Canadian privacy and data protection laws for the private, non-health sector are structured around consent. Unlike many other privacy laws across the world, including the lauded European General Data Protection Regulation (GDPR), businesses in Canada cannot rely on legitimate interests or other legal bases to process personal information without consent. In recent years, many commentators have questioned the efficacy and appropriateness of the consent model, including based on concerns related to the burden on individuals (and associated “consent fatigue”) as well as the potentially stifling impact on innovation in a time of immense technological change.
Most recently, use of personal information to develop and train artificial intelligence (AI) models has risen to the forefront of privacy law debates among organizations, privacy professionals and regulators. In particular, many have questioned whether it is possible or practicable for such activities to comply with strict privacy
