Trains models, in Canada
Each law's tag says when it binds: since in force proposed proposed
Personal Information Protection and Electronic Documents Act (PIPEDA) — AI Training Data and Automated Decisionssince 3 lines
Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5; enforced by the Office of the Privacy Commissioner of Canada; provincial equivalents: Personal Information Protection Act (Alberta), S.A. 2003, c. P-6.5; Personal Information Protection Act (British Columbia), S.B.C. 2003, c. 63
- In the course of commercial activities in Canada, outside Alberta, British Columbia and Quebec, obtain valid consent before mass scraping of personal data from publicly available websites to train AI models.
- In the course of commercial activities in Canada, outside Alberta, British Columbia and Quebec, be transparent about how your automated systems use personal information.
- Keep AI-based profiling free of discriminatory outcomes, which can create liability under the Canadian Human Rights Act.
Personal Information Protection and Electronic Documents Act (PIPEDA), scraped personal datasince 2 lines
S.C. 2000, c. 5, Part 1 · Read the law's page
- Do not assume a public web page's personal information falls outside PIPEDA merely because it was publicly accessible; the no-consent carve-out applies only to information specified as publicly available by regulation.
- Apply PIPEDA's purpose-limitation and accountability obligations to personal information collected by crawling, the same as personal information collected any other way.
Copyright Act, fair dealingsince 1 line
R.S.C., 1985, c. C-42, s. 29 · Read the law's page
- A use of a copyrighted work must fall within an enumerated fair-dealing purpose (research, private study, education, parody or satire, or another statutory dealing elsewhere in the Act) to avoid infringement; collecting or reproducing text to train a generative model is not itself an enumerated purpose.
Copyright Act, Circumvention of Technological Protection Measures (sections 41 to 41.21 and 42(3.1))since 2 lines
R.S.C., 1985, c. C-42, ss. 41 to 41.21 · Read the law's page
- Do not circumvent a technological protection measure that controls access to a work, a performer's performance fixed in a sound recording or a sound recording and whose use is authorized by the copyright owner, by descrambling or decrypting the work or otherwise avoiding, bypassing, removing, deactivating or impairing the measure, unless you have the authority of the copyright owner or a statutory exception applies.
- Do not offer or provide services to the public primarily for the purposes of circumventing a technological protection measure, and do not manufacture, import, distribute, offer for sale or rental or provide a technology, device or component designed or produced primarily for that purpose.
Bill C-36, Protecting Privacy and Consumer Data Actproposed1 line
Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, 45th Parliament, 1st Session · Read the law's page
- Would require organizations to be transparent about their use of automated decision making for significant decisions about individuals, set higher standards for handling children's information, and obtain meaningful consent supported by plain-language explanations.
Criminal Code, unauthorized use of a computerin force2 lines
R.S.C., 1985, c. C-46, s. 342.1 · Read the law's page
- Do not obtain a computer service, or cause a function of a computer system to be intercepted, fraudulently and without colour of right.
- Do not use, possess, traffic in, or permit another person to have access to a computer password to commit either of the above.