Serves under-18s, in Canada

S.C. 2000, c. 5, Part 1 · Read the law's page

• Obtain knowing, meaningful consent before collecting, using or disclosing personal information, and limit collection to what a reasonable person would consider appropriate for the stated purpose.
• Comply with the ten Schedule 1 fair information principles, including limiting use and disclosure to the purposes for which information was collected and keeping it only as long as necessary.
• Remain accountable for personal information transferred to a third party for processing, in Canada or abroad, and use contractual or other means to ensure a comparable level of protection.
• Give individuals access to their own personal information on request and a way to challenge the organization's compliance with these obligations.

S.C. 2000, c. 5, ss. 10.1-10.3 · Read the law's page

• Report any breach of security safeguards involving personal information under the organization's control to the Privacy Commissioner as soon as feasible, if it is reasonable to believe the breach creates a real risk of significant harm to an individual.
• Notify each affected individual directly, in a conspicuous form, with enough information to let them understand the significance of the breach and take steps to reduce or mitigate the resulting harm.

Bill C-34, An Act to enact the Digital Safety Act and the Digital Safety Commission of Canada Act and to make consequential amendments to other Acts, 45th Parliament, 1st Session, ss. 37, 53(a) · Read the law's page

• Would require the operator of a regulated social media service, to the extent that it is reasonable for the operator to do so, to implement adequate measures to label, as synthetic content, any synthetic content accessible on the service that meets the criteria set by regulation.
• Would require a regulated AI chatbot service to implement measures adequate to mitigate the risk of the chatbot posing as a human being or otherwise being deceptive about being an artificial intelligence system.

Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, 45th Parliament, 1st Session · Read the law's page

• Would require organizations to be transparent about their use of automated decision making for significant decisions about individuals, set higher standards for handling children's information, and obtain meaningful consent supported by plain-language explanations.