PIPEDA and the privacy commissioners' principles for generative AI

What it is

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada’s federal privacy law for the private sector. Part 1 and its Schedule 1 set out ten fair information principles. They are accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access and challenging compliance. The Office of the Privacy Commissioner of Canada (OPC) oversees it.

PIPEDA was written before modern AI and contains no provision aimed at automated decisions. It still governs most commercial AI in Canada, because almost every AI system that touches customers or employees collects, uses or discloses personal information.

Who it applies to

PIPEDA applies to private-sector organisations that collect, use or disclose personal information in the course of commercial activity. Federally regulated organisations, such as banks, airlines and telecommunications companies, are always subject to it, including for their employees’ personal information. Alberta, British Columbia and Quebec have private-sector privacy laws deemed substantially similar, and organisations covered by those laws are generally exempt from PIPEDA for information handled within the province. PIPEDA still applies when personal information crosses provincial or national borders in the course of commercial activity.

Quebec’s law goes further on automated decisions. Its section 12.1 requires notice and an explanation when a decision is based exclusively on automated processing.

What it requires of AI today

The fair information principles turn into concrete questions for an AI system.

• Accountability. Someone in the organisation is answerable for personal information in its AI systems, including information passed to an AI vendor for processing.
• Purpose and consent. The purposes for which an AI system uses personal information are identified before or at collection, and meaningful consent covers them. Reusing data collected for one purpose to train or run a model for another is the classic problem.
• Limiting collection and use. An AI system takes in only the personal information its purpose needs, and outputs about people are not kept longer than necessary.
• Accuracy. Information used to make decisions about people, including inferences a model generates, is as accurate and complete as the purpose requires.
• Safeguards. Security suited to the sensitivity of the information, wherever the AI system and its vendors hold it.
• Openness, access and challenge. People can find out how the organisation uses AI with their information, see the information held about them, including inferences, and challenge compliance.

Since 1 November 2018 organisations have had to report breaches of security safeguards involving personal information that create a real risk of significant harm to the OPC, notify the affected individuals and keep a record of every breach. That includes breaches through AI systems and AI vendors.

The commissioners’ generative AI principles

On 7 December 2023 the OPC and its provincial and territorial counterparts issued Principles for responsible, trustworthy and privacy-protective generative AI technologies. They are organised under legal authority and consent, appropriate purposes, necessity and proportionality, openness, accountability, individual access, limiting collection, use and disclosure, accuracy, and safeguards, with separate expectations for developers, providers and organisations using generative AI.

The commissioners say many of the considerations will be required for compliance with privacy law, depending on the sector and the activity, while not covering every requirement. They also name no-go zones, including profiling that may lead to unfair, unethical or discriminatory treatment, and uses likely to threaten fundamental rights and freedoms.

Bill C-36

The federal government’s earlier reform, Bill C-27, would have replaced PIPEDA’s privacy rules and enacted the Artificial Intelligence and Data Act. It died when Parliament was prorogued on 6 January 2025.

Bill C-36, introduced by the Minister of Artificial Intelligence and Digital Innovation on 15 June 2026, would enact the Protecting Privacy and Consumer Data Act and amend PIPEDA. As introduced, it defines an automated decision system as any technology that assists or replaces the judgement of human decision-makers. Section 62(2)(c) would require an organisation’s policies and practices to include a general account of its use of any automated decision system to make predictions, recommendations or decisions about individuals that could have a legal or similarly significant effect on them. Under section 63(4) and (5), on request it would have to explain the prediction, recommendation or decision, identifying the personal information used, its source, and the principal reasons or factors that led to it.

The bill does not include a standalone AI act. It is at second reading in the House of Commons and may change before it passes.

Key dates

• 1 November 2018. Mandatory breach reporting under PIPEDA begins.
• 7 December 2023. The privacy commissioners issue their generative AI principles.
• 6 January 2025. Bill C-27 dies on prorogation.
• 15 June 2026. Bill C-36 introduced and read a first time.

How it relates to other frameworks

The proposed account-and-explanation duties in Bill C-36 are closer to GDPR Article 22 transparency than Bill C-27 was, because they use the “legal or similarly significant effect” threshold. They remain lighter than Quebec’s section 12.1, which already requires notice at the time of an exclusively automated decision and a right to have it reviewed.

Federal institutions are covered by the Privacy Act and the Directive on Automated Decision-Making, not PIPEDA. Federally regulated financial institutions add OSFI Guideline E-23 for AI models from May 2027. For the AI-specific governance that privacy law does not reach, organisations often adopt ISO/IEC 42001 or the NIST AI RMF.

A note on this page

This is Aicura’s reading of PIPEDA, the commissioners’ principles and Bill C-36 as introduced. It is not legal advice and it is not the law itself. Read the Act on the Justice Laws website and the bill on LEGISinfo, and take advice on how they apply to your organisation.