Author: Jennifer Hunter, Lerners LLP
Introduction
Since the world was introduced to ChatGPT, privacy and data security experts have been calling for increased regulation regarding AI. In particular, the Information and Privacy Commissioner of Ontario has called specifically for legislation governing the use of AI by public entities in this province. Of course, the ongoing and arguably increasing threat of cyber incidents and breaches has also led to demand for regulatory oversight to compel cyber security. It appears these calls have been responded to, if not yet directly answered.
On May 13, 2024, the Ontario government introduced Bill 194, the Enhancing Digital Security and Trust Act, 2024. The Act aims to address cyber security and AI in the public sector. The Act will come into force on July 1, 2025. Much of the content of the new requirements will be in the regulations, which have not yet been introduced, but now is a good time for public sector organizations to turn their mind to how they will prepare to meet new data security and AI regulatory obligations.
Scope and Applicability
The Act will apply to all public sector entities as defined in the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act, children’s aid societies, and school boards— all of which are included in the definition of “public sector entity”.
Key Regulatory Areas
Cybersecurity Regulations
- The Act provides for the enactment of regulations that will:
- Require public sector entities to develop and implement programs for ensuring cyber security.
- Govern such cyber security programs, including requiring specific elements.
- Require the submission of reports in respect of incidents related to cyber security, including the form and frequency of such reports; and
- May also include roles and responsibilities of specified individuals, reporting on progress towards ensuring cyber security, education and awareness measures, response and recover measures for incidents, and oversight measures for implementation of cyber security program.
Artificial Intelligence Regulations
- The definition of artificial intelligence includes AI that is developed or procured by a public sector entity or developed by a third party on behalf of a public sector entity. It is also clearly stated that the collection, use, retention or disclosure of digital information by a public sector entity includes such activities conducted by a third party on its behalf. In other words, the public sector entity will have obligations to ensure the compliance of any third party acting on its behalf.
- The relevant provisions of the Act will apply to public sector entities “as may be prescribed” if they use or intend to use an AI system in the “prescribed circumstances”, which implies that the regulatory requirements regarding the use of an AI system will not apply to all public sector entities in all circumstances.
- Prescribed public sector entities in prescribed circumstances may be required to: provide public disclosure about the use of an AI system, develop an accountability framework, manage risks associated with the use of the AI system, and use the system in accordance with any prescribed requirements, and not for prohibited use.
- For specified uses of an AI system, as prescribed by the regulations, a public sector entity will be required to disclose information and ensure that an individual exercises oversight in accordance with the regulations.
- Bill 194 also addresses digital technology affecting individuals under age 18 and includes provisions that will allow for regulations regarding the collection, use, retention and disclosure of digital information by children’s aid societies and school boards, including prescribing technical standards and issuing directives with which these entities will be required to comply.
- It is specifically stated that nothing in the proposed Act or any regulation or directive made under the Act establishes a private law duty of care owed to any person.
How You Should Prepare
Although the regulations yet to be introduced will ultimately address the pressing concerns of cyber security and AI in Ontario’s public sector, the current proposed Act, for now, merely sets out a framework to do so. While it is now clear that new obligations regarding both cyber security and the use of AI are forthcoming, the substance of those obligations will not be fully known until the new regulations are introduced.
In the meantime, public sector entities in Ontario can expect they will be required to implement or revise their cyber security programs to match regulatory requirements and be prepared to provide reports regarding cyber incidents. In addition, at least some public sector entities in certain circumstances will also be required to ensure they are using AI systems appropriately, which will likely include enhanced transparency and data protection. Importantly, the obligations imposed by the Act will require public sector entities to ensure that any third party acting on their behalf is also meeting regulatory requirements.
