Canadian privacy & access decisions

This joint investigation by the OPC, CAI, OIPC-BC, and OIPC-AB examined OpenAI OpCo, LLC's compliance with federal and provincial privacy laws regarding its ChatGPT service. The Offices investigated OpenAI's collection, use, and disclosure of personal information for model training, consent practices, openness, accuracy, individual rights (access, correction, deletion), data retention, and accountability. While OpenAI challenged jurisdiction and argued for implied consent, the Offices largely found contraventions in its initial practices, particularly concerning the overbroad collection of personal information from public sources and user interactions without valid consent or sufficient transparency. However, in response to the preliminary report, OpenAI committed to implementing significant privacy-enhancing measures, including a new filtering tool for training data, improved transparency, and enhanced individual rights processes. Consequently, the OPC found the matter well-founded and conditionally resolved under PIPEDA, expecting continued implementation and improvement of these measures. The OIPC-AB and OIPC-BC, due to stricter provincial consent requirements, found the consent issues well-founded and unresolved, while the CAI had mixed outcomes, also finding some issues unresolved. The Offices will monitor OpenAI's implementation of the agreed-upon recommendations.

• Whether the Offices had jurisdiction over OpenAI's activities under federal and provincial privacy laws.
• Whether OpenAI collected, used, and disclosed personal information for purposes that a reasonable person would consider appropriate in the circumstances.
• Whether OpenAI obtained valid consent for the collection and use of personal information from publicly accessible websites and licensed third-party sources for model training.
• Whether OpenAI obtained valid consent and met its obligation to inform individuals with respect to the collection and use of personal information included in their interactions with ChatGPT.
• Whether OpenAI obtained valid consent and met its obligation to inform individuals with respect to the disclosure of personal information collected from various sources via ChatGPT.
• Whether OpenAI was sufficiently open and transparent about its models and information handling practices.
• Whether OpenAI took reasonable steps to ensure that the information it generates about individuals is as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
• Whether OpenAI provided individuals with the ability to obtain access to their personal information.
• Whether OpenAI provided individuals with the ability to correct their personal information.
• Whether OpenAI provided individuals with the ability to remove/delete their personal information from its models.
• Whether OpenAI established appropriate retention and disposal procedures for the personal information that it collects, uses, and discloses.
• Whether OpenAI met its accountability requirements in respect of the personal information under its control.
• Whether the personal or domestic purposes exemption applied to OpenAI's commercial activities.
• Whether the publicly available information exception applied to OpenAI's collection of personal information from the Internet.
• Whether the journalistic, historical, or genealogical material exception under Quebec's Private Sector Act applied to OpenAI's model training data.
• Whether section 9.1 of Quebec's Private Sector Act (privacy by default) applied to ChatGPT's privacy settings.

The complainant alleged that Canadian Heritage failed to conduct a reasonable search for records and improperly claimed that some records did not exist in response to an access request for communications between Canadian Olympic Committee staff and Sport Canada staff related to weightlifting. The investigation found that the institution's search scope was too narrow, as it only used one athlete's name for keywords and did not adequately explain why certain repositories like Outlook were not searched. Furthermore, the OIC identified specific responsive records that were not provided by Canadian Heritage. The Commissioner concluded that Canadian Heritage did not conduct a reasonable search and that additional records likely exist. The complaint was found to be well founded, and Canadian Heritage was ordered to conduct a new search and provide a new response.

• Whether Canadian Heritage conducted a reasonable search for records
• Whether Canadian Heritage improperly responded that some or all requested records do not exist