Canada’s Bill C-۳۶ tackles AI privacy. Is it enough?

Vancouver, Canada: In an era of artificial intelligence, deepfakes and data-driven decision-making, Canada is moving to revise its privacy laws through Bill C-۳۶, the Protecting Privacy and Consumer Data Act.

Announced in June, Bill C-۳۶ is Canada’s first major overhaul of private-sector privacy legislation in more than ۲۵ years. The bill explicitly recognises privacy as a fundamental right and also aims to give children’s personal information stronger protections, enhance deletion rights and require greater transparency where automated systems make significant decisions about people.

The reforms also arrive amid growing scrutiny of AI after incidents such as British Columbia’s Tumbler Ridge shooting in February raised greater questions about AI chatbots, vulnerable users and the responsibilities of technology companies.

The ۱۸-year-old shooting suspect allegedly used ChatGPT before the attack. The victims’ families are now suing OpenAI, stating the company’s AI safety team identified violent prompts but did not alert law enforcement. This week, the province of British Columbia also announced it is “preparing legal action” against the AI company.

Meanwhile, Canada’s federal government plans to modernise private-sector consumer privacy rules via Bill C-۳۶.

Evan Solomon, Canada’s minister of AI and digital innovation, told Al Jazeera that the government’s responsibility is “to protect Canadians online and to ensure Canadians can benefit from artificial intelligence and emerging technologies. These goals are not mutually exclusive”.

“Bill C-۳۶ establishes a framework for the responsible use of de-identified data. It includes safeguards designed to reduce the risk of re-identifying individuals while supporting important public-interest activities, including research, accountability and innovation.”

But as AI systems become more capable of predicting, profiling and influencing people, experts say the challenge is no longer just what data companies collect — it is what AI can infer from users.

The question is whether privacy legislation can keep pace with technology designed to predict, profile and influence human behaviour.

Inferred information

The biggest issue is that AI is changing where privacy harms occur, according to Ignacio Cofone, professor of law and regulation of AI at the University of Oxford.

“Older privacy law assumes the danger is in what a company collects from you. The danger now is in what a company infers about you from data you never handed over, and in what it does with that AI inference.”

In other words, today’s AI systems don’t necessarily need someone to disclose sensitive information voluntarily. Patterns in shopping habits, browsing history, location data or online activity can be enough for algorithms to make surprisingly accurate predictions about a person’s health, finances or behaviours.

“A model trained on [anonymous] data can produce decisions that disadvantage a category of people without pointing at a named individual who can complain,” Cofone told Al Jazeera.

Bill C-۳۶ responds by expanding the definition of personal information to include inferred information and requiring organisations to explain certain automated decisions.

But, as Cofone argues, the real challenge is in ensuring regulation targets harmful uses of AI rather than just data collection.

“A model can predict your health, your sexuality, or your creditworthiness from unrelated traces and then act on the prediction, with no data leak or breach in a conventional sense,” he said.

“That matters enormously because it moves the law toward where AI harm actually occurs, the inference and the decision, rather than leaving it fixed on the act of collection.”

Protecting children online

Protecting children’s privacy is one of Bill C-۳۶’s headline reforms. The legislation would classify information belonging to anyone under ۱۸ as inherently sensitive and gives young people stronger rights to have their personal information deleted.

For Stephany Oliveros, ethical AI lecturer and CEO of Just Lyra, an AI talent-matching platform, data privacy and consent are about user agency.

“It’s one thing to donate my data towards cancer research, but another thing if tech firms find out the blood type and behaviours of my kid. Like, why does Facebook need to know that?”

Cofone added that the changes that come with Bill C-۳۶ are worthwhile but only address part of the problem.

“It will help, modestly, and less than the framing suggests. The bill does two things for children: It treats a child’s information as sensitive, which raises the bar for consent and for the security an organisation owes, and it gives children a stronger deletion right. Both are useful.”

But, he said, the bigger challenge lies elsewhere.

“The heavier protections people need with children online are age-appropriate design and limits on what platforms can do.”

According to Jill Ma, a tech founder who works in children’s AI products, beyond privacy, the next frontier is algorithmic fairness.

“Privacy isn’t just about controlling data; it’s about not being misjudged by an algorithm,” she said. “A child’s early digital footprint shouldn’t become a lifelong label. Our job as [product] builders is to teach AI how to respect people, not just collect their data.”

For concerned parents such as Martin Haucke, a Vancouver-based father of one, the greater issue is the cultural norm around internet permissiveness for children.

“The physical world is the safest it’s ever been, and the online world is what poses the biggest threats to kids’ safety,” he said. “And yet we are treating the real world as a dangerous place and are cavalier about our kids having phones before they hit high school.”

Earlier this year, Ottawa introduced separate legislation proposing restrictions on social media access to platforms such as TikTok for users under ۱۶. Other governments around the world have also begun responding in kind. Last year, Australia passed legislation to restrict access to certain social media platforms for under-۱۶s.

“It’s backwards,” said Haucke, who is also a school teacher. “What we need are zero phones in school. More time outdoors socialising.”

Privacy is only one part of the solution

Privacy is only one part of governing AI. Experts say future AI laws will need to balance user safety, journalism and public interest.

“As technologies continue to evolve,” Solomon said. “We will continue engaging with researchers, journalists, privacy experts, civil society and other stakeholders to ensure Canada’s privacy framework remains effective, balanced and responsive to Canadians’ expectations.”

One example of such a challenge is the bill’s treatment of de-identified information, an issue that has prompted debate among privacy experts, researchers and journalists.

While the legislation seeks to prevent organisations from reconstructing people’s identities from de-identified datasets, experts such as Oxford law’s Cofone say that this comes down to how organisations and researchers should be allowed to use de-identified data responsibly.

“I would separate the two concerns. On journalism, the bill keeps the exemption for journalistic, artistic and literary work,” he said. “Investigative journalism is protected, as it was under the old law. The harder problem is research, which turns on how the bill draws the line between de-identified and anonymised data.”

Oliveros, the ethical AI lecturer who has also collaborated with the United Nations, says this debate goes beyond legal definitions of privacy and should address accountability. Restricting access to data could make it harder for journalists and human rights organisations to uncover wrongdoing, she said.

“Watchdogs cannot rely on corporate summaries,” Oliveros told Al Jazeera. “To find environmental racism, algorithmic bias or predatory lending, journalists and human rights groups need access to granular, line-by-line data. If Bill C-۳۶ locks this data down entirely under the banner of privacy, it inadvertently shields powerful corporations from public accountability. Privacy must not become a legal cloak for corporate secrecy.”

But there may not be any easy answers.

“If the definition of a public-interest researcher is too loose, the law fails. But if it is too rigid, it shuts out independent journalists and grassroots NGOs who do the heavy lifting in human rights work,” Oliveros said.

While the bill focuses on protecting personal information, Eric Wishart, journalism ethics author and professor at the University of Hong Kong, says privacy laws should preserve journalism’s ability to hold accountable those in power as well as the public’s right to know.

He pointed to the United States-Israel conflict with Iran as one example.

“There was very little information released by the Pentagon about attacks on Iran, so journalists were depending on imagery from [satellite imagery platform] Planet Labs to track the damage. It was a key source that showed the sites hit by bombing, but then Planet Labs announced it was withholding imagery from the war at the request of the US government.”

“We have to balance the need to protect people’s privacy against journalists’ right to carry out investigative work in the public interest,” he said. “Legislation designed to address the legitimate privacy concerns of private individuals, including children, should not prevent journalists from investigating potential wrongdoing by public figures or holding power to account.”

Bill C-۳۶ may represent Canada’s most significant privacy reform in decades, but the challenge for governments will be ensuring regulation evolves as quickly as the technology itself as AI becomes increasingly capable of predicting behaviour, influencing decisions and reshaping daily life.

For Oliveros, the debate ultimately comes down to who holds power in an AI-driven world.

“Data privacy rights shift the power dynamic, so the power is back onto you,” she said. “You own something — your identity.”