Crawls the web, in Canada

Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5; enforced by the Office of the Privacy Commissioner of Canada; provincial equivalents: Personal Information Protection Act (Alberta), S.A. 2003, c. P-6.5; Personal Information Protection Act (British Columbia), S.B.C. 2003, c. 63

• In the course of commercial activities in Canada, outside Alberta, British Columbia and Quebec, obtain valid consent before mass scraping of personal data from publicly available websites to train AI models.
• In the course of commercial activities in Canada, outside Alberta, British Columbia and Quebec, be transparent about how your automated systems use personal information.
• Keep AI-based profiling free of discriminatory outcomes, which can create liability under the Canadian Human Rights Act.

S.C. 2000, c. 5, Part 1 · Read the law's page

• Do not assume a public web page's personal information falls outside PIPEDA merely because it was publicly accessible; the no-consent carve-out applies only to information specified as publicly available by regulation.
• Apply PIPEDA's purpose-limitation and accountability obligations to personal information collected by crawling, the same as personal information collected any other way.

R.S.C., 1985, c. C-42, s. 29 · Read the law's page

• A use of a copyrighted work must fall within an enumerated fair-dealing purpose (research, private study, education, parody or satire, or another statutory dealing elsewhere in the Act) to avoid infringement; collecting or reproducing text to train a generative model is not itself an enumerated purpose.

R.S.C., 1985, c. C-42, ss. 41 to 41.21 · Read the law's page

• Do not circumvent a technological protection measure that controls access to a work, a performer's performance fixed in a sound recording or a sound recording and whose use is authorized by the copyright owner, by descrambling or decrypting the work or otherwise avoiding, bypassing, removing, deactivating or impairing the measure, unless you have the authority of the copyright owner or a statutory exception applies.
• Do not offer or provide services to the public primarily for the purposes of circumventing a technological protection measure, and do not manufacture, import, distribute, offer for sale or rental or provide a technology, device or component designed or produced primarily for that purpose.

2017 SCC 33, [2017] 1 SCR 751

• Do not assume a forum selection clause in consumer terms of use will be enforced against a Canadian consumer: four of the seven justices of the Supreme Court of Canada held Facebook's clause, which users accept by clicking, unenforceable against a British Columbia resident suing under the Privacy Act.
• Treat the gross inequality of bargaining power between a company and an individual consumer, and the nature of the rights the claim involves, as circumstances a court weighs against enforcing such a clause: three justices held so in joint reasons, and the burden stays on the consumer to show strong cause.

2020 SCC 16, [2020] 2 SCR 118

• Do not assume an arbitration clause in standard form online terms will be enforced against an individual who could not negotiate it: the Supreme Court of Canada held an arbitration clause in Uber's driver services agreement, which required mediation and arbitration in the Netherlands with about US$14,500 in up-front fees, unconscionable and invalid.
• Make the cost, place and governing law of any arbitration clause in standard form terms clear to the person who must accept it: the joint reasons found the clause unconscionable in part because the agreement gave no information about the costs of mediation and arbitration and a person in the driver's position could not be expected to appreciate them.
• Do not rely on an arbitrator to decide a clause's own validity where its fees or location put arbitration out of reach: the joint reasons held a court should not refer a bona fide challenge to the arbitrator if there is a real prospect that doing so would leave the challenge never resolved.

Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, 45th Parliament, 1st Session · Read the law's page

• Would require organizations to be transparent about their use of automated decision making for significant decisions about individuals, set higher standards for handling children's information, and obtain meaningful consent supported by plain-language explanations.

R.S.C., 1985, c. C-46, s. 342.1 · Read the law's page

• Do not obtain a computer service, or cause a function of a computer system to be intercepted, fraudulently and without colour of right.
• Do not use, possess, traffic in, or permit another person to have access to a computer password to commit either of the above.