The EU has passed landmarks rules that will impact big tech companies including:

• The Digital Marketers Act (DMA) requires “gatekeepers” to make their messaging services interoperable and provide business users access to their data.
• The Digital Services Act (DSA) bans targeted advertising aimed at children or based on sensitive data such as religion, gender, race, or political opinion.
• The Artificial Intelligence Act regulates the use of facial recognition and biometrics.

While these Acts are aimed at non personal data, they do not exempt personal data from their scope.

This raises concerns over companies facing penalties under both the Acts and the GDPR, which is significant as violators can face fines up to:

• 10% of annual global turnover for DMA violations.
• 6% for DSA violations.
• Greater of 4% or €20 million for GDPR violations.

Canada has introduced a draft privacy act, Digital Charter Implementation Act, 2022 (Bill C-27).

The bill takes a three-in-one approach to strengthening privacy law and creating rules for AI development, while also extending the Digital Charter. Bill C-27 contains:

1. Consumer Privacy Protection Act
2. The Personal Information and Data Protection Tribunal Act
3. The Artificial Intelligence and Data Act (AIDA).