Ransomware Incidents Overview in Canada

Artificial Intelligence and Data Act

• Citable as the Artificial Intelligence and Data Act.

Definitions

• An artificial intelligence system is a technological system that autonomously or partly autonomously processes data related to human activities.
• Data processing is done using a genetic algorithm, a neural network, machine learning, or another technique.
• Processing is done to generate content or make decisions, recommendations, or predictions.
• A person includes a trust, a joint venture, a partnership, an unincorporated association, and any other legal entity.
• Personal information has the meaning assigned by subsections 2(1) and (3) of the Consumer Privacy Protection Act.

Non-Application

• This Act does not apply with respect to a government institution as defined in section 3 of the Privacy Act.
• This Act does not apply with respect to a product, service, or activity under the direction or control of the Minister of National Defence, the Director of the Canadian Security Intelligence Service; the Chief of the Communications Security Establishment; or any other person responsible for a federal or provincial department or agency and who is prescribed by regulation.
• The Governor in Council may make regulations prescribing persons.

Purposes

• The purposes of this Act are to regulate international and interprovincial trade and commerce in artificial intelligence systems by establishing common requirements, applicable across Canada, for the design, development, and use of those systems and to prohibit certain conduct in relation to artificial intelligence systems that may result in serious harm to individuals or harm to their interests.

Definitions (Part 1)

• Biased output means content generated by an artificial intelligence system that adversely differentiates without justification on prohibited grounds of discrimination set out in section 3 of the Canadian Human Rights Act.
• Biased output does not include content or decisions intended to prevent or eliminate disadvantages suffered by a group based on prohibited grounds.
• Confidential business information means business information that is not publicly available, for which the person has taken measures to ensure it remains not publicly available.
• The information has actual or potential economic value to the person or their competitors because it is not publicly available and its disclosure would result in a material financial loss to the person or a material financial gain to their competitors.
• Harm means physical or psychological harm to an individual, damage to an individual's property, or economic loss to an individual.
• High-impact system means an artificial intelligence system that meets the criteria that are established in regulations.
• Regulated activity means processing or making available data relating to human activities for the purpose of designing, developing, or using an artificial intelligence system or designing, developing, or making available for use an artificial intelligence system or managing its operations.

Person Responsible

• A person is responsible for an artificial intelligence system, including a high-impact system, if they design, develop, or make available for use the artificial intelligence system or manage its operation.
• The trade must be in the course of international or interprovincial trade and commerce.

Anonymized Data

• A person who carries out any regulated activity and who processes or makes available for use anonymized data in the course of that activity must establish measures with respect to the manner in which data is anonymized and the use or management of anonymized data.

Assessment - High-Impact System

• A person responsible for an artificial intelligence system must assess whether it is a high-impact system.
• Assessment must be done in accordance with the regulations.

Measures Related to Risks

• A person responsible for a high-impact system must establish measures to identify, assess, and mitigate the risks of harm or biased output that could result from the use of the system.
• Measures must be done in accordance with the regulations.

Monitoring of Mitigation Measures

• A person responsible for a high-impact system must establish measures to monitor compliance with the mitigation measures they are required to establish and the effectiveness of those mitigation measures.
• Measures must be done in accordance with the regulations.

Keeping General Records

• A person who carries out any regulated activity must keep records describing the measures they establish and the reasons supporting their assessment.
• The person must, in accordance with the regulations, keep any other records in respect of the requirements that apply to them.

Publication of Description — Making System Available for Use

• A person who makes available for use a high-impact system must publish on a publicly available website a plain-language description of the system.
• The plain-language description of the system that includes an explanation of how the system is intended to be used, the types of content that it is intended to generate and the decisions, recommendations, or predictions that it is intended to make, the mitigation measures established in respect of it; and any other information that may be prescribed by regulation.
• Publication in the time and manner that may be prescribed by regulation.

Publication of Description — Managing Operation of System

• A person who manages the operation of a high-impact system must publish on a publicly available website a plain-language description of the system.
• The plain-language description of the system that includes an explanation of how the system is used, the types of content that it generates and the decisions, recommendations, or predictions that it makes, the mitigation measures established in respect of it; and any other information that may be prescribed by regulation.
• Publication in the time and manner that may be prescribed by regulation.

Notification of Material Harm

• A person who is responsible for a high-impact system must, as soon as feasible, notify the Minister if the use of the system results or is likely to result in material harm.
• Notification must be done in accordance with the regulations

Ministerial Orders

• The Minister may, by order, require that a person provide the Minister with any of the records referred to in that subsection.
• The Minister may, by order, require that a person provide the Minister with any of the records that relate to that system.

Audit

• If the Minister has reasonable grounds to believe that a person has contravened any of sections 6 to 12 or an order made under section 13 or 14, the Minister may, by order, require that the person conduct an audit.
• The audit may be with respect to the possible contravention or engage the services of an independent auditor to conduct the audit.
• The audit must be conducted by a person who meets the qualifications that are prescribed by regulation.
• If the audit is conducted by an independent auditor, the person who is audited must give all assistance that is reasonably required to enable the auditor to conduct the audit.
• Assistance includes providing any records or other information specified by the auditor.
• The person who is audited must provide the Minister with the audit report.
• The cost of the audit is payable by the person who is audited.

Implementation of Measures

• The Minister may, by order, require that a person who has been audited implement any measure specified in the order to address anything referred to in the audit report.

Cessation

• The Minister may, by order, require that any person who is responsible for a high-impact system cease using it or making it available for use if the Minister has reasonable grounds to believe that the use of the system gives rise to a serious risk of imminent harm.
• The order is exempt from the application of sections 3 and 9 of the Statutory Instruments Act.

Publication

• The Minister may, by order, require that a person publish on a publicly available website, any information related to any of those sections.
• The Minister is not permitted to require that the person disclose confidential business information.
• The person must publish the information in accordance with any regulations

Compliance

• A person who is the subject of an order made by the Minister must comply with the order.

Filing

• The Minister may file a certified copy of an order made in the Federal Court.
• On the certified copy being filed, the order becomes and may be enforced as an order of the Federal Court.

Statutory Instruments Act

• An order made is not a statutory instrument as defined in subsection 2(1) of the Statutory Instruments Act.

Confidential Nature Maintained

• Confidential business information that is obtained by the Minister does not lose its confidential nature.

Obligation of Minister

• The Minister must take measures to maintain the confidentiality of any confidential business information that the Minister obtains.

Disclosure of Confidential Business Information — Subpoena, Warrant, etc.

• The Minister may disclose confidential business information for the purpose of complying with a subpoena or warrant issued or order made by a court.
• May disclose information for the purpose of complying with rules of court relating to the production of information.

Disclosure of Information - Analyst

• The Minister may disclose any information that is obtained to an analyst designated.
• The Minister may impose any condition on the analyst in order to protect the confidentiality of information that the Minister discloses.
• An analyst must maintain the confidentiality of information disclosed to them and may use the information only for the administration and enforcement of this Part.

Disclosure of Information - Others

• The Minister may disclose any information obtained to the Privacy Commissioner, the Canadian Human Rights Commission, the Commissioner of Competition, the Canadian Radio-television and Telecommunications Commission, any person appointed by the government of a province, or any provincial entity, with powers, duties, and functions that are similar to those of the Privacy Commissioner or the Canadian Human Rights Commission or any other person or entity prescribed by regulation.

Restriction

• The Minister may disclose personal information or confidential business information only if the Minister is satisfied that the disclosure is necessary for the purposes of enabling the recipient to administer or enforce the Act in question and the recipient agrees in writing to maintain the confidentiality of the information except as necessary for any of those purposes.
• The recipient may use the disclosed information only for the purpose of the administration and enforcement of the Act in question.

Publication of Information - Contravention

• If the Minister considers that it is in the public interest to do so, the Minister may publish information about any contravention.
• The Minister is not permitted to publish confidential business information under subsection (1).

Publication of Information - Harm

• Without the consent of the person to whom the information relates and without notifying that person, the Minister may publish information that relates to an artificial intelligence system if the Minister has reasonable grounds to believe that the use of the system gives rise to a serious risk of imminent harm and the publication of the information is essential to prevent the harm.

Administrative Monetary Penalties

• A person who is found under the regulations to have committed a violation is liable to the administrative monetary penalty established by the regulations.
• The purpose of an administrative monetary penalty is to promote compliance and not to punish.

Violation or Offence

• If an act or omission may be proceeded with as a violation or as an offence, proceeding with it in one manner precludes proceeding with it in the other.

Regulations

• The Governor in Council may make regulations respecting an administrative monetary penalties scheme.

Offences

• Every person who contravenes any of sections 6 to 12 is guilty of an offence.
• Every person who carries out a regulated activity is guilty of an offence if the person obstructs or provides false or misleading information.

Punishment

• A person who commits an offence is liable, on conviction on indictment
• A person who commits an offence is liable, on summary conviction.
• A person is not to be found guilty of an offence if they establish that they exercised due diligence to prevent the commission of the offence.
• It is sufficient proof of an offence to establish that it was committed by an employee, agent, or mandatary of the accused.

Administration

• The Governor in Council may, by order, designate any member of the Queen's Privy Council for Canada to be the Minister for the purposes of this Part.

General Powers of Minister

• The Minister may promote public awareness of this Act and provide education with respect to it.
• May make recommendations and cause to be prepared reports on the establishment of measures to facilitate compliance with this Part; and establish guidelines with respect to compliance with this Part.

Artificial Intelligence and Data Commissioner

• The Minister may designate a senior official of the department to be called the Artificial Intelligence and Data Commissioner.
• The role is to assist the Minister in the administration and enforcement of this Part.
• The Minister may delegate to the Commissioner any power, duty, or function conferred on the Minister except the power to make regulations.

Analysts

• The Minister may designate any individual or class of individuals as analysts for the administration and enforcement of this Part.

Advisory Committee

• The Minister may establish a committee to provide the Minister with advice on any matters related to this Part.
• The Minister may cause the advice that the committee provides to the Minister to be published on a publicly available website.

Remuneration and Expenses

• Each committee member is to be paid the remuneration fixed by the Governor in Council.
• Entitled to the reasonable travel and living expenses that they incur while performing their duties away from their ordinary place of residence.

Regulations — Governor in Council

• The Governor in Council may make regulations for the purposes of this Part.

Regulations – Minister

• The Minister may make regulations respecting the records required to be kept under section 10.

Possession or Use of Personal Information

• Every person commits an offence if, for the purpose of designing, developing, using, or making available for use an artificial intelligence system, the person possesses or uses personal information knowing or believing that the information is obtained as a result of the commission in Canada of an offence under an Act of Parliament or a provincial legislature.

Making System Available for Use

• Every person commits an offence if the person makes the artificial intelligence system available knowing that, or being reckless as to whether, the use of an artificial intelligence system is likely to cause serious physical or psychological harm to an individual and the use of the system causes such harm.
• Every person commits an offence if the person makes an artificial intelligence system available with intent to defraud the public and to cause substantial economic loss to an individual.

Order in Council

• The provisions of this Act come into force on a day or days to be fixed by order of the Governor in Council.