Personal Information Protection and Electronic Documents Act

So just based on the comment you just made that its inherent trade is survival, what should the government be doing in regards to the news that we've heard over the last many months, including coming from CEOs that run these AI companies to even what we've seen this week with the banks? I mean, what should the policy and government response be to this?

No, I mean, they should be looking at all of their legislation pertaining to both technology and the finance sector and asking themselves, is that legislation still relevant as AI agents increasingly take over what has always been a very manual kind of workflow? And so, for example, they've introduced changes to our privacy legislation that would update the existing law, which is known as PIPEDA, and kind of bring it more into the modern era.

But it doesn't explicitly talk about AI agents and the automations and the risks to privacy that we are now exposed to because of the increasing popularity of these technologies.

So government really needs to take a fine-tooth comb to a wide range of legislation and vet it, filter it for relevance.

So that's an important part of it.

My colleague, Michael, suggested that we put in a blocking statute into PIPEDA, which is the privacy legislation for business industry.

And that would be analogous to what Switzerland does.

They get a lot of requests for their banking data and it creates a conflict of law.

What we're looking at here is just regulatory guidance.

The Code sets out the Privacy Commissioner's interpretation of how Canada's existing private sector privacy law, PIPEDA, applies when businesses collect, use, and disclose children's personal information.

Now, PIPEDA is the Personal Information Protection and Electronic Documents Act, and it's been Canada's federal private sector privacy law since 2001.

That law establishes broad principles covering consent, appropriate purposes, limits on collection, safeguards, access to personal information, and accountability.

But PIPEDA actually doesn't really distinguish at all between adults and children, and it doesn't contain a special set of children's privacy rights.

So the commissioner has taken existing legal requirements and through his lens has developed guidance for applying them to young people.

This is significant, but we need to understand its limitations.

For example, the code repeatedly says organizations must do certain things.

That's a YouTube channel.

Yeah, I was going to say, go back and listen to some of the earliest podcasts where we did a breaking news one on China and we wound up in a knockdown drag out fight on PIPL versus PIPA and HIPAA and PIPEDA.

And yeah, it's amusing.

We should resurrect that one.

Now here's the larger conversation I'd invite all of you to join.

In regulations like PIPEDA, which is the Canadian Personal Information Protection and Electronic Documents Act, it's built on consent.

If your agent is building a profile of your sister from your messages, your sister never consented to that.

And every one of these agents runs on a computer in a U.S. data center.

I've covered, you know, privacy laws in the past decade or so.

There was a new law called PIPEDA, which is protection of information or paper and electronic documents act or something like that.

Anyway, they can pass the law, but there's no way to enforce it unless they have what's called regulations.

And so when they put the implementation together, they call that a regulation, and that's what everybody has to comply with.