[syndicated profile] michaelgeistsblog_feed

Posted by Michael Geist

Image

Earlier this month, the government quietly released a “what we heard” report this discussing the response to its 30-day sprint AI consultation from last October. The consultation was promoted as giving Canadians – including a 28 person expert advisory board – the chance to provide their views on AI as the AI Minister Evan Solomon works toward a national AI strategy. The consultation garnered some criticism for its speed and missing perspectives on the expert panel.  More recently on the use of AI to assess the results have sparked further doubts about it.

Jaxson Khan is the CEO and Founder of Aperature AI and a Senior Fellow at the Munk School of Global Affairs and Public Policy at the University of Toronto. But before that, he served as Senior Policy Advisor the Minister of Innovation Science and Industry, where AI was one of his lead responsibilities. Jaxson joins the Law Bytes podcast to provide an insider perspective on AI policy development along with his thoughts on the AI consultation and its results.

The podcast can be downloaded here, accessed on YouTube, and is embedded below. Subscribe to the podcast via Apple Podcast, Spotify or the RSS feed. Updates on the podcast on X/Twitter at @Lawbytespod.

Credits:

Hon. Evan Solomon, Minister of AI speech at 2025 Women in AI Summit & Awards North America, Women in AI Awards, October 17, 2025

The post The Law Bytes Podcast, Episode 258: Jaxson Khan With an Insider Perspective on AI Policy Development in Canada appeared first on Michael Geist.

[syndicated profile] michaelgeistsblog_feed

Posted by Michael Geist

Image

Just weeks after last year’s election, Mark Carney’s government committed not one, but two privacy blunders in rapid succession. First, Bill C-2 – literally the first substantive bill of the new government – buried lawful access provisions in an omnibus “border measures” bill that would have established unprecedented warrantless access to the personal of information of Canadians. Second, days later it introduced Bill C-4, which was framed as affordability measures bill but included provisions that exempt political parties from the application of privacy protections. The bizarre assault on privacy felt like an opportunistic attempt to insert unpopular rules in the hope that few were paying attention. The strategy was failure: the government ultimately introduced a new border measures bill with lawful access removed (new lawful access rules are expected in their own bill this year) and now a Senate committee which studied the Bill C-4 privacy rules has recommended that they be killed, removed from the bill, or subject to a two-year sunset clause.

The Senate recommendation and Bill C-4 is finally getting some attention after months of privacy advocates raising alarm bells. The bill would leave political parties subject to weaker privacy rules than virtually any other major organization in Canada that collects personal data. Instead of enforceable statutory obligations backed by independent oversight, the government proposes relying primarily on internal privacy policies drafted and administered by the parties themselves. There is no comparable enforcement regime, no equivalent compliance structure to that faced by the private sector, and no meaningful external accountability mechanism.

Moreover, Bill C-4 is deemed to be in force as May 31, 2000, meaning that it would retroactively exempt the parties from any privacy violations that may date back decades. The ostensible reason for the provisions is a B.C. case that applied provincial privacy law to federal political parties. The government is now seeking to render that case moot and provide all political parties with an effective exemption from any privacy laws other than measures found in the Elections Act.

This is not the first time the government has tried to exempt political parties from standard privacy laws. Bill C-65, which failed in the last Parliament, contained similar provisions. However, the provisions were in a bill on the Elections Act, not buried among tax measures. Moreover, the previous approach was stronger. It included measures to address data breaches and the requirement to notify affected individuals as well as certain restrictions, including the sale of personal information. This iteration removes the data breach notification requirements and drops the sale restrictions. Oddly, the government’s Charter statement for the bill found no Charter issues despite the fact that Bill C-65 statement raised multiple issues worthy of analysis.

The government had seemingly little interest in defending the indefensible. The House of Commons Standing Committee on Finance wrapped up its study of the bill last November and incredibly refused to hear from any witnesses that would speak to the issue. In fact, despite concerns raised in briefs from the Privacy Commissioner of Canada and the Commissioner of Elections, the committee (consisting almost entirely of Liberal and Conservative MPs) limited its discussion of an entire section of the bill to a thirty second description of the provisions from a government official. No witnesses, no debate, no acknowledgement of concerns raised by experts. It was as if the provisions did not exist.

That changed last week once the bill made it to the Senate. The Senate Standing Committee on Legal and Constitutional Affairs decided to tackle the issue with a range of witnesses and invitations to submit briefs (I submitted one posted here). The resulting recommendation arrived swiftly: remove the provisions entirely, split them into separate legislation for proper study, or allow them to pass only with a sunset clause requiring future reconsideration.

The committee’s recommendations will now move to another committee and potentially the full Senate. If senators adopt amendments removing or separating the privacy provisions, the bill would need to return to the House of Commons, delaying the entire legislative package. The government would no doubt like to fast track Bill C-4 and avoid any delays. But with the political party self-interest evident to all, it is time to fix the privacy blunder from the early days of the Carney government. Kill the privacy provisions in Bill C-4 and start fresh with a targeted bill that creates a genuine privacy law framework applicable to political parties in Canada.

The post Time for the Government to Fix Its Political Party Privacy Blunder: Kill Bill C-4’s Disastrous Privacy Rules appeared first on Michael Geist.

denise: Image: Me, facing away from camera, on top of the Castel Sant'Angelo in Rome (Default)
[staff profile] denise posting in [site community profile] dw_news
Back in August of 2025, we announced a temporary block on account creation for users under the age of 18 from the state of Tennessee, due to the court in Netchoice's challenge to the law (which we're a part of!) refusing to prevent the law from being enforced while the lawsuit plays out. Today, I am sad to announce that we've had to add South Carolina to that list. When creating an account, you will now be asked if you're a resident of Tennessee or South Carolina. If you are, and your birthdate shows you're under 18, you won't be able to create an account.

We're very sorry to have to do this, and especially on such short notice. The reason for it: on Friday, South Carolina governor Henry McMaster signed the South Carolina Age-Appropriate Design Code Act into law, with an effective date of immediately. The law is so incredibly poorly written it took us several days to even figure out what the hell South Carolina wants us to do and whether or not we're covered by it. We're still not entirely 100% sure about the former, but in regards to the latter, we're pretty sure the fact we use Google Analytics on some site pages (for OS/platform/browser capability analysis) means we will be covered by the law. Thankfully, the law does not mandate a specific form of age verification, unlike many of the other state laws we're fighting, so we're likewise pretty sure that just stopping people under 18 from creating an account will be enough to comply without performing intrusive and privacy-invasive third-party age verification. We think. Maybe. (It's a really, really badly written law. I don't know whether they intended to write it in a way that means officers of the company can potentially be sentenced to jail time for violating it, but that's certainly one possible way to read it.)

Netchoice filed their lawsuit against SC over the law as I was working on making this change and writing this news post -- so recently it's not even showing up in RECAP yet for me to link y'all to! -- but here's the complaint as filed in the lawsuit, Netchoice v Wilson. Please note that I didn't even have to write the declaration yet (although I will be): we are cited in the complaint itself with a link to our August news post as evidence of why these laws burden small websites and create legal uncertainty that causes a chilling effect on speech. \o/

In fact, that's the victory: in December, the judge ruled in favor of Netchoice in Netchoice v Murrill, the lawsuit over Louisiana's age-verification law Act 456, finding (once again) that requiring age verification to access social media is unconstitutional. Judge deGravelles' ruling was not simply a preliminary injunction: this was a final, dispositive ruling stating clearly and unambiguously "Louisiana Revised Statutes §§51:1751–1754 violate the First Amendment of the U.S. Constitution, as incorporated by the Fourteenth Amendment of the U.S. Constitution", as well as awarding Netchoice their costs and attorney's fees for bringing the lawsuit. We didn't provide a declaration in that one, because Act 456, may it rot in hell, had a total registered user threshold we don't meet. That didn't stop Netchoice's lawyers from pointing out that we were forced to block service to Mississippi and restrict registration in Tennessee (pointing, again, to that news post), and Judge deGravelles found our example so compelling that we are cited twice in his ruling, thus marking the first time we've helped to get one of these laws enjoined or overturned just by existing. I think that's a new career high point for me.

I need to find an afternoon to sit down and write an update for [site community profile] dw_advocacy highlighting everything that's going on (and what stage the lawsuits are in), because folks who know there's Some Shenanigans afoot in their state keep asking us whether we're going to have to put any restrictions on their states. I'll repeat my promise to you all: we will fight every state attempt to impose mandatory age verification and deanonymization on our users as hard as we possibly can, and we will keep actions like this to the clear cases where there's no doubt that we have to take action in order to prevent liability.

In cases like SC, where the law takes immediate effect, or like TN and MS, where the district court declines to issue a temporary injunction or the district court issues a temporary injunction and the appellate court overturns it, we may need to take some steps to limit our potential liability: when that happens, we'll tell you what we're doing as fast as we possibly can. (Sometimes it takes a little while for us to figure out the exact implications of a newly passed law or run the risk assessment on a law that the courts declined to enjoin. Netchoice's lawyers are excellent, but they're Netchoice's lawyers, not ours: we have to figure out our obligations ourselves. I am so very thankful that even though we are poor in money, we are very rich in friends, and we have a wide range of people we can go to for help.)

In cases where Netchoice filed the lawsuit before the law's effective date, there's a pending motion for a preliminary injunction, the court hasn't ruled on the motion yet, and we're specifically named in the motion for preliminary injunction as a Netchoice member the law would apply to, we generally evaluate that the risk is low enough we can wait and see what the judge decides. (Right now, for instance, that's Netchoice v Jones, formerly Netchoice v Miyares, mentioned in our December news post: the judge has not yet ruled on the motion for preliminary injunction.) If the judge grants the injunction, we won't need to do anything, because the state will be prevented from enforcing the law. If the judge doesn't grant the injunction, we'll figure out what we need to do then, and we'll let you know as soon as we know.

I know it's frustrating for people to not know what's going to happen! Believe me, it's just as frustrating for us: you would not believe how much of my time is taken up by tracking all of this. I keep trying to find time to update [site community profile] dw_advocacy so people know the status of all the various lawsuits (and what actions we've taken in response), but every time I think I might have a second, something else happens like this SC law and I have to scramble to figure out what we need to do. We will continue to update [site community profile] dw_news whenever we do have to take an action that restricts any of our users, though, as soon as something happens that may make us have to take an action, and we will give you as much warning as we possibly can. It is absolutely ridiculous that we still have to have this fight, but we're going to keep fighting it for as long as we have to and as hard as we need to.

I look forward to the day we can lift the restrictions on Mississippi, Tennessee, and now South Carolina, and I apologize again to our users (and to the people who temporarily aren't able to become our users) from those states.

Profile

deane: (Default)
deane

April 2014

S M T W T F S
  12345
6789101112
13141516171819
20212223242526
27282930   
Progressive Bloggers

Most Popular Tags

Style Credit

Expand Cut Tags

No cut tags