
When the collection and use of data involves personal information, it raises significant ethical and legal challenges concerning privacy, data security, and the potential for discriminatory biases in AI systems. These issues are exacerbated by the massive scale of collecting and using personal information.
The massive collection and use of personal information are subject to laws on personal data protection that rigorously regulate how such data can be collected (purposes, consent, volume, retention period) and individuals' rights (e.g., right to access, right to rectify).
It is therefore crucial to ensure that massive data collection adheres to ethical and legal standards, and that resulting AI systems are designed and used without causing social harm.
The use of personal information to fuel artificial intelligence is widespread. Preferences, habits, and behaviors of individuals are particularly useful for developing AI systems capable of targeted advertising and providing personalized goods and services.
However, personal information is part of individuals' privacy and is protected by specific laws. The collection and use of personal information by AIs must respect the rules set out in laws on personal data protection, which rigorously govern how personal data can be collected (purposes, consent, volume, retention period) without infringing upon individuals' rights, including:
- Privacy
- Data security
- How data is used and stored
- Access to data and rectification
- Freedom of expression
These aspects will be further clarified in the upcoming second part of the Q&A box.
More about – What is personal information?
Personal information, according to the law, is any information that directly or indirectly identifies a person. Personal information is also commonly referred to as "personal data."
Direct identification of an individual:
Information that directly identifies a person includes their name, postal address, telephone number, email address, social insurance number, date and place of birth, income, credit history, educational background, image, voice, etc.
Indirect identification of an individual:
Information that can indirectly identify a person becomes personal information when combined with other information. For example, combining postal code, age, and typical transportation route can identify an individual. This significantly expands the scope of what qualifies as personal information.
It is crucial to determine whether information qualifies as personal information because it is protected by rules that specify its collection, use, retention, and disclosure.
Personal information and sensitive information: what difference(s)?
In Quebec, the Act Respecting the Protection of Personal Information (Bill 25) protects sensitive information. Sensitive information is a specific category of personal information due to the significant risks it poses to privacy, security, or the dignity of the individual.
More about – What is personal information?
Personal information, according to the law, is any information that directly or indirectly identifies a person. Personal information is also commonly referred to as "personal data."
Direct identification of an individual: Information that directly identifies a person includes their name, postal address, telephone number, email address, social insurance number, date and place of birth, income, credit history, educational background, image, voice, etc.
Indirect identification of an individual: Information that can indirectly identify a person becomes personal information when combined with other information. For example, combining postal code, age, and typical transportation route can identify an individual. This significantly expands the scope of what qualifies as personal information.
It is crucial to determine whether information qualifies as personal information because it is protected by rules that specify its collection, use, retention, and disclosure.
Learn more – Personal information and sensitive information: what difference(s)?
In Quebec, the Act Respecting the Protection of Personal Information (Bill 25) protects sensitive information. Sensitive information is a specific category of personal information due to the significant risks it poses to privacy, security, or the dignity of the individual.
Examples of sensitive information:
- Ethnic or racial origin
- Political opinions
- Religious or philosophical beliefs
- Health or medical history
- Sexual life or sexual orientation
- Criminal convictions
- Financial information
This distinction on sensitive information allows Quebec law to impose additional obligations on private and public organizations, such as:
- Justifying the collection, use, and disclosure of sensitive data.
- Taking specific measures to protect sensitive data. For example, obtaining explicit consent before using sensitive data for a purpose other than originally intended during collection.
- Assessing the privacy risks associated with processing sensitive data based on its purpose, quantity, distribution, and storage medium.
- Implementing measures to ensure a high level of protection for this data.