Yes. PIPEDA applies to personal information handled in the course of commercial activities, and putting a tenant application or a buyer’s file through an AI tool is a use of that information — often a disclosure as well. For a licensee two further layers sit on top: your regulator’s confidentiality rules, which in Ontario require written consent before anything reaches a third party, and human rights law wherever the output influences who gets housing.
Key takeaways
Yes. PIPEDA applies to every organisation in respect of personal information it collects, uses or discloses in the course of commercial activities, and running a tenant application or a buyer’s file through an AI tool is a use of that information — and, where the provider can retain or read it, a disclosure to a third party. The tool changes the mechanics, not the obligation.
For a licensed real estate professional there are then two further layers on top: your regulator’s confidentiality rules, and human rights law where the output influences who gets housing.
The Office of the Privacy Commissioner sets out the ten fair information principles that PIPEDA is built on. Three do most of the work in an AI context. Accountability makes the organisation responsible for personal information under its control, with a named individual accountable for compliance. Limiting use, disclosure and retention means information can only be used for the purposes it was collected for unless the individual consents. Openness means telling people what you are doing.
Canada’s federal, provincial and territorial privacy commissioners then applied those principles to generative tools specifically. Their joint principles state that generative AI does not occupy a space outside of current legislative frameworks and single out housing as one of the “highly impactful contexts” where discriminatory outcomes are a live risk.
Two of their principles bite hardest in a brokerage or a property management office. Openness: outputs that could have a significant impact on an individual or group should be meaningfully identified as being created by a generative AI tool. Individual access: where a generative system forms part of a decision-making process, keep records adequate to allow a request for access to information about that decision to be meaningfully fulfilled. If you cannot reconstruct why an applicant was ranked where they were, you cannot answer the request.
In Ontario, TRESA goes further than privacy law in one specific way — it requires written consent. RECO’s confidentiality bulletin states that brokerages and agents must not disclose any confidential client information to a third party without the client’s written consent, except as authorised or required by law, and that the consent must answer four questions: what information will be disclosed, who will receive it, what the purpose is, and who might benefit and how. An AI vendor is a third party. Draft the consent accordingly, and note the bulletin’s reminder that the duty of confidentiality continues after the client relationship ends.
In British Columbia, BCFSA reaches the same point through the Real Estate Services Act and PIPA: always ensure that you have acquired your clients’ informed consent before using their information in an AI tool, review the AI provider’s privacy disclosures, and refrain from using AI tools without your client’s express consent.
This is where the risk stops being paperwork. BCFSA warns that AI systems employed for tenant screening may inadvertently rank individuals differently based on factors like race, gender or language, reinforcing discriminatory practices, and expects licensees to establish procedures for error and bias correction and to tell tenant applicants when AI tools are used. CREA answers the general question the same way: yes, AI systems may reproduce or amplify biases present in their training data.
In Ontario the governing instrument is the Human Rights Code. The Ontario Human Rights Commission’s Policy on human rights and rental housing states that the Code applies to both tenants and landlords, that everyone has the right to equal treatment in housing without discrimination and harassment, and that housing providers are responsible for ensuring housing environments are free from discrimination. A screening score produced by software does not move that responsibility. Ontario’s Information and Privacy Commissioner has also published principles for the responsible use of artificial intelligence, developed jointly with the Human Rights Commission.
A property manager receives eleven applications for one unit and wants a tool to extract income, employment and reference details into a comparison table. Extraction is a legitimate use, provided the applicants were told at collection that their information would be handled this way and the vendor’s terms permit it.
What the manager does not do is ask the tool to rank the applicants. The ranking is the decision, the decision touches housing, and both the OPC and BCFSA identify exactly this as the point where bias becomes discrimination. The manager scores the applications against written criteria applied consistently, records the reasons in their own words, tells applicants that AI was used to extract information from their forms, and keeps the file in a form that would answer an access request.
If a breach happens — a misdirected export, a compromised account — and it creates a real risk of significant harm, the report to the Commissioner and the notification to the individual follow. Our sister firm sets out what mandatory breach reporting under PIPEDA requires of an Ontario business.
Size is not the test; commercial activity is. Our sister firm’s explainer on whether PIPEDA applies to your Ontario business works through the exceptions, and privacy policy requirements for a small business covers the document you will be asked for first.
Those provinces have their own private-sector privacy statutes, which is why BCFSA cites British Columbia’s Personal Information Protection Act rather than PIPEDA when it tells licensees to limit use to purposes a reasonable person would consider appropriate. The OPC maintains an interactive tool for working out which privacy law applies to a given organisation and information type.
No — but it does not relieve them either. Real estate brokers, sales representatives and developers have specific obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and its regulations, and identification and record-keeping remain the registrant’s. What changes when a customer’s data is sold or transferred is covered by our sister firm in what happens to customer data and privacy obligations when a company is sold.
Next: the policy that operationalises all of this is in how to write an AI use policy for your brokerage, and the errors this article is designed to prevent are catalogued in the AI mistakes agents keep making.
A 30-minute call is enough to tell you whether AI pays for itself here.
