Canadian Privacy Watchdogs Accuse OpenAI of Violating Federal and Provincial Laws

Canadian privacy regulators have formally accused OpenAI of violating federal and provincial privacy laws, citing concerns over the company’s data collection practices and consent mechanisms.

The Office of the Privacy Commissioner of Canada (OPC) and provincial counterparts in Quebec, British Columbia, and Alberta jointly announced the findings on April 10, 2024, following a joint investigation into OpenAI’s handling of personal information.

Key Allegations Against OpenAI

• Excessive Data Collection: Regulators argue OpenAI gathered an unreasonable amount of personal data without clear justification.
• Lack of Valid Consent: The company failed to obtain meaningful consent from individuals whose data was processed, according to the investigation.
• Non-Compliance with Privacy Laws: The OPC and provincial authorities allege OpenAI breached multiple privacy statutes, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial equivalents.

Regulatory Response and OpenAI’s Stance

The joint investigation, which began in 2023, concluded that OpenAI’s practices posed risks to individuals’ privacy rights. The regulators issued a joint report outlining their findings and recommendations for corrective measures.

“The evidence gathered during our investigation raises significant concerns about OpenAI’s compliance with privacy laws. The lack of transparency and consent mechanisms is particularly troubling.”

— Office of the Privacy Commissioner of Canada

OpenAI has not yet publicly responded to the allegations. However, the company has previously stated its commitment to privacy and compliance with global regulations.

Next Steps and Potential Consequences

The OPC and provincial regulators have given OpenAI 30 days to respond to the findings and propose measures to address the alleged violations. Failure to comply could result in enforcement actions, including fines or legal proceedings under applicable privacy laws.

The regulators emphasized the importance of accountability in AI-driven data processing, urging companies to prioritize transparency and user consent.