By Esther Shainblum and Martin U. Wissmath

ISED new Voluntary Code of Conduct Encourages Responsible AI Development

The Honourable François-Philippe Champagne, Minister of Innovation, Science and Industry, unveiled Canada's Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems (the “Code”). Announced in a news release on September 27, 2023, this initiative offers voluntary commitments for industry participants to demonstrate responsible practices in the development and oversight of generative artificial intelligence (AI) systems, such as ChatGPT, DALL·E 2, and Midjourney.

The Code serves as an immediate guide to responsible AI development, bridging the gap until the proposed Artificial Intelligence and Data Act (AIDA) becomes effective, as part of Bill C-27, which was introduced in June 2022. Bill C-27 completed Second Reading in the House of Commons on April 24, 2023, and is currently under examination by the Standing Committee on Industry and Technology.

The Code emphasizes six core principles:

Accountability: Organizations must establish proportional risk management frameworks aligned with the scope of their activities.

Safety: Emphasis is placed on risk assessments and risk mitigation measures to ensure safety, including addressing malicious or inappropriate uses.

Fairness and equity: Organizations must assess and mitigate biases throughout an AI system's lifecycle.

Transparency: Transparency is achieved through the publication of information about AI systems and the clear identification of AI-generated content.

Human oversight and monitoring: Systems must be continually monitored, and incidents reported and addressed.

Validity and robustness: Comprehensive testing is required to ensure the effective operation and cybersecurity of AI systems.

Drafting of the Code was informed by input from diverse stakeholders, including the Government of Canada’s Advisory Council on Artificial Intelligence, through the “Consultation on the development of the Canadian code of practice for generative AI systems”. The federal government expects the Code to enhance Canada’s contributions to international discussions on addressing common risks associated with the wide-scale deployment of generative AI, including “at the G7 and among like-minded partners,” according to the news release.

The Code is part of the federal government’s effort toward a proactive stance on regulating AI and ensuring its responsible use, citing the importance of addressing issues like bias and maintaining human oversight in AI technology. This Code signifies an attempt at building public trust and fostering innovation in the rapidly evolving AI landscape. It is designed to support the proposed AIDA, which focuses on high-impact AI systems' responsible design, development, and use in Canada's private sector, emphasizing health, safety, and human rights. Charities and not-for-profits, as participants in the private sector, will also be impacted by the development, implementation, and regulation, of AI systems.

Google’s Contravention of Federal Privacy Law Not Exempt for ‘Journalistic Purposes’

The Federal Court of Appeal has ruled that Google’s search engine service is subject to federal privacy law. In Google LLC v Canada (Privacy Commissioner), published on September 29, 2023, the Federal Court of Appeal (“FCA”) heard an appeal by Google from a lower court decision. The FCA held that Google is not exempt from the Personal Information Protection and Electronic Documents Act (PIPEDA), under the journalistic purposes exemption in paragraph 4(2)(c). Hon. Justice Wyman W. Webb dissented.

The proceedings began with an investigation by the federal Office of the Privacy Commissioner (OPC) involving a complainant that accused Google of violating privacy law under PIPEDA by displaying search results containing news articles related to the complainant when their name was searched. The complainant alleged that the articles were outdated, inaccurate, and disclosed sensitive personal information about them, and that this caused them significant harm. In dismissing Google’s appeal, the FCA upheld the Federal Court decision that Google’s search engine “collects, uses, or discloses” personal information “in the course of commercial activities” under paragraph 4(1)(a) of PIPEDA. Related legal issues, including whether an individual has the “right to be forgotten” in Canada, have yet to be decided. Charities and not-for-profits may in some cases be subject to PIPEDA and should seek legal advice to ensure that their online content complies with all privacy laws and OPC guidance.

Ontario Privacy Commissioner Expands Transparency of Decisions under PHIPA

The Information and Privacy Commissioner of Ontario (IPC) has introduced a significant alteration in the way it publishes its decisions under the Personal Health Information Protection Act, 2004 (PHIPA). Effective October 10, the IPC may now publish PHIPA decisions at any stage of dispute resolution, encompassing early resolution, investigation, and adjudication. These decisions may include the names of the respondents and affected parties, unless revealing such names would identify the complainant or any individuals whose personal health information is at stake. Some charities and not-for-profits that collect personal health information are also subject to PHIPA.

The IPC's revised "PHIPA Practice Direction #3" reflects this recent update and guides readers on when a PHIPA decision will be made available to the public and which parties will be identified in that decision by name. Directors on the board of charities and not-for-profits that collect personal health information should read this practice direction in conjunction with the IPC’s “Code of Procedure for Matters under the Personal Health Information Protection Act, 2004.”

​Read the October 2023 Charity & NFP Law Update