What’s on our Radar in 2025: Canada’s Privacy and AI Landscape

Canada’s proposed federal reform of existing privacy law and proposed artificial intelligence (“AI”) law has been paused in light of the latest prorogation of Parliament. When Parliament resumes in the spring 2025, critical pieces of tabled legislation could be abandoned, including Bill C-27, which has been long awaited by Canada’s technology sector. Bill C-27 was first introduced in 2021, and was set to replace the Personal Information Protection and Electronic Documents Act (“PIPEDA”), Canada’s current federal private-sector privacy legislation, with the new Artificial Intelligence and Data Act (“AIDA”) and Consumer Privacy Protection Act. Considering the recent prorogation, any anticipated legislative reform from Bill C-27 as drafted is now in legislative limbo. The fate of Bill C-27 is uncertain, disappointingly leaving Canada without any federally regulated AI legislation for the foreseeable future.

However, despite Parliament’s suspension, public sector organizations should be aware of newly introduced legislation in Ontario and Alberta that has created new obligations with respect to both cybersecurity and the use of AI. Further, organizations in Québec now have additional obligations with respect to the use of automated decision systems after the final amendments to An Act to modernize legislative provisions as regards the protection of personal information (“Law 25”)  came into force in the fall of 2024.

Use of AI in the Ontario Public Sector 

Ontario’s Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act, received Royal Assent on November 25, 2024, and has become law. Bill 194 effectively amended Ontario’s Freedom of Information and Protection of Privacy Act (“FIPPA”) and introduced the new Enhancing Digital Security and Trust Act, 2024. Public sector entities in Ontario are now required to provide information to the public on its use of AI systems, take prescribed steps to manage risks associated with the use of AI systems, and both develop and implement an accountability framework with respect to its use of AI systems. Public sector entities in Ontario should also be aware that additional regulations could be introduced that may set certain technical standards respecting the use of AI systems and restrict the use of certain AI technology in the public sector. It is also worth noting that additional regulations may be made specifically related to digital technology affecting individuals under the age of 18. Compliance with Bill 194 should be on every public sector entity’s radar in 2025.

Use of AI in the Alberta Public Sector

Alberta’s Bills 33 and 34 received Royal Assent on December 5, 2024, effectively amending Alberta’s Freedom of Information and Protection of Privacy Act, which is now divided into the Protection of Privacy Act and the Access to Information Act. As a result of these amendments, any public body that wishes to use  an individual’s personal information to make a decision that directly affects the individual, including a decision using an automated system, must: (a) make every reasonable effort to ensure that the information is accurate and complete; and (b) retain the information for at least one (1) year after using it so that the individual has a reasonable period of time to access it, or for any shorter period of time as agreed to in writing by the individual, the public body and any applicable governing body. Further, Bill 33 requires that a public body that collects information directly from an individual must give notice to the individual at the time of collection of the public body’s intention, if any, to enter the data into an automated system to generate content or make decisions, recommendations or predictions.

Use of AI in Québec 

Additionally, organizations operating in the province of Québec have new obligations with respect to the use of AI after the final installment of requirements under Law 25 were implemented in the fall of 2024. Law 25 governs the collection, use and disclosure of personal information in Québec. Law 25 came into force in three installments, notably on September 22, 2022, September 22, 2023, and September 22, 2024, respectively. Entities operating in the province of Québec must now let individuals know when their personal information is used by an automated system to make a decision. As a reminder, entities are also obligated to inform individuals of the personal information that was used by the automated system to make a decision, the factors and criteria used to make the decision and inform the individual of their right to correct the personal information held by the entity.

Notwithstanding federal paralysis, the new provincial laws enacted in Ontario, Alberta and Québec create meaningful obligations on both private and public sector organizations using AI technology into 2025. However, any anticipated federal reform or national regulation of AI technology that would bring Canadian legislation in harmony with other developed nations, is now at a standstill until Parliament resumes. For the time being, without any comprehensive federal AI legislation, regulatory oversight of AI in Canada remains fragmented across provinces.   

Businesses or organizations operating in the AI space in Canada are encouraged to reach out to the Technology and Privacy & Data Management Groups at Torkin Manes LLP with any questions on Canadian compliance.