The Office of the Privacy Commissioner of Canada (OPC) is the Canadian federal regulator responsible for enforcing the Personal Information Protection and Electronic Documents Act (PIPEDA) and the federal Privacy Act. Its May 6, 2026 PIPEDA finding against OpenAI's ChatGPT training-data practices is one of the first substantive privacy-regulator AI-training-data determinations outside the European Union.
Activities
On May 6, 2026, the OPC determined that OpenAI's training-data practices violate PIPEDA. As of mid-2026, specific remedies and enforcement actions remained pending, and it is not yet settled whether the determination produces material remediation by OpenAI or remains an advisory finding. The finding parallels the earlier European pattern of data-protection-authority action against ChatGPT, including the Italian Garante per la protezione dei dati personali (Italy)'s 2023 measures and ongoing scrutiny by France's CNIL (CNIL (Commission nationale de l'informatique et des libertés)). (Source: covered in May 2026 dev-log.)
Positions
PIPEDA enforcement of existing privacy law functions as the operational alternative to dedicated Canadian AI legislation. The Artificial Intelligence and Data Act (Artificial Intelligence and Data Act (AIDA) — Canada (Bill C-27, Part 3)) has been delayed in Parliament, leaving the OPC to act under PIPEDA without a dedicated AI statute. Whether AIDA passes before the end of 2026, or the OPC continues operating under PIPEDA, is unresolved.
The May 6 determination was the first substantive AI-training-data finding by a privacy regulator outside the EU. It has been described as setting a potential precedent for other Commonwealth jurisdictions, with the United Kingdom's ICO (UK Information Commissioner's Office (ICO)), Australia's OAIC, and New Zealand named as regulators that may follow a comparable PIPEDA-style approach to AI training-data enforcement. Through Canada's participation in the OECD AI Principles work, OPC findings have been characterized as influencing OECD AI policy frameworks.
Relationships
- related: AI and Privacy, AI Content Licensing.
- related: Garante per la protezione dei dati personali (Italy) (EU peer), CNIL (Commission nationale de l'informatique et des libertés), UK Information Commissioner's Office (ICO) (UK peer).
- related: OpenAI (May 6 PIPEDA-finding target).
- related: Artificial Intelligence and Data Act (AIDA) — Canada (Bill C-27, Part 3).
Sources
Stub created 2026-05-11.