Protection of Privacy Act, automated-system notice and decision accuracy duties of public bodies
Protection of Privacy Act, S.A. 2024, c. P-28.5, ss. 5 (2), 6
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://kings-printer.alberta.ca/documents/Acts/P28P5.pdfIn force since .
An AI risk obligations rule binding government bodies.
- Enforcement body
- Information and Privacy Commissioner of Alberta
- Obligation class
- Disclosure, Governance, Retention
As of .
What it requires
- These duties bind a public body, and the Act applies to personal information collected, used or disclosed by a public body.
- When you collect personal information that must be collected directly from the individual, give the individual notice at the time of collection of the purpose of the collection, the specific legal authority for it, contact information for questions, and your intention, if any, at that time to input the information into an automated system to generate content or make decisions, recommendations or predictions. Section 5(3) and (4) state the exceptions.
- If you will use an individual's personal information to make a decision that directly affects the individual, including a decision made using an automated system, make every reasonable effort to ensure that the information is accurate and complete.
- Retain that information for at least one year after using it so the individual has a reasonable opportunity to obtain access to it, or for any shorter period agreed in writing by the individual, the public body and, if different, the body that approves your records retention and disposition schedule.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 60(1)(a) makes it an offence to knowingly collect, use or disclose personal information in contravention of Part 1, which contains sections 5 and 6, and section 60(2) sets the fine.
Penalty structure
Section 60(2) sets the fine for an offence under section 60(1)(a) at not more than $750,000 for a person other than an individual and not more than $125,000 for an individual.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 750,000
What this law does
The Act applies to all personal information collected, used or disclosed by a public body. A public body must collect personal information directly from the individual the information is about unless the Act lists an exception.
A public body that collects personal information that is required to be collected directly from the individual must give notice to the individual, at the time of collection, of the purpose of the collection, the specific legal authority for it, contact information for questions, and the public body's intention, if any, at that time to input the information into an automated system to generate content or make decisions, recommendations or predictions.
The notice duty does not apply if, in the opinion of the head of the public body, it could reasonably be expected that the information collected would be inaccurate. It also does not apply where the public body previously gave the notice and continues to collect personal information from that individual for the same purpose and under the same specific legal authority.
If an individual's personal information will be used by a public body to make a decision that directly affects the individual, including a decision made using an automated system, the public body must make every reasonable effort to ensure that the information is accurate and complete.
It must also retain the information for at least one year after using it so the individual has a reasonable opportunity to obtain access to it, or for any shorter period agreed in writing by the individual, the public body and, if different, the body that approves the records retention and disposition schedule. The Act came into force on , on the coming into force of the Access to Information Act.
A person who knowingly collects, uses or discloses personal information in contravention of Part 1 is guilty of an offence. That offence is punishable by a fine of not more than $125,000 for an individual and not more than $750,000 for any other person.
When LexLint raises it
When your app profile says your app generates content with AI or makes high-risk automated decisions.