Canada's Bill C-36 tackles AI privacy challenges, but experts question its adequacy
Canada introduces Bill C-36, its first major privacy law overhaul in 25 years, recognizing privacy as a fundamental right and strengthening children's data protection, yet experts warn it may not keep pace with AI's ability to infer sensitive information from seemingly innocuous data.
Canada has introduced Bill C-36, the Protecting Privacy and Consumer Data Act, marking the first major overhaul of private-sector privacy legislation in over 25 years. The bill explicitly recognizes privacy as a fundamental right, aims to give stronger protections to children's personal information, enhance deletion rights, and require greater transparency when automated systems make significant decisions about individuals.
The legislation comes amid growing scrutiny of AI, particularly after an incident in British Columbia where an 18-year-old shooting suspect allegedly used ChatGPT before the attack. Victims' families have sued OpenAI, claiming the company's AI safety team identified violent prompts but did not alert law enforcement. The province of British Columbia has also announced it is preparing legal action against the AI company.
Evan Solomon, Canada's minister of AI and digital innovation, told Al Jazeera that the government's responsibility is to protect Canadians online while enabling them to benefit from emerging technologies. Bill C-36 establishes a framework for responsible use of de-identified data, including safeguards to reduce re-identification risks while supporting research and innovation.
However, experts argue that modern AI shifts privacy harms from data collection to inference. Ignacio Cofone, professor of law and regulation of AI at the University of Oxford, noted that AI can now predict health, finances, or behaviors from shopping habits, browsing history, and location data without any traditional data breach. Bill C-36 expands the definition of personal information to include inferred data and requires explanations for certain automated decisions, but Cofone believes the real challenge lies in regulating harmful uses of AI beyond mere collection.
A key reform is children's privacy: information about anyone under 18 is deemed inherently sensitive, and young people gain stronger deletion rights. Yet experts like Cofone and tech founder Jill Ma emphasize that privacy alone is insufficient. Age-appropriate design and algorithmic fairness are equally critical, as a child's early digital footprint should not become a lifelong label.
The bill also addresses de-identified data, sparking debate among privacy experts, researchers, and journalists. While it aims to prevent re-identification, some fear it could hinder investigative journalism and human rights work. Ethical AI lecturer Stephany Oliveros warned that over-restrictive privacy rules could shield powerful corporations from accountability. Canada's government has pledged to continue engaging with stakeholders to ensure the framework remains balanced and effective.
