Industry committee  Thank you for that question. In all the work I've done as a regulator over 15 years, the work that I think is most impactful and the work that I'm most proud of is developing the age-appropriate design code.

Industry committee  Yes. Because the CPPA gives the commissioner a new power to create codes and certification, there would be a vehicle in the CPPA for the commissioner to develop such a code as is happening across northern Europe, Argentina, Turkey, Ireland and many places around the world. The state of California has this code.

Industry committee  The code is a statutory code, which means it's enforceable by the commissioner and by the court. It's not guidelines. It follows directly from the U.K. GDPR. It has some provisions in it that I would recommend need to be in the CPPA. One of them needs to be a statement in the preamble or in the purpose statement that recognizes that companies need to provide services in the best interests of the child.

Industry committee  Yes, I did—with my team. We were directed by Parliament to write a code. It was a requirement in the act. It was a one-line requirement to have an age-appropriate design code. My team worked for two years. We had 57 round tables across all industry sectors. We worked with child psychologists, parents, children themselves, the gaming industry, and the social media and video-sharing companies to come up with a code.

Industry committee  It does. Obviously, the commissioner's office developed the code, but it was laid in Parliament. Parliament approved the code, which gives it the status before the courts that the code needs to be taken into consideration.

Industry committee  It could be a rounding error.

Industry committee  I can't recall at this moment whether the CPPA has a power in there for the commissioner to order the deletion of data for data that may have been gathered illegally or not properly consented to. I can't remember if the commissioner has that power, but it is certainly something that is necessary in the modern world.

Industry committee  Absolutely.

Industry committee  The EU AI act is comprehensive in terms of its scope. It's a comprehensive act, so it applies to the public sector, the third sector and the private sector. It's a product-safety statute, so it doesn't give individuals any rights. What it does require is that companies categorize the AI system they are procuring or developing.

Industry committee  Yes, your question was about the outcome of the AI Safety Summit that was held several weeks ago at Bletchley Park. I think, first of all, there was the fact that an international declaration on the risks that generative AI brings to society, an agreement, was signed by 25 countries, including China.

Industry committee  Yes, Jennifer Stoddart is a personal hero of mine. I worked closely with her in Ottawa as her assistant commissioner. One of the benefits of Canada is that Canada has been a hard-working member of the OECD, so Jennifer Stoddart was the chair of the privacy and security committee of the OECD for many years.

Industry committee  Yes, the global summit that was sponsored by the Prime Minister in the U.K. was really important, because there was an outcome that was an agreement of leading nations around the world around the approach towards AI. There was a declaration that came out of that meeting, and it included China.

Industry committee  That's a private member's bill, as my colleague has just said, so I haven't studied that. The government's direction right now is not to regulate AI, but rather to give existing regulators the powers that they need, which includes running sandboxes to beta-test generative AI and machine learning applications.

Industry committee  As I said, in the U.K. there is a tribunal system, and administrative tribunals are used across many areas of law. In the U.K., when it comes to freedom of information, data protection, cybersecurity or electronic marketing—all of those areas the commissioner is responsible for—the decisions that the commissioner fines and sanctions are subject to a review by the first-tier tribunal.

Industry committee  My experience with countries in the global south is.... If you take Africa, for example, and South America, many of those nations are not copying and pasting the GDPR, but they are certainly taking inspiration from the GDPR. I think the GDPR is a global standard. There are different cultures and different legal systems, which means that it's not going to look the same as the GDPR, but certainly the principles are the same.