Market Intelligence

Canadian privacy regulators have completed a joint investigation into OpenAI's ChatGPT, examining whether the company's collection, use, and disclosure of personal information complies with federal and provincial private-sector privacy legislation. The investigation involved the Office of the Privacy Commissioner of Canada alongside regulators from Quebec, British Columbia, and Alberta, scrutinizing OpenAI's practices in developing and operating its AI chatbot platform.

Foreign companies entering Canada often assume their existing privacy programs designed for GDPR or CCPA compliance can simply extend to Canadian operations, but Canada's legal requirements demand targeted modifications. This comprehensive guide examines Canada's private sector privacy legislation, breach reporting obligations, AI governance expectations, and anti-spam regulations that businesses must navigate before launching in the Canadian market.

A Quebec Superior Court has authorized a class action examining whether professional contact information collected by business intelligence platform Apollo.io falls within Quebec privacy law's "professional information" exception. The case raises critical questions about the boundaries between protected personal data and exempted professional information in today's digital workplace, particularly regarding cell phone numbers, LinkedIn profiles, and algorithmic profiling outputs.

Les entreprises au Canada doivent naviguer un paysage complexe de lois fédérales et provinciales régissant la collecte, l'utilisation et la communication de renseignements personnels.

Ce bulletin mensuel a été préparé par le groupe Protection des renseignements confidentiels, vie privée et cybersécurité de Fasken pour vous présenter les actualités et les développements récents qui ont attiré notre attention. Si vous avez des questions sur l’un des sujets abordés dans ce bulletin, communiquez avec l’un des membres de ce groupe, qui se fera un plaisir de vous aider.

The guidance emphasizes that organizations remain accountable for personal information under their control, including where it is collected, used, disclosed or processed by a third party, and should conduct privacy due diligence to identify compliance risks, inform contractual protections and demonstrate accountability. The OPC is accepting comments on the guidance until December 4, 2026.