PIPEDA and AI: 5 Obligations for Canadian Advisors

The Federal Layer: PIPEDA and AI

PIPEDA establishes the federal privacy baseline for all provinces. This chapter covers what it specifically requires when you use an AI tool that processes client data.

2.1 Five PIPEDA Obligation Areas for AI

PIPEDA is 25 years old. It has no AI provisions. It applies to AI anyway. Five areas create specific obligations for advisors using AI tools:

1. Consent. Express consent is almost certainly required when client financial data is processed by a third-party AI tool. The OPC classifies financial information as "extremely sensitive." The Federal Court of Appeal's Facebook decision (2024) established a "double reasonableness" standard: the advisor must make reasonable efforts to inform, AND the client must reasonably understand what they consented to. Burying AI processing in lengthy terms of service does not satisfy this standard.

2. Cross-border transfers. PIPEDA permits cross-border data transfers but requires accountability to travel with the data. Contractual protections must provide a comparable level of protection regardless of jurisdiction. Clients must be advised that their information may be processed in another jurisdiction. The OPC's 2009 Guidelines treat a transfer for processing as a "use" of information (not a disclosure), meaning additional consent for the transfer itself is not typically required if the original collection purpose is maintained. However, for highly sensitive financial information, the OPC warns that transfer to certain jurisdictions "may be unwise."

3. Accountability. The advisor and firm remain responsible for client information transferred to a third-party processor. This cannot be outsourced. The OPC's Equifax investigation confirmed that security safeguard requirements apply to a service provider independently of its contractual obligations, and the advisor retains responsibility for what happens to client data after it reaches the processor.

4. Automated decision-making. PIPEDA has no specific provisions for automated decisions. General principles still apply: the accuracy principle (4.6) requires AI outputs to be based on accurate information, the openness principle (4.8) implies disclosure of AI use, and Section 5(3) prohibits processing that a reasonable person would consider inappropriate.

5. Breach notification. The "real risk of significant harm" (RROSH) threshold applies. Financial data is inherently high-sensitivity, lowering the bar for notification. All breaches must be recorded and retained for 24 months, whether or not they meet the RROSH threshold. Knowingly contravening breach requirements is an offence carrying fines up to $100,000 per offence.

2.2 Why PIPEDA Still Applies Despite Its Age

AI does not occupy a space outside of current legislative frameworks.

OPC Generative AI Principles, December 2023

The OPC further stated that "the inference of information about an identifiable individual (such as outputs about a person from a generative AI system) will be considered a collection of personal information."

The law is old. The obligations are current. PIPEDA's principles-based framework means it adapts to new technologies without amendment, and the OPC has made clear that AI tools fall squarely within existing requirements.

2.3 Where PIPEDA Is Heading

Bill C-27 died on January 6, 2025 when Parliament was prorogued. All three components, including the Consumer Privacy Protection Act and the Artificial Intelligence and Data Act (AIDA), died together.

Mark Carney became Prime Minister on March 14, 2025. In May 2025, he appointed Evan Solomon as Canada's first Minister of Artificial Intelligence and Digital Innovation. In June 2025, Solomon confirmed that AIDA is "off the table as drafted" and described the government's approach as "light, tight, right": light enough to avoid stifling innovation, tight enough to close real risks, right-sized for Canada's economy.

New federal privacy legislation is expected in early 2026, led by Minister Solomon. AI regulation will proceed separately from privacy reform this time. No new bills have been tabled as of February 2026.

Until new legislation arrives, PIPEDA is the federal baseline. The obligations described above apply today.