Operates a social platform, in Canada

S.C. 2000, c. 5, Part 1 · Read the law's page

• Obtain knowing, meaningful consent before collecting, using or disclosing personal information, and limit collection to what a reasonable person would consider appropriate for the stated purpose.
• Comply with the ten Schedule 1 fair information principles, including limiting use and disclosure to the purposes for which information was collected and keeping it only as long as necessary.
• Remain accountable for personal information transferred to a third party for processing, in Canada or abroad, and use contractual or other means to ensure a comparable level of protection.
• Give individuals access to their own personal information on request and a way to challenge the organization's compliance with these obligations.

2017 SCC 33, [2017] 1 SCR 751

• Do not assume a forum selection clause in consumer terms of use will be enforced against a Canadian consumer: four of the seven justices of the Supreme Court of Canada held Facebook's clause, which users accept by clicking, unenforceable against a British Columbia resident suing under the Privacy Act.
• Treat the gross inequality of bargaining power between a company and an individual consumer, and the nature of the rights the claim involves, as circumstances a court weighs against enforcing such a clause: three justices held so in joint reasons, and the burden stays on the consumer to show strong cause.

2017 SCC 34, [2017] 1 SCR 824

• If you run a search engine or another service that lists or links to third-party websites, comply with a Canadian court's interlocutory order to stop listing the websites it names, even though you are not a party to the underlying lawsuit: the Supreme Court of Canada held that injunctive relief can be ordered against someone who is not a party.
• Apply the order to your search results worldwide when the order is worldwide: the Court held that a court with in personam jurisdiction can grant an injunction enjoining a person's conduct anywhere in the world where that is necessary to ensure the injunction's effectiveness, and upheld an order covering all of Google's search results.
• Do not read such an order as a finding of liability or a monitoring duty: the Court held that the injunction does not require Google to monitor content on the Internet and is not a finding of any sort of liability against Google for facilitating access to the impugned websites.
• If complying with the order would require you to violate the law of another jurisdiction, apply to the issuing court to vary it: the Court noted that Google was free to apply to the British Columbia courts and had made no such application.

S.C. 2000, c. 5, ss. 10.1-10.3 · Read the law's page

• Report any breach of security safeguards involving personal information under the organization's control to the Privacy Commissioner as soon as feasible, if it is reasonable to believe the breach creates a real risk of significant harm to an individual.
• Notify each affected individual directly, in a conspicuous form, with enough information to let them understand the significance of the breach and take steps to reduce or mitigate the resulting harm.

Bill C-34, An Act to enact the Digital Safety Act and the Digital Safety Commission of Canada Act and to make consequential amendments to other Acts, 45th Parliament, 1st Session · Read the law's page

• The Digital Safety Act would cover social media services and public chatbots and other online services designated under it, and would establish the Digital Safety Commission of Canada.
• If the Governor in Council specifies your regulated social media service by regulation, implement age-verification or age-estimation measures that prevent a person under 16 from having an account with it, unless the Digital Safety Commission of Canada exempts you on application after finding adequate safeguards for the protection of children.

Bill C-34, An Act to enact the Digital Safety Act and the Digital Safety Commission of Canada Act and to make consequential amendments to other Acts, 45th Parliament, 1st Session, ss. 37, 53(a) · Read the law's page

• Would require the operator of a regulated social media service, to the extent that it is reasonable for the operator to do so, to implement adequate measures to label, as synthetic content, any synthetic content accessible on the service that meets the criteria set by regulation.
• Would require a regulated AI chatbot service to implement measures adequate to mitigate the risk of the chatbot posing as a human being or otherwise being deceptive about being an artificial intelligence system.

Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, 45th Parliament, 1st Session · Read the law's page

• Would require organizations to be transparent about their use of automated decision making for significant decisions about individuals, set higher standards for handling children's information, and obtain meaningful consent supported by plain-language explanations.