Categories
Mobile Syrup

Canadian government’s new bill proposes expanded rules on privacy, AI

Innovation, Science and Industry minister François-Philippe Champagne and Justice minister David Lametti introduced the ‘Digital Charter Implementation Act, 2022′ on June 16th to strengthen Canada’s privacy laws, create new rules around artificial intelligence (AI) and more.

The act includes three proposals. First, the proposed Consumer Privacy Protection Act (CPPA) aims to protect Canadians’ privacy by establishing clear rules around how organizations can handle personal information.

Second, the proposed Personal Information and Data Protection Tribunal Act will create a new tribunal to enforce the CPPA.

Finally, the proposed Artificial Intelligence and Data Act (AIDA) will introduce new rules around the development and deployment of AI systems.

The CPPA will help bring Canadian privacy law in line with international partners

In a press release, the government described some of the goals of the CPPA, which will ultimately replace the Personal Information Protection and Electronic Documents Act (PIPEDA) once passed. It’s worth noting that a previous version of the Digital Charter introduced in 2020 was considered a “step back” by Privacy Commissioner Daniel Therrien.

The CPPA will increase control and transparency around how organizations handle Canadians’ personal information. For example, it will require companies provide plain-language information about how they use Canadians’ data so that Canadians can give meaningful consent.

Additionally, the act will give Canadians the freedom to securely move information from one organization to another.

A major focus of the CPPA includes protections for minors, such as limiting the ability of organizations to collect information on minors. The act aims to hold organizations that handle the information of minors to a higher standard. Another part of this focus will be ensuring that Canadians can request that their information be disposed of when it’s no longer needed (parents will be able to make these requests on behalf of minors).

Along with this, the CPPA will enable broad, order-making powers for the Privacy Commissioner of Canada. These powers include the ability to make a company stop collecting data or using personal information.

Finally, the CPPA will establish fines for organizations that fail to comply. Fines can total up to five percent of global revenue or $25 million, whichever is greater, for the most serious offences.

Canada will get an AI and Data Commissioner

One of the main benefits AIDA will introduce will be a new AI and Data Commissioner. That commissioner will support the Minister of Innovation, Science, and Industry in fulfilling the responsibilities of the act. For example, that includes monitoring company compliance, ordering third-party audits, and sharing information with other regulators and enforcers.

AIDA aims to protect Canadians from potential AI harms through the establishment of rules to ensure developing and deploying “high-impact AI systems” mitigates harm and bias. Further, AIDA will outline clear criminal prohibitions and penalties around the use of unlawfully obtained data in AI development, reckless deployment of AI that can pose serious harm, and fraudulent intent to cause substantial economic loss through AI deployment.

The Canadian government has posted details about the Digital Charter Implementation Act on the Innovation, Science, and Economic Development (ISED) website, including text and visual summaries of the bill. You can find that here. Moreover, the full text of the bill will become available later today here, although it’s disappointing the bill was not made available sooner.

You can find the full proposed bill here.

Image credit: Shutterstock

Categories
Mobile Syrup

Sweeping EU tech legislation could force messaging apps to work together

The big news in tech today is that the European Union (EU) reached an agreement on its ‘Digital Markets Act’ (DMA) that aims to “make the digital sector fairer and more competitive.”

Like the EU’s GDPR, the DMA will have wide-reaching impacts, specifically on the world’s biggest tech companies: Google, Apple, Amazon, Meta (Facebook), etc. At least, it will in the EU — Canadians likely won’t be directly impacted, although some of the new regulations in the DMA may have knock-on effects outside Europe (more on this at the end).

To start, let’s dig into some of the biggest changes the DMA brings to tech in Europe.

EU comes for Big Tech

The DMA is set up to target what the EU calls “gatekeepers,” defined as companies controlling one or more core platform services in at least three EU members states. Google’s and Apple’s smartphone app stores are great examples of this since they’re core services available in multiple European countries. However, services like search engines, social networks, cloud services, advertising, voice assistants, web browsers, and more also fall under this umbrella.

Along with the gatekeeper focus, DMA has certain revenue, valuation, and active user thresholds companies need to meet before the regulations take effect. These requirements mean the DMA almost exclusively applies to big tech companies like those mentioned above.

The DMA also outlines punishments for companies that don’t play by the rules. The legislation spells out fines of up to 10 percent of a company’s global turnover, and up to 20 percent for repeat offenders. Companies that fail to comply at least three times in eight years can be subject to a European Commission market investigation and, “if necessary,” the commission could break up those companies or prevent them from making new acquisitions.

Rules target data sharing and default apps

Some of the new rules in the DMA are fairly straightforward. For example, the DMA now requires that companies allow users to use only specific parts of their services with the ability to unsubscribe from other parts. Android Police suggest using YouTube but not Gmail or Android as an example of this.

Moreover, under the DMA, companies must explicitly ask users for permission to use their data across different services.

Perhaps one of the more significant requirements of the DMA is that core software can no longer be the default upon installation of an operating system. For example, that would mean no more default web browsers — a blow to both Google’s Chrome and Microsoft’s Edge.

That said, it’s worth noting the EU has already forced Google to unbundle Chrome and Search on Android devices sold in the EU. Instead, users get to choose their preferred browser and search engine during set-up. I’m interested to see how this particular rule will apply to things like Chrome OS, where the operating system and browser are effectively the same thing.

However, this rule applies to hardware too. For example, the DMA requires that developers be able to access supplementary smartphone functions like NFC chips. That’s a blow to Apple, which only allows its payment services to work with the iPhone’s NFC chip. Under the DMA, the chip would become accessible to third-party payment services.

Message interoperability is an interesting, but troublesome addition

One of the most significant additions in the DMA is a requirement for companies to “ensure the interoperability of their instant messaging services’ basic functionalities.”

In other words, messaging services would need to open up their platforms to allow cross-service messaging. On the one hand, this seems like it’d potentially solve the frustrating problem of trying to get all your friends using the same messaging service. On the other, it would likely be a total nightmare to implement.

Just off the top of my head, that’d mean opening up iMessage, WhatsApp (and Meta’s various other chat apps), Telegram, Signal, Google’s RCS system and Hangouts, and many more, to somehow work with each other (although some of the smaller services may be exempt from the DMA). It’s not impossible — WhatsApp and Signal, for example, rely on the same method for encrypting messages and so theoretically could be interoperable. Meta is also working to tie all of its chat apps together so WhatsApp, Instagram, and Facebook users can all get messages in one place.

Aside from the technical complexity of making interoperable messaging, there’s the question of whether developers would even want this. For example, Signal prides itself on its encryption and security — the app is often used as a messaging tool for journalists to securely contact sources. But if it were to become interoperable as per the DMA, it could pose a risk to the encryption and trust Signal has built up over years if suddenly those messages are tied into a system also used by Meta and Google.

Assuming message interoperability is implemented well with strong encryptions and protections for consumers, I could see a unified system generally being a net positive. But, I have my doubts that’s what we’ll get.

Will the DMA impact Canadians?

The short answer is probably not, although as with anything, it’s complicated. My best guess is that the DMA will not directly impact Canadians, although some of the broader requirements of the new regulations may have ripple effects.

I think it really depends on how deep changes will need to go. Things like the new default apps requirements will likely not reach beyond Europe, judging by how Google handled its previous unbundling of Chrome and Android in the EU.

At the same time, I think requirements like messaging interoperability could extend beyond the EU considering the technical complexity of implementing such a solution. If companies have to go through all the work of making messaging platforms work together in the EU, why not expand that capability to other countries too?

Finally, as noted by The Verge, the DMA hasn’t passed yet. The EU still needs to finalize the language of the legislation before it’s approved by Parliament and Council. However, the DMA could come into force sometime in October, so it’s not that far out. If and when the DMA does pass, I expect some companies will challenge it. Plus, the EU will likely grant companies time to meet the obligations of the legislation.

It’ll be interesting to see how this all plays out and, if the DMA is successful, it may pave the way for restrictions on big tech in other countries too.

Header image credit: Shutterstock

Source: Android Police, The Verge

Categories
Mobile Syrup

Canada will soon require digital platforms to pay news outlets and broadcasters revenue

Minister of Canadian Heritage Pablo Rodriguez’s mandate letter calls on him to introduce drastic legislation to equal the news revenue playing field.

The legislation will likely require digital platforms (like Google and Facebook) financially benefiting from Canadian news content to share revenue with news outlets. The mandate letter states Rodriguez will present legislation in early 2022.

But according to recent reporting from Cartt, a timeline to when exactly the legislation will be introduced has not been made public.

The publication does confirm news broadcasters are going to be a part of the new legislation, according to an announcement Rodriguez made at a Canada 2020 event discussing the future of news.

“Minister Rodriguez confirmed last week that broadcasters will benefit from the framework, given the important role they play in producing and providing Canadians access to news,” the spokesperson told Cartt.

The mandate letter also details the legislation will take after Australia’s approach.

Named the “news media bargaining code,” the legislation allows Australia’s Treasury to designate certain digital platforms to share revenues with news platforms they financially benefit from.

But what exactly that will look like in Canada is not clear at this time.

“Further details on the legislative approach will be available in due course,” the spokesperson told Cartt.

Image credit: Shutterstock

Source: Cartt.ca