Ontario’s Information and Privacy Commissioner urges government to put guardrails around public sector use of AI technologies

TORONTO, ON (June 7, 2023) – Ontario’s Information and Privacy Commissioner, Patricia Kosseim, is calling on the Ontario government to put in place a robust framework to govern the public sector’s use of artificial intelligence (AI) technologies. The recommendation is included in the 2022 annual report of the Office of the Information and Privacy Commissioner of Ontario (IPC), released today.

While AI technologies offer tremendous opportunities to accelerate the delivery of government services and improve health, education and public safety, if left unchecked, they can pose a serious threat to privacy and other human rights. These technologies often rely on large volumes of personal information, which must be lawfully collected, fairly and equitably representative, and properly protected.

“Together with the Ontario Human Rights Commission, we urge the government to continue showing leadership by pressing forward with a robust, granular and binding framework for the responsible use of artificial intelligence technologies by public sector organizations,” said Patricia Kosseim, Information and Privacy Commissioner of Ontario. “Clear and effective guardrails are needed to ensure the benefits of AI don’t come at the cost of Ontarians’ privacy and other fundamental human rights. Ontarians might want their public sector institutions to deploy AI technologies for the public good, but only if it is safe, transparent, accountable, and ethically responsible. Ultimately, innovative uses of AI must be supported and sustained by public trust.”

Other recommendations in the IPC’s 2022 annual report include:

Optional, accessible digital identity systems

Digital identity systems are emerging in Ontario and around the world to make it easier for individuals to confirm who they are and conduct transactions online. The IPC is calling on the government to ensure that any plans to introduce a digital ID system in Ontario ensure that it is optional and equitably accessible to all. Digital ID systems should only collect, use, or share the minimum amount of personal information needed to confirm identity and must not allow tracking or tracing of credential use for other purposes. Such systems must be secured from identity theft, fraud or other harms, and most importantly, governments and organizations that use them must be transparent about it, held accountable, and subject to independent oversight.

Stronger privacy protections for workers

As more people work from home, employers have stepped up their efforts to supervise and measure the performance of workers through electronic surveillance tools, known as “bossware.” Although the government did make it mandatory for employers of a certain size to be transparent about their use of electronic workplace monitoring through workplace policies, the IPC is calling for clearer statutory boundaries around employers’ use of such tools, effective oversight of privacy rights and obligations in Ontario’s employment sector, and an independent mechanism for addressing employee privacy complaints.

Full implementation of PHIPA reforms

The IPC commends the government for moving forward with public consultation on regulations to support administrative penalties under the Personal Health Information Protection Act (PHIPA). When wielded against those few bad actors in the health system, administrative penalties are vital for building Ontarians’ overall trust that their personal health information will be protected and respected. The IPC stands ready to implement this new enforcement tool in a fair and proportionate manner, drawing from principles of a just culture.

The IPC strongly urges the government to move forward with fully implementing all of the other PHIPA reforms adopted back in 2019 and 2020 that are still awaiting proclamation and/or the adoption of regulation. These include requirements for electronic audit logs, consumer electronic services providers, and de-identification standards.

The IPC’s 2022 in review, comprehensive statistics, including freedom of information requests, compliance rates, appeals and privacy complaints, are available at annualreport.ipc.on.ca.

Additional resources:

• IPC 2022 annual report key statistics and trends
• Joint statement by the IPC and the OHRC on the use of AI technologies

Media contact:

@email