SUBSCRIBE! Sign up for our daily newsletter and never miss a story!

The right to data portability and mobility is included among a dozen recommendations from the privacy comissioner's office. Rawpixelimages/Dreamstime.com

Alberta privacy head recommends changes to PIPA on AI, ‘right to be forgotten’ and more

Jun 13, 2024 | 3:14 PM

Alberta’s information and privacy commissioner’s office on Thursday made a series of key recommendations to strengthen a law that is described as critical to the advancement of the province’s interests in the information and digital economy.

The recommendations focus on the need to update legislation to protect privacy in the midst of vast and fast-moving changes in the handling of information around the world.

Officials with the OIPC say they have provided a comprehensive submission to the Alberta legislature’s Standing Committee on Resource Stewardship as part of the committee’s review of the Personal Information Protection Act, known as PIPA, which is more than two decades old.

Officials said PIPA applies primarily to private sector organizations, providing individuals with the right to request access to their own personal information while also setting a framework for private sector organizations to collect, use and disclose personal information.

Information and Privacy Commissioner Diane McLeod said the proposed changes come at “a crucial time.”

“Since PIPA came into force in January 2004, the state of technology and the amount of personal information shared by individuals with organizations has changed monumentally,” McLeod said in a statement.

“In the early 2000s, less than seven per cent of the world was online. By 2020, this had increased to more than 50 per cent.”

“Dramatically expanded use of cell phones, apps, social media and online shopping has created a world in which technology touches everything we do.”

MacLeod said artificial intelligence, or AI, also plays a role in modern challenges.

Officials say the OIPC submission also describes the impact of generative AI and quantum computing, noting that these technological changes have immense potential benefits for societies, but also great potential for harm.

Amongst other things, the OIPC’s key recommendations are that PIPA should include:

  • recognition of the protection of personal information as a fundamental human right;
  • application to political parties and not-for-profit organizations;
  • the right of Albertans to access their own personal information;
  • the “right to be forgotten”;
  • the right to data portability and mobility;
  • rules about automated decision-making, including that individuals be granted the right to contest automated decision-making;
  • specific protection for children’s personal information;
  • specific requirements for privacy management programs and privacy impact assessments, and modifications regarding mandatory breach notification;
  • requirements for compliance by service providers and downstream service providers;
  • enhanced requirements for organizations to use security safeguards to protect personal information commensurate with its sensitivity;
  • requirements for communication in plain language;
  • requirements for de-identification and anonymization of personal information;
  • provisions for the creation and use of a regulatory sandbox operated by the OIPC; and
  • enhanced provisions for enforcement of PIPA.

The public is invited to read the OIPC submission on PIPA in its entirety. It is available online on the OIPC website here.