Ensuring Digital Signature Lawfulness for Personnel in Canada

How to eSign a document: digital signature lawfulness for Personnel in Canada

earlier this year the government of Canada tabled legislation to regulate the use of artificial intelligence frankly it's an embarrassment the government should go right back to the drawing board and consult with people who know what they're talking about they should also look at what is being done in Europe so that our approach is consistent with emerging International norms hi my name is David Fraser I'm a privacy internet and Technology lawyer with the Canadian law firm McGinnis Cooper I also teach internet and media law at the Schulich School of Law at Dalhousie University in this channel I try to provide educational and informative content about Canadian privacy and Technology law you should check out the full disclaimer below but you should know that I'm going to give you a very high level overview of a pretty complicated and nuanced subject with lots of gaps you should also know that my clients include companies that provide artificial intelligence systems and companies that use them any opinions expressed are mine alone and should not be attributed to my firm or any of its clients the government of Canada tabled the digital Charter implementation Act of 2022 on June 16 2022 it is just sat at first reading like bill c-11 before it without being referred to committee and without making any progress at all we do expect that it'll come back to life sometime this fall while much of the attention has been focused on the first two parts of the bill which will implement the consumer privacy protection act and the personal information and data protection tribunal act the third part has not gotten much attention to be honest the artificial intelligence and data act cannot attract much commentary because it is incomplete and largely meaningless without being a without us being able to see the regulations which will give most of its meaning it's the first step of a work in progress a skeleton but we can't tell if it will be a mammal or a reptile you may recall that bill c27 is largely a reintroduction of Bill c-11 from 2019 which was the digital Charter implementation Act of 2019. that bill did not include a proposed AI law if it had we would have at least have had the time between 19 or 2019 and 2022 to provide comments on what was missing but largely out of the blue the government introduced Bill c-27 and seems determined to continue to include all of it as one package in the meantime the European Union has also been looking at regulating artificial intelligence while it is still a work in progress we can underscore the word progress over the last several years the EU has released discussion papers and solicited comments then they introduced a draft law and solicited more comments many many stakeholders have had a chance to consider the proposals and weigh in on them none of that has happened in Canada other than maybe some behind closed-door discussions the process that led to this bill is embarrassing as is the substance of it but speaking of I should probably include some substance so on with the show keep in mind that what is regulated and how it is regulated is largely left to regulations and thus presently unknown and unknowable the Aida is the beginning of a work in progress and largely appears to be an afterthought as part of the government's digital Charter agenda what's weird is that it doesn't fit within the current or proposed structures of the so-called digital Charter for example it doesn't make use of the new tribunal that is established earlier in the bill the ACT applies to regulated activities and requires measures to mitigate risks of harm and biased output related to high impact systems what much of this means is left to the regulations which haven't been shared some key Concepts and the intent of the law are set out in the bill artificial intelligence system is very broadly defined but limited to processing data about human activities it is a technological system that autonomously or partly autonomously processes data related to human activities through the use of a genetic algorithm a neural network machine learning or another technique in order to generate content or make decisions recommendations or predictions the X purposes are also set out and are justifiably limited to International or inter-provincial uses since the federal government doesn't have jurisdiction over purely local uses of AI it's meant to regulate Ai and to prohibit uses of artificial intelligence systems that may result in serious harm to individuals or harms to their interests interestingly the government has decided to carve out some of the most potentially harmful and dangerous uses of artificial intelligence namely the use of AI by the government itself including National Security and National Defense entities the bill prescribes regulated activities to include the design development use and making available AI systems including data related to human activities for such purposes I think it's notable that research and development related to AI is captured within these rules when it probably should be limited to the promotion or deployment of systems that might actually affect the real world the bill regulates the use of anonymized data in AI systems but how it does so is left to the regulations the bill largely regulates and police's high impact systems but but what is high impact that's left to the regulations anyone who is responsible for any AI system has to assess whether that system is high impact how they need to do that will be left to the regulations they'll have to establish measures to identify assess and mitigate the risks of harm or bias output that could result from the use of the system how they need to do that is left to the regulations they also have to put in place mitigation measures and monitor them how they need to do that will be left to the regulations there are record-keeping requirements but we have no real idea what they do since that is also left to the regulations the risk assessment has to be documented along with the compliance with the rules related to anonymized data risk management and mitigation and also other records set on the regulations have to be kept for high impact systems a person who makes a high impact system available has to publish on the internet a plain language description of the system that includes an explanation of how the system is intended to be used and the types of content that it is intended to generate and the decisions recommendations or predictions that is intended to make and the risk mitigation measures put in place and any other information that may be prescribed by regulation and of course how and when they do this will be set out in the regulations finally a person who is responsible for a high impact system must notify the minister if the use of the system results or is likely to result in material harm of course how to give notice is determined by the regulations you'll likely not be surprised to learn that material harm and the definition of it is left to be defined in the regulations as you can see everything important in figuring out who this applies to and how it applies is unknown because we haven't seen those regulations does this materially affect your AI systems don't know assuming this does affect your AI systems we really don't know how it will affect them the whole regulatory scheme is significantly different from existing or planned digital regulation in Canada instead of being overseen by an independent officer of parliament like our privacy and access to information laws the minister can name a bureaucrat as the AI and data commissioner they are an unrealing of the minister and not at all at arm's length there is no appeal to the data protection tribunal the bill does contain significant offenses and penalties it is an offense to violate any of section 6 through 12 which relate to anonymized data assessment of high impact systems measures related to risk monitoring mitigation measures record-keeping publication of descriptions and notification of material harm so what activity becomes an offense is largely left to the regulations ah but the penalties are not the maximum penalty is the greater of 10 million dollars or three percent of an organization's Global Revenue the bill also provides for administrative monetary penalties which are like offenses but without due process and of course everything related to that will be set out in the regulations the most detailed section of the bill is the one that authorizes the creation of regulations shocker as I said before this bill is an embarrassment the government should yank it out of Bill c27 go right back to the drawing board and actually consult with people who know what they're talking about in the field of AI it's like they're trying to take a shortcut to the finish line of having an AI law on the books without regard to actually getting it right this is important stuff that affects the lives of people in Canada and Innovative companies they should look at what's being done in Europe so that our approach is consistent with these emerging International norms I hope this has been interesting and useful I try to put out a new video every week or so so if you're interested in this sort of content please click the like And subscribe buttons also leave a comment if you have any questions or if you have a suggestion for other topics you'd like me to cover and of course feel free to share this with anyone who you think may be interested in hearing about developments in Canadian Tech and Privacy Law thanks for tuning in