The federal Personal Information Protection and Electronic Documents Act was written years before a generative AI tool existed, and it did not need to be rewritten to reach one. PIPEDA does not ask what software a business is running. It asks two much older questions, and an AI tool answers both of them the same way any other piece of software does.
Key takeaways
PIPEDA defines its own reach in plain terms. “Personal information” “means information about an identifiable individual”, and “commercial activity” “means any particular transaction, act or conduct or any regular course of conduct that is of a commercial character”. (PIPEDA, s.2(1)) The Act then applies to every organization in respect of personal information that “the organization collects, uses or discloses in the course of commercial activities”. (PIPEDA, s.4(1)(a)) A customer’s name typed into a chatbot, a client file summarised by an assistant, an applicant’s resume screened by a model — each is personal information moving through a commercial activity. The statute was drafted to reach any means by which that happens, not a named list of technologies, which is exactly why it did not need updating to reach a technology that did not exist when it was written.
Schedule 1’s vendor clause is the one provision that answers, on its own, most objections built around the fact that a business is using a third-party AI product: “An organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. The organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party.” (PIPEDA, Schedule 1, clause 4.1.3) Sending information to an AI vendor’s API is a transfer for processing, not a transfer of accountability. The organization that collected the information from the customer stays on the hook for what happens to it afterward, and a vendor’s terms of service do not change who the OPC holds responsible.
The joint federal-provincial-territorial privacy commissioners’ own generative AI guidance builds directly on this: it separates “Developers and Providers” — “individuals or organizations that develop (including training) foundation models or generative AI systems, or that put such services onto the market” — from “organizations using generative AI”, and notes an organization “might shift between or play multiple roles at once.” (OPC, generative AI principles) A business buying an off-the-shelf assistant is squarely in the second category, and the Act’s accountability principle does not let that role opt out of Schedule 1 by pointing at the vendor.
PIPEDA is not the only private-sector privacy statute in Canada, and it deliberately steps aside in three provinces. “Alberta, British Columbia (B.C.) and Quebec have their own private-sector privacy laws that have been deemed substantially similar to PIPEDA”, and “organizations subject to a substantially similar provincial privacy law are generally exempt from PIPEDA with respect to the collection, use or disclosure of personal information that occurs within that province.” (OPC, provincial laws that may apply instead of PIPEDA) The Governor in Council’s power to grant that exemption is written directly into the Act, at paragraph 26(2)(b). (PIPEDA, s.26(2)(b)) That means the answer to “does PIPEDA apply” genuinely depends on where the business operates — see our companion piece on Alberta and BC’s own AI-relevant rules, and the one on Quebec’s separate automated-decision regime under Law 25, both linked below.
It is tempting to reach for a purpose-built “AI law” instead of an older privacy statute. Canada does not have one in force. Bill C-27, which would have enacted the Artificial Intelligence and Data Act alongside a rewritten consumer privacy statute, is recorded on Parliament’s own bill tracker against the 44th Parliament’s first session — a session the page itself marks as prior — with its status listed as “At consideration in committee in the House of Commons” and its latest recorded activity a second reading and referral to committee on April 24, 2023. (LEGISinfo, Bill C-27) Nothing in that record establishes the bill is in force, and nothing establishes it is dead either — only that it has not passed. PIPEDA, by contrast, is the statute a Canadian business is already bound by today, AI tool or not.
PIPEDA gives an affected customer a specific route, not just a general right to be annoyed: an individual “may file with the Commissioner a written complaint against an organization for contravening a provision of Division 1”, and the Commissioner can also open an investigation without waiting for one to be filed. (PIPEDA, s.11) If the Commissioner’s report does not resolve it, the complainant can take the matter to the Federal Court, but only “within one year after the report… is sent, or within any longer period that the Court may… allow”. (PIPEDA, s.14(2)) Treadstone Law’s own plain-language walkthrough of this same two-part test makes the same point about new tools generally: “As your business adds new tools, vendors, or ways of collecting information, the same questions apply again: what are you collecting now, why, and have your customers meaningfully agreed to it.” (Treadstone Law, on PIPEDA’s basic test generally)
An Ontario bookkeeping firm starts routing new-client intake emails through an AI assistant that drafts a welcome reply and logs the client’s name, contact details and the services they asked about into a CRM. Is this PIPEDA territory? Personal information: yes, a name and contact details about an identifiable person. Commercial activity: yes, the firm is soliciting paying clients, which is squarely “conduct... of a commercial character.” Both boxes on the s.2(1)/s.4(1)(a) test are checked before the AI tool is even considered. The firm remains the accountable organization under clause 4.1.3 for whatever the assistant does with that data, which is why the vendor contract — not the marketing page — is where the firm should be checking what the assistant provider actually does with what it is sent.
Related: whether customer records can be used to train a model, Alberta and BC’s own privacy rules for AI, and Quebec’s Law 25 and automated decisions.
No. Clause 4.1.3 of Schedule 1 makes the transferring organization accountable for personal information “that has been transferred to a third party for processing”, and requires it to use “contractual or other means to provide a comparable level of protection” while the vendor holds it. The obligation moves with the data; the accountability does not.
The Act’s test is about the activity, not the size of the business. Section 4(1)(a) applies PIPEDA to “every organization” collecting, using or disclosing personal information “in the course of commercial activities”, with no revenue or headcount threshold in the text.
PIPEDA still applies to cross-border transfers of personal information and to federally regulated businesses such as banks and telecoms, even inside those three provinces — it is only the purely intra-provincial commercial activity that shifts to the provincial statute.
Accountability for a vendor’s AI tool is a contract question as much as a privacy-law one — the Operations hub covers what that looks like once a tool is live.
