Artificial Intelligence and Data Act

Part 4 Coming into Force

This Act enacts the Consumer Privacy Protection Act, establishing a digital regulatory framework for privacy protection, artificial intelligence systems, and data protection in Canada grounded in principles of individual autonomy, trust, transparency and alignment with international standards and human rights law. It applies to organizations handling personal information in commercial activities or concerning federal work undertaking employees, including interprovincial and international data flows, with exemptions for government institutions, personal domestic purposes, journalistic or artistic purposes, and employment-related communications. The Act creates comprehensive obligations on organizations regarding privacy management programs, consent, retention, accuracy, security, breach notification, transparency and individual rights to access, deletion, and amendment, while prohibiting certain practices such as conditioning services on unnecessary data collection, using automated collection tools without consent, and identifying individuals from de-identified information except for security testing, legal compliance, fairness testing or Commissioner authorization.

Part 2 Commissioner’s Powers, Duties and Functions and General Provisions

The Commissioner may approve codes of practice and certification programs, investigate complaints and conduct audits, issue compliance orders and recommend penalties up to the greater of 10 million dollars or 3 percent of gross global revenue, and summon witnesses and compel document production with powers equivalent to a superior court. Individuals affected by contraventions can sue for damages in Federal or provincial superior courts within two years of learning of a finding or conviction. The Commissioner must maintain confidentiality, develop education and guidance programs, enter coordination agreements with provincial and federal authorities and foreign regulators, and table annual reports to Parliament; employers cannot retaliate against employees disclosing contraventions or refusing to participate in them, and knowingly contravening specified sections or obstructing investigations carries indictable fines of the greater of 25 million dollars or 5 percent of gross global revenue, or summary conviction fines of the greater of 20 million dollars or 4 percent of gross global revenue.

Part 1 Protection of Personal Information in the Private Sector

This section defines key terms used throughout the Act governing private sector personal information protection, including breach of security safeguards, business contact information, and business transaction, which are essential for understanding the scope of obligations.

Division 1 Protection of Personal Information

Organizations must follow Schedule 1 obligations for personal information and may collect it only for purposes a reasonable person would find appropriate, with seven exceptions including investigations, emergencies, insurance claims, employment contexts, research impracticable without consent, publicly available regulated information, and required disclosures; they may use and disclose it without consent in specified circumstances including law violation investigations, emergencies, fraud prevention, court orders, and government requests, and may share it in business transactions with appropriate safeguards and agreements. After business transactions, organizations may continue using disclosed information under the same restrictions, and federal employers may collect and use information necessary for employment management with notification; individuals may request access within thirty days (extendable by thirty days with notification if activities would be unreasonably interfered with), but organizations must refuse access revealing third party information unless the third party consents or life, health or security is threatened, and must wait thirty days after notifying government institutions of disclosure requests unless those institutions object on national security, defence, international affairs, or law enforcement grounds. Organizations must report personal information breaches to the Commissioner without delay if there is reasonable basis to believe the breach creates genuine risk of major harm, and must notify affected individuals and relevant government institutions of such breaches unless law forbids it, with records kept for Commissioner access.

Division 2 Remedies

The Commissioner investigates complaints about Schedule 1 violations or refused access requests unless other procedures should be exhausted first, the matter is better addressed elsewhere, or the complaint is unreasonably late, and may also initiate investigations without complaint if reasonable grounds exist; the Commissioner may summon persons, compel evidence, enter non-dwelling premises, examine records, and discontinue investigations if evidence is insufficient, the complaint is trivial or in bad faith, the organization responded fairly, a compliance agreement exists, investigation is ongoing, or the matter was already reported or is being addressed elsewhere. The Commissioner must send a report to the complainant and organization without delay including any settlement, a request for notice of implemented recommendations, and information about available recourse; complainants may apply to Court for a hearing within one year of receiving the report or within any longer period the Court allows. Courts may order organizations to correct practices, publish notices of actions taken, and award damages including for humiliation; the Commissioner may enter compliance agreements when having reasonable grounds to believe violations have been or are likely to be committed, and such agreements prevent the Commissioner from applying to Court on those matters but do not prevent individuals from seeking Court hearings or prosecution for offences.

Division 3 Audits

The Commissioner may audit an organization's personal information practices with reasonable notice when there are grounds to believe violations of Division 1 or 1.1 exist or Schedule 1 recommendations are not being followed, using powers including summoning evidence, entering non-residential premises, and examining records, and must provide the audited organization with a report of findings and recommendations.

Division 4 General

The Commissioner and staff generally must not disclose information acquired through their duties except where public interest justifies it or disclosure is necessary for investigations, audits, findings, recommendations, prosecutions for specified offences, court hearings, appeals, or judicial review. The Commissioner may disclose to provincial or federal attorneys general evidence of officer or employee offences, and to government institutions where reasonably believed to assist investigations of legal contraventions; may consult with provincial counterparts and foreign authorities with similar functions under confidentiality procedures restricting use to original purpose; and may enter written arrangements with enforcement bodies limiting disclosure to what is necessary and restricting use to original purpose. Employers cannot dismiss, suspend, demote, discipline, harass or disadvantage employees who in good faith report contraventions, refuse to contravene, or take compliance steps; organizations that knowingly contravene certain provisions or obstruct investigations face summary conviction fines up to $10,000 or indictable fines up to $100,000.