Regulations Rule In The Realm Of Privacy: What You Need To Know About Bill C-34, The Safe Social Media Act

Digital service providers should stay up to date on the Government of Canada’s efforts to enact significant legislative transformation in the realm of privacy protection and online safety. Bill C-34, the Safe Social Media Act, targets social media platforms, AI chatbot services, and other online services. Bill C-34 strives to promote accountability and transparency, impose obligations on service providers, and protect more vulnerable users such as children and victims of online harms. To accomplish these goals, Bill C-34 enacts both the Digital Safety Act and the Digital Safety Commission of Canada Act.

While this article focuses on Bill C-34, the Digital Safety Commission (the “Commission”), which would be created by Bill C-34, has largely been updated and expanded by Bill C-36. Under Bill C-36, the Commission has been granted additional authority over privacy enforcement, which is significant for private sector privacy law and organizations handling personal information. This is different from the enforcement mechanisms in Bill C-34 focusing on setting standards for online safety, assessing organizations’ digital safety plans, enforcing legislative and regulatory obligations, and assessing user complaints. A further analysis of Bill C-36 and PPCDA can be found here.

Overview of Bill C-34 – General Duties Imposed on Regulated Service Providers

Unlike Bill C-36, Bill C-34 primarily addresses digital safety, child protection, content moderation, accountability, and transparency. Bill C-34 defines three types of regulated services to which its provisions apply:

• Social Media Services: websites or applications which primarily facilitate interprovincial or international online communication and sharing of content between users.
• Chatbot Services: an artificial intelligence system that is publicly accessible, communicates over the internet, uses a natural language interface for human-like communications or relations, and generates responses that are not fully predetermined.
• Online Services: websites or applications that are not social media services or chatbot services. Online services are accessible over the internet and allow users to interact with the website or application.

Additionally, the obligations and duties under Bill C-34 only apply if a service is “regulated”. A regulated service is determined by the number of users as set out in the regulations or by the Governor in Council if there is a significant risk that harmful content is accessible on the service. The determination of how many users is sufficient to make a service regulated is not set out in the text of Bill C-34 and is subject to Governor in Council regulations.

Crucially, all regulated services will have to implement and publish a digital safety plan. While the exact requirements vary slightly depending on the service, digital safety plans generally must be made accessible to the public and include information about the risk of exposure to harmful content, mitigation measures taken by the provider, child protection features, data on user reporting of harmful content, and steps taken to comply with Bill C-34.

Enforcement through the Digital Safety Commission

The implementation of the Commission is a noteworthy step towards making compliance with online safety and transparency requirements more meaningful. Part 4 of Bill C-34 provides the Commission with broad investigative, oversight, and regulation-making authority.

Section 126 lists 31 separate areas under which the Commission may issue regulations. In essence, the Commission has the authority to determine whether operators are in contravention of the provisions of Bill C-34 and impose heavy administrative monetary penalties of up to the greater of $10 million or 3% of gross global revenue. When conducting hearings, the Commission is not bound by the rules of evidence and may, at its discretion, hold hearings privately.

The Commission can directly receive complaints about harmful content online, conduct hearings and inspections, and issue orders without the involvement of other regulatory bodies. Included in the Commission’s mandate is the authority to compel testimony, document production, and determine what constitutes ‘effective’ or ‘adequate’ safety measures. The structure of the Commission differs from Bill C-36, which separates the investigative and adjudicative processes by creating the role of the Privacy and Consumer Data Commissioner and Privacy and Consumer Data Division to consider complaints, enter into compliance agreements and explore the resolution of digital safety issues before pursuing orders penalizing contravention.

The Commission as set out in Bill C-34 provides for rapid harm reduction, allowing the Commission to more efficiently address digital safety problems, as opposed to the segmented investigative and adjudicative process under Bill C-36. While it is possible that the Commission will apply the different approaches in Bill C-34 and Bill C-36 depending on the issue at hand, the details of the Commission’s operation remain to be seen.

In terms of accountability, the Commission reports to a designated Minister rather than Parliament itself. Section 21 requires the Commission to submit annual reports on its activities and imposes an obligation on the minister to bring the report to Parliament. The reporting structure established in Bill C-34 carries over into the privacy reporting requirements established in Bill C-36.

Additional Changes and Obligations under Bill C-34

Since Bill C-34 broadly focuses on digital safety, content moderation, and online harms instead of private sector privacy law, the obligations imposed on social media services, chatbot services, and other online services broadly fall into three categories: protecting children, acting responsibly, and promoting transparency.

Duties imposed on Social Media Services

• Regulated social media service providers must implement adequate age-verification to prevent children under 16 years old from having accounts on their services. Section 29 provides an exemption to this requirement if the service provider can demonstrate that they maintain safeguards to protect children. The determination of what constitutes ‘sufficient’ safeguards is left unclear by the provisions in Bill C-34.
• Providers are required to act responsibly and integrate safety measures to reduce the risk of exposing users to harmful content. Social media service providers must provide tools enabling users to easily report and block harmful content, make user guidelines and resources to assist with harmful content issues readily available, and update digital safety measures to comply with Bill C-34.
• In line with the imposition of digital safety plans, social media service providers that identify content that sexually victimizes a child, revictimizes a survivor, or involves intimate content communicated without consent must be removed within 24 hours of being identified. The 24-hour takedown timeline may be altered by regulations.

Duties imposed on Chatbot Services

• Chatbot service providers are obligated to ensure that AI services do not promote harmful content. AI services must have emergency measures to mitigate the risk of chatbot services promoting self-harm, posing as a human being or licensed professional, or using manipulative techniques to elicit emotional attachment.
• Chatbot services are subject to the same digital safety plan requirements that social media and online service providers are, and these plans must be submitted to the Commission.

Duties imposed on Online Services

• The term online service provider appears to capture organizations that fall outside the scope of chatbot or social media provider. Similarly to chatbot and social media requirements, service providers must submit a digital safety plan to promote transparency.

Key Takeaways – Unsettled Areas of Regulation

Bill C-34, alongside Bill C-36, is the culmination of the government’s efforts to strengthen privacy oversight and set standards for online services and organizations that collect, use, or disclose personal information. While Bill C-34 and Bill C-36 are both still at the first reading stage, organizations should still consider reviewing their policies on digital safety, data sharing, transparency, and protection of vulnerable users.

Reviewing digital safety matters is crucial, especially considering the significant grant of authority given to the Commission. The Commission’s powers under both bills are broad and discretionary, meaning the definitions and consequences of certain compliance requirements, such as ‘adequate’ safety measures, are left unaddressed and will be subject to further regulations. Organizations that provide chatbot services, social media services, or online services should continue to follow the progress of both bills to ensure they are aware of potential future steps they may need to take towards compliance.