Remarks by the Privacy Commissioner to the Ontario Bar Association Privacy Law Summit

October 8, 2026
Toronto, ON

Address by Philippe Dufresne
Privacy Commissioner of Canada

(Check against delivery)

Good morning, thank you for the invitation to join you here today.

It is always a pleasure to speak with fellow lawyers and professionals who are immersed in data protection issues and understand the critical importance of privacy in the current environment.

Meetings such as this one also serve as an opportunity for me to hear your perspectives and concerns, which helps to inform the work of my Office, to our mutual benefit.

I want to congratulate Summit Chairs Imtiaz Karamat and Warren Urquhart for putting together a timely program that explores many of the issues that have seized regulators around the world - particularly artificial intelligence, and the myriad questions that it raises; as well as children's privacy rights and how to protect youth in the digital age.

In my remarks today, I will talk about the OPC's ongoing efforts to adapt to the growing complexity of the digital environment as we work to provide more timely outcomes for Canadians. I will also detail some of the recent work carried out by my Office to address technologies such as generative AI, and champion children's privacy. Lastly, I will touch on recent steps that the government has taken toward updating Canada's federal privacy laws.

Maximizing the OPC's impact

Artificial intelligence has become part of our daily lives, so it should come as no surprise that it is having an impact on the work of the OPC.

For example, the number of complaints that my Office received last fiscal year jumped by 82 percent over the previous year. We believe that increased public awareness and the greater visibility of our complaint form following the launch in Canada of AI-enhanced search engine functionality is at least partly responsible for this upward trend that continues today. It is in part why we are also now looking at revising the resources available on our website to ensure that they are optimized for AI.

This is just one way that the OPC is seeking to maximize its impact. My Office has also taken steps to streamline operations to deliver more timely outcomes for Canadians, including focusing, where possible, on solutions that allow us to address concerns more quickly and efficiently. The compliance letters that we reached following breaches at Nova Scotia Power and WestJet are good examples.

In those cases, my Office accepted compliance letters from the organizations, in which the organizations committed to implement certain measures to ensure adequate privacy protections for Canadians according to specified timelines. These investigations will remain open and in abeyance until I am satisfied that the companies have fulfilled all their commitments.

The approach taken in these cases marks a recognition that formal, resource-intensive investigations are not always the most effective or expeditious means of achieving regulatory compliance, though there are of course still occasions where they are the best option. We have also increased our use of proactive compliance engagements with businesses and industry sectors as a mechanism to address issues that could present a serious privacy risk to Canadians.

For instance, last year we engaged with LinkedIn to get a better understanding of, and offer recommendations to improve, its AI training practices following media reports that it was training AI models using the personal information of its members without having first notified them of the practice. As well, together with our provincial counterparts, we have reached out to select auto manufacturers to obtain more information and clarification on the connected car ecosystem.

Another way that my Office is addressing issues more efficiently and expeditiously is through our new approach to dispositions - that is, how the OPC classifies its responses to complaints, such as well-founded, or well-founded and resolved.

I have added a new disposition, "action warranted." Without making a determination about whether the Personal Information Protection and Electronic Documents Act, or PIPEDA, has been contravened, this finding indicates that the organization needs to review the matter at the heart of the complaint, and if warranted, take measures to bring itself into legal compliance.

In addition, I have started making more frequent use of powers that I have under PIPEDA to decline to investigate a complaint, or to discontinue an investigation without issuing a finding, if, for example, the complaint could more appropriately be dealt with under a different law.

The emphasis on voluntary engagements is the result of our efforts to better understand a company or industry's practices, provide recommendations to address any identified potential compliance issues, and encourage the voluntary implementation of measures to improve privacy practices.

Learning from others and identifying best practices ultimately helps shape the advice and guidance that we provide to organizations.

Another important way to maximize our impact is through collaboration with domestic, international, and cross-regulatory partners. This includes my work with the Federal, Provincial and Territorial Privacy Commissioners and Ombuds group, the G7 Data Protection and Privacy Authorities Roundtable, the Global Privacy Assembly comprised of more than 130 regulators, which I currently chair, and the Canadian Digital Regulators Forum. The latter brings together my Office and the Competition Bureau, the Canadian Radio-television and Telecommunications Commission, and the Copyright Board of Canada on matters of mutual interest related to digital markets.

Domestic and international privacy communities have stressed the importance of embedding privacy considerations into the development, deployment, and use of technologies, including AI, to enable responsible and trustworthy innovation, while also contributing to strong economies by collaborating with industry and promoting data free flow with trust and privacy enhancing technologies.

Addressing the impact of new technologies

Numerous initiatives, statements, and resolutions from these groups over the last few years have dealt with addressing the impact of new technologies, another priority area for my Office. Collectively, we have tackled topics such as educational technology and privacy, age assurance, AI-generated imagery, and data-scraping.

For instance, in response to serious concerns about the creation of explicit images without consent, I joined 60 of my global and domestic counterparts in signing a joint statement on AI-generated imagery and the protection of privacy in February.

The statement reminds organizations that AI content-generation systems must be developed and used in accordance with applicable legal frameworks, including those related to data protection and privacy.

While my Office continues to advocate for modernized Canadian privacy laws, which I will discuss more in a few moments, the 2023 G7 Data Protection and Privacy Authorities Roundtable statement holds true today - existing privacy laws apply to new technologies, including generative AI. Recent investigations into organizations deploying popular AI tools have demonstrated this.

For example, in June, I announced the results of my investigation into reports that the Grok chatbot was being used to create sexualized deepfakes. My investigation found that X Corp. and xAI violated PIPEDA by launching the Grok AI-powered image-generation tool without implementing sufficient safeguards from the outset, given the potential privacy harms.

This lack of protections allowed users to create and share sexualized deepfakes, including many targeting women and children. According to researchers, Grok was at one point generating well over 6,000 sexualized images per hour.

After the issue came to public attention, and during the investigation, X Corp. and xAI implemented new safeguards to reduce the risk that the tool would be misused to produce sexualized deepfakes.

In response to recommendations from my Office, the companies have committed to additional measures, including enhancing their processes for anticipating and mitigating privacy issues associated with image-generation tools and other novel products. They will also report to my Office on a recurring basis to explain and demonstrate the effectiveness of their safeguards, until the issue of sexualized deepfakes is fully resolved.

In May, I announced the results of a joint investigation with my counterparts in Quebec, British Columbia, and Alberta, that examined OpenAI's collection, use, and disclosure of personal information for the purpose of developing and deploying its AI-powered chatbot, ChatGPT. Our investigation ultimately concluded that the way that OpenAI had initially trained ChatGPT was not compliant with our respective privacy laws.

Throughout the course of the investigation and in response to our findings and recommendations, OpenAI implemented measures to improve protections for personal information in the ongoing development and delivery of ChatGPT and took steps to address privacy concerns in its operations.

I expect that the results of these investigations will help to inform privacy and policy direction with respect to AI and help individuals and organizations to use and deploy these technologies safely, responsibly, and with appropriate protections for personal data.

As we are seeing more and more, tools such as AI can bring important benefits to society, but their value will only be realized if individuals trust them enough to use them.

As part of building that trust, organizations that use AI should be transparent about their use, and accountable for any AI-generated decisions about individuals, such as whether to grant someone a loan or a job.

It is key for developers and providers of AI to employ privacy-by-design principles which will embed privacy in the design, conception, operation, and management of their products and services. They must consider the unique impact that these tools have on children as well as on groups that have historically experienced discrimination or bias.

This summer, I presented the Global Privacy and Human Rights Award to the Electronic Health Information Laboratory (EHIL) at the CHEO Research Institute, a leading pediatric health research institute in Ottawa, which exemplifies what can be accomplished when AI innovation prioritizes privacy.

I was pleased to present the award in my dual role as Privacy Commissioner of Canada and as Chair of the Global Privacy Assembly, which created the award in partnership with the human rights organization AccessNow. The Award recognizes outstanding leadership in privacy or data protection as well as other fundamental rights.

The team at EHIL is internationally renowned for pioneering the development of privacy-enhancing technologies that support health data sharing for purposes such as research and public health surveillance and analysis, and responsible AI development - without compromising privacy.

I have long said that as data fuels innovation, we need to use innovation to protect data. The work being carried out at EHIL is a great example of how that is possible. As privacy becomes increasingly important to consumers, prioritizing privacy in products and services will be a competitive advantage for organizations that develop and deploy technologies such as AI in a responsible, privacy-preserving manner.

Championing children's privacy

Championing children's privacy is another focus of the work that my Office has undertaken this past year.

A key initiative is the establishment of a Youth Council. Comprised of seven students aged 14 to 17 from across Canada, the Council is helping my Office better understand the impact that privacy issues have on youth.

My Office will soon be publishing a Children's Privacy Code following an exploratory consultation last year. The Youth Council is working with us to develop a youth-friendly summary of the Code, as well as an infographic for younger children.

We have seen from examples in the UK and other countries that having a code of best practices, as well as special protections in privacy legislation, can empower children to exercise their privacy rights and protect them against potential harm as they navigate online spaces.

This past May, following a public consultation, I launched two new guidance documents on age assurance. One of the documents, directed to websites and services, is about assessing whether and how to use age assurance. The other, aimed at developers, concerns design considerations for age assurance.

Together, they set out the ways in which the goal of creating a safer and more appropriate online experience for children can be advanced while mitigating potential adverse impacts on privacy.

My aim is to ensure that age assurance can support the goal of creating a safer online experience for children, without creating an undue impact on privacy rights.

In terms of investigations, last September, along with my colleagues in Quebec, British Columbia, and Alberta, I announced the results of our joint investigation into the privacy practices of TikTok, which is the social media platform most used by Canadian children and teens.

The investigation concluded that the measures used to keep children off the platform and to prevent the collection and use of their sensitive personal information for profiling and targeting purposes, were inadequate. In response, TikTok agreed to enhance its age-assurance methods, and to make privacy communications easier for children and adults to understand.

Finally, the OPC conducts a biennial Survey of Canadians to understand their knowledge of privacy rights. We are about to launch this year's survey, which for the first time will include an online survey specifically for children and teens.

Children's privacy remains a priority for my Office, as well as for many of my Canadian and international counterparts. We will continue to advance specific initiatives focused on the needs of children and youth, learn from them and those who advocate for them, and identify opportunities through research and engagement.

Law reform

Before I conclude my remarks today, I will talk briefly about recent movement toward law reform in Canada. We are on the cusp of a major change in Canada's approach to privacy, data protection, and combatting online harms, especially involving children.

In June, the federal government tabled Bill C-34, the Safe Social Media Act, which aims to protect individuals, particularly children, from harmful content online.

It followed up with Bill C-36, the Protecting Privacy and Consumer Data Act, which proposes to replace PIPEDA. I was pleased to see many of the recommendations that my Office has made over the years reflected in the Bill.

In particular, I welcome proposals to recognize privacy as a fundamental right, and an explicit recognition of the best interests of children, as well as requirements to conduct privacy impact assessments, along with stronger enforcement powers.

I note that the Bill would transfer private-sector privacy responsibilities from the OPC to the proposed Digital Safety and Data Protection Commission of Canada. The new Commission would be given the power to issue orders and administrative monetary penalties, as appropriate, in cases involving violations of the law.

The OPC has been carefully analyzing the Bill, and I look forward to providing my views and recommendations to Parliament in due course with the goal of making it the best possible legislation - to ensure that Canadians' fundamental right to privacy is protected for current and future generations.

With respect to the Privacy Act, in April the Treasury Board Secretariat invited submissions on a consultation document proposing changes to the 43-year-old legislation.

I have expressed support for many of the measures that are being proposed, including the recognition of privacy as a fundamental right. I have also proposed several additional measures, including a legislative requirement to conduct privacy impact assessments for high-risk activities and greater authority for my Office to collaborate with other oversight bodies. I remain hopeful that we will soon see updated public-sector legislation.

Conclusion

When I was appointed as Privacy Commissioner of Canada in June 2022, I said that this is a pivotal, exciting time for privacy. Four years into my mandate, it is still true.

The importance of the collective mandate that is shared by the privacy professionals in this room cannot be understated at this time of significant change and complexity. In today's data-driven digital environment, your efforts to protect privacy, whether you work as lawyers representing individuals, companies or governments, or provide advice as in-house counsel, is more important and valuable than ever.

Thank you for your time, and thank you to the Ontario Bar Association for inviting me to speak with you today. I believe that we now have time for a few questions.