WATCH | Solomon on why the government is acting now:

‘The moment is here’ to modernize Canada’s privacy laws: AI minister

Artificial Intelligence Minister Evan Solomon says the Protecting Privacy and Consumer Data Act will help keep Canadians safe in the digital age. ‘I think it’s a common-sense approach to what Canadians and what average folks want from their digital media,’ Solomon said on Monday about the new bill. ‘They want some control over their personal information.’

The right to request a deletion would include things such as AI-generated deepfakes that use an individual’s likeness.

Some exceptions that would allow a company to deny a deletion request would include if the data can be anonymized or if there are retention rules in place for things like fraud prevention, the government officials said.

The bill proposes higher standards for how companies handle children’s data, Solomon said.

The legislation is also aiming to create more transparency around how a company uses personal information in automated decision-making, where a company replaces human judgement with algorithmic judgement. A government official used the example of a decision around mortgage approvals.

Under the bill, Canadians would be able to ask what information was specifically used in an automated decision and request a review in cases where, for example, the information may have been out of date.

New commission proposed to enforce rules

This is the Liberal government’s third attempt to update privacy regulations, after introducing bills in 2020 and in 2023 that did not become law.

This latest bill comes after the government introduced separate legislation last week that would also restrict access to social media for kids under the age of 16, crack down on online harmful content and put in some controls around artificial intelligence chatbots.

That bill also proposed to set up a Digital Safety Commission that the government says will be responsible for enforcing the new privacy rules. Government officials said there would be a specific wing of this commission that would cover privacy.

WATCH | Culture minister on the proposed regulator:

Proposed digital safety commission would ‘give some teeth’ to social media ban, Miller says

When asked about the potential for kids to circumvent the government’s proposed social media restrictions for young Canadians, Culture Minister Marc Miller said ‘that is why it was so key to have a commission able to interact with industry and able to give some teeth to this law so we just didn’t hope and pray that this would be enforced.’

The commission would be able to launch investigations, make recommendations and issue fines up to $25 million or five per cent of global revenue, whichever is greater.

Officials estimate it could take 18 months to set up the new regulator after the online harms bill becomes law.

The new commission would be separate from the existing federal privacy commissioner. That office oversees how the federal government handles private information, though it can accept complaints about private companies and launch investigations based on those complaints.

But the current privacy commissioner doesn’t have much in the way of enforcement powers and is primarily limited to making recommendations to private companies, government officials said.