Office Of The Information And Privacy Commissioner Of Ontario Releases 2022 Annual Report And Urges Province To Implement AI Framework

On June 7, 2023, the Office of the Information and Privacy Commissioner of Ontario (IPC) released its 2022 annual report, The Vision of a Modern and Effective Regulator (the Report), where it included among its recommendations, a call for the Ontario government to implement a robust framework to govern the use of artificial intelligence (AI) technologies.

The Report summarizes the IPC’s activities and accomplishments during 2022 and provides recommendations for Ontario’s information and privacy framework going forward. As part of these recommendations, the IPC takes the position that despite having the potential to improve public safety and bolster our economy, guardrails are needed for AI technologies to not cross legal, social and ethical lines. The Report states that a comprehensive legal or policy framework is required to govern public and private sector use of AI “within clear and transparent boundaries that align with Ontarians’ rights and values”. 

The Report also includes recommendations on topics such as:

• Digital Identity (ID) Resolution: The IPC maintains that digital ID systems should be optional and equitably accessible to all; only collect, use, or share the minimum amount of personal information needed; be secured from identity theft, fraud, or other harms; and not be used to create central databases.  Governments and organizations should also be held accountable for their use of digital ID systems and be subject to independent oversight.
• Ontario Health Data Council and Personal Health Information Protection Act (PHIPA) Reforms: The IPC strongly suggests that the government ensure any change to PHIPA that is meant to increase the sharing of personal health information is counterbalanced by robust accountability and transparency measures.  The IPC also encourages the government to implement already-adopted PHIPA reforms dealing with topics, such as those involving consumer electronic service providers and de-identification standards, by proclaiming such sections into force and adopting the necessary regulations to enable them to come into effect.
• Ongoing Advocacy for Administrative Penalties: The IPC recommends that the government set out the details of PHIPA’s administrative penalty scheme in regulations, thus enabling the IPC to impose monetary penalties.  The IPC advises that it “will apply a proportionate approach to administrative penalties”, adopting different levels of intervention based on the nature and circumstances of the contravention.
• Employee Privacy: The IPC acknowledges that Bill 88, the Working for Workers Act, constituted an important step towards increasing transparency of electronic monitoring practices, but recommends that the government go further by requiring greater accountability.  The IPC indicates that electronic workplace monitoring issues should be governed by a more comprehensive Ontario private sector privacy law and urges the government to address the gaps in Ontario’s statutory privacy protections.

For additional information, the full Report can be found here.

Summary By: Steffi Tran