Privacy & Compliance in the Age of AI

Written by Austin Minnings
JD Candidate 2026

Introduction
The rapid adoption of AI systems has brought significant advancements across various industries, raising unique privacy and compliance concerns. This post explores key considerations for organizations operating AI systems in Canada including, among other things, anonymization and data thresholds, the proposed AIDA and recent updates to relevant privacy legislation. By understanding and adhering to the applicable Canadian privacy laws, organizations can ensure compliance in the new age of AI.
 
Anonymization Thresholds & Data Storage Rules
Anonymization of data has been a crucial consideration in protecting information. The Personal Information Protection and Electronic Documents Act [1](“PIPEDA”) and Alberta’s Personal Information Protection Act[2](“PIPA”) require organizations to ensure that personal information gathered is de-identified in a manner that protects re-identification. Organizations operating in Alberta must also adhere to PIPA’s standard of reasonableness in their data storage policies and practices.[3] PIPA does not specify a retention period that is considered reasonable but best practices suggest deleting or disposing of personal data once it is no longer required for its original purpose.
 
The proposed Artificial Intelligence and Data Act (“AIDA)
On June 16, 2022, Bill C-27; the Digital Charter Implementation Act was tabled by the Federal Government. As it was proposed, the AIDA would regulate activity of persons involved in the design, development and use of “high-impact” AI systems, the determination of “high-impact” was deferred to future regulations.[4] Compliance obligations under the AIDA for persons responsible for high impact systems would have been related to risk management, transparency, record keeping and notification.[5] However, with the prorogation of Parliament in January 2026, Bill C-27, including the new proposed AIDA and privacy reforms it contained essentially “died”.[6] As such, the relevant compliance legislation remains PIPEDA and PIPA, among others.
 
Demographic Protection
Information and data may be used regarding demographics are often utilized in AI models. Passive demographic protection, such as identifying age, gender or mood may pose risks under the Office of the Information and Privacy Commissioner (OIPC) guidelines. In the event that such detection results in the collection of identifiable personal information or may contribute to systemic biases, there is a risk of non-compliance.
 
Recent Updates
The Freedom of Information and Protection of Privacy Act[7] (“FIPPA”) was recently reformed with the enactment of Bill 33.[8] Bill 33 included strengthened privacy protections and new rules with respect to data use and sharing and increased penalty of up to $750,000 for an organization.[9] Additionally, the PIPA is still currently under review.
 
Conclusion
The privacy and AI landscape continues to evolve, even without Bill C-27 and the accompanying proposed AIDA. Businesses should continue to monitor this landscape, especially given the pace of change. It is clear that AI will continue to intersect with privacy and compliance, necessitating further compliance requirements that organizations must stay up to date with.
 
​Note: The above information does not constitute legal advice. No guarantees are made as to accuracy, completeness, or applicability to individual situations.

[1] SC 2000, c 5, [PIPEDA].

[2] SA 2003, c P-6.5, [PIPA].

[3] Section 2, PIPA.

[4] Luca Lacarini, Part 2: Canada’s evolving artificial intelligence and privacy regime (April 12, 2023), online: https://www.dentons.com/en/insights/articles/2023/april/12/part-2-canadas-evolving-artificial-intelligence.

[5] Ibid.

[6] Nic Wall, Molly Reynolds & Rosalie Jetté et al, Looking ahead: the Canadian privacy and AI landscape without Bill C-27 (January 16, 2025), online: https://www.torys.com/our-latest-thinking/publications/2025/01/the-canadian-privacy-and-ai-landscape-without-bill-c-27.

[7] RSA 2000, c F-25.

[8] Supra note 4.

[9] Ibid.