--- title: "British Columbia, Canada Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/british-columbia-canada/ source_html: /jurisdictions/british-columbia-canada/index.html description: "British Columbia, Canada data protection and privacy regulation: 10 categories, 65 claims, updated 2026-11-04." generated_at: 2026-11-07T14:58:19Z content_sha256: 58b787bbde8298f3f6e1ff5e26fab9ce0d471b545b562d9e3cd4203a099d4f20 generator: "fe-fleet/md-twin@1.0" --- # British Columbia, Canada Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # British Columbia, Canada Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: artificial-intelligence Last updated 2026-11-04 · 10 categories · 65 claims · 38 sources in the cumulative register Download report (PDF) Expand all The Office of the Information and Privacy Commissioner for British Columbia (OIPC) operates independently from government, with a mandate to promote and protect the information and privacy rights of British Columbians; against that standing institutional backdrop, this cycle's developments cluster unusually heavily around algorithmic and biometric governance and around the enforcement and redress consequences that follow from it. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: AdTech & Commercial Privacy. Not fully checked this cycle: Regulator & Framework, Algorithmic, Biometric & Surveillance Governance, Enforcement & Redress (3 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=BRITISH-COLUMBIA-CANADA)[Build Report](/reports/?j=BRITISH-COLUMBIA-CANADA)[Compare](/compare/?j=BRITISH-COLUMBIA-CANADA) Framework posture Regulated (omnibus) 9 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 9 / 10 modules assessed 0 Confirmed · 9 Probable · 0 Uncertain · 1 Not yet assessed 10 Categories 0 Red categories 57 Sub-modules 65 Claims 14 Tier-1 sources Traffic-light mix 1 green 8 amber 1 n/a (sums to 10 rendered categories; click to filter) No red categories; 15 sub-modules are flagged red. Canada federal law that applies in British Columbia, Canada is covered once, on the [Canada](/jurisdictions/canada/) page. This page covers British Columbia, Canada’s own layer: its own law, regulators and enforcement. ## Jurisdiction brief Jurisdiction lead brief 1,113 Full executive summary 405 ###### Latest update · 4 November 2026 #### Lead Signal British Columbia's privacy regulator has moved from oversight posture to active compulsion against a major AI provider, and that move is now before the courts. The Office of the Information and Privacy Commissioner for British Columbia issued an order under section 38(1) of the Personal Information Protection Act compelling OpenAI to produce documents as part of an investigation into how ChatGPT handled personal information connected to the Tumbler Ridge shooting. The order rests on the Commissioner's established jurisdictional position: the Act reaches any organization that collects, uses or discloses the personal information of people living in British Columbia, regardless of where that organization is based. OpenAI has not complied quietly. It has petitioned the Supreme Court of British Columbia to quash the order, arguing that the investigation exceeds both the statutory and constitutional limits of the Commissioner's authority under the Act, and separately maintains that the inquiry amounts to a broader examination of online platforms generally rather than a targeted investigation of its own conduct. The petition was filed in late October 2026 and its outcome is not yet known. #### Other Developments No other material developments register against the provincial framework this period beyond the production-order dispute itself. #### Cross-Monitor Connections The dispute touches the perimeter of the artificial-intelligence monitor insofar as it concerns a leading AI provider's handling of personal data generated through a conversational product, and the underlying legal question — how far a provincial privacy regulator's investigative powers reach over a foreign-based platform operator — sits close to issues tracked there. Readers following algorithmic governance questions in that monitor should treat the British Columbia Supreme Court proceeding as a parallel signal worth monitoring alongside it. #### Outlook The immediate question is procedural but consequential: whether the Supreme Court of British Columbia upholds, narrows or quashes the Commissioner's production order. A ruling in the Commissioner's favour would confirm that the province's organization-based jurisdictional test extends comfortably to large foreign AI platforms and would likely embolden further investigative activity of this kind. A ruling for OpenAI would narrow the Commissioner's practical reach over such platforms and could invite similar challenges elsewhere. Either outcome will shape how assertively the Office pursues AI-linked personal-data investigations going forward, and the dispute is worth tracking through to resolution. 3 earlier updates not shown here. ###### Standing brief · as of 26 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal The Office of the Information and Privacy Commissioner for British Columbia (OIPC) operates independently from government, with a mandate to promote and protect the information and privacy rights of British Columbians; against that standing institutional backdrop, this cycle's developments cluster unusually heavily around algorithmic and biometric governance and around the enforcement and redress consequences that follow from it. British Columbia's data-protection posture recorded a period of active regulatory movement this cycle, anchored by the BC Court of Appeal's dismissal, on 2026-02-18, of Clearview AI's appeal against the OIPC's finding that Clearview contravened the Personal Information Protection Act (PIPA) by collecting and using BC residents' personal information from online sources without consent. The appellate court confirmed that PIPA applies to Clearview and does not exempt it from the consent requirement it was found to have contravened, a confirmation of PIPA's extraterritorial reach that carries High confidence, though it is sourced this cycle to Tier-3 law-firm commentary rather than the primary judgment, which was not independently retrieved from CanLII this cycle. The Clearview AI outcome doubles as this cycle's leading enforcement and redress development: the appellate loss confirms both the underlying PIPA-contravention finding and the BC-market prohibition the OIPC imposed, giving British Columbia's enforcement track record its most significant test of extraterritorial reach in this period. Separately, Bill 9, the Freedom of Information and Protection of Privacy Amendment Act, 2026, was introduced on 2026-02-26, amending the public-sector Freedom of Information and Protection of Privacy Act (FIPPA) to tighten the specificity a requester must provide in an access request, to change the response-timeline standard from "without delay" to "without unreasonable delay," and to grant the OIPC new authority to enter inter-regulator information-sharing agreements. For public-body-covered access requesters, the shift from an unqualified "without delay" standard to a more qualified "without unreasonable delay" standard, paired with tightened specificity requirements for what a request must contain, together represent a data-subject-rights change that skews toward administrative flexibility for public bodies rather than expanded requester protection. Bill 9 is a public-sector-only instrument; no corresponding PIPA private-sector amendment was identified this cycle. #### Other Developments OIPC signals PIPA is not fit for AI-driven consent. In a letter dated 2026-05-05, the OIPC stated that PIPA's consent provisions are no longer well suited to AI-driven data processing. A joint OIPC/OPC investigation found that PIPA does not enable OpenAI to establish implicit consent, and the Commissioner urged the legislature to advance its statutory review of PIPA. This is High-confidence guidance rather than binding instrument, understood as advocacy for legislative reform rather than a change in force. OIPC publishes audit and compliance-review guidance. On 2026-03-23, the OIPC published guidance on its audit, investigation, and compliance-review authority, intended to help both public bodies and private-sector organizations understand the OIPC's function in these processes. This is non-binding guidance, sourced this cycle to Tier-3 commentary. Updated Public Sector Surveillance Guidelines. In January 2026, the OIPC released updated Public Sector Surveillance Guidelines, replacing 2014 guidance and applicable to all FIPPA-covered public bodies, requiring a privacy impact assessment under FIPPA section 69(5.3) before implementing new surveillance initiatives. This is non-binding guidance sourced to Tier-3 commentary this cycle. #### Cross-Monitor Connections The OIPC's position that PIPA's consent framework is not fit for AI-driven processing, and the underlying joint investigation finding that PIPA does not enable OpenAI to establish implicit consent, is directly relevant to the artificial-intelligence monitor's tracking of AI-governance regulatory response; that analysis is not duplicated here. Clearview AI's continued facial-recognition prohibition in British Columbia, upheld on appeal, is similarly relevant to the artificial-intelligence monitor's biometric-governance tracking. Neither connection is analysed further in this brief. #### Outlook Two open questions define the near-term horizon. First, whether British Columbia's statutory six-year review of PIPA has a scheduled 2026 or 2027 date was not confirmed this cycle; the OIPC's public urging for legislative advancement of that review, set against the OpenAI investigation findings, suggests momentum but no confirmed timeline. Second, whether Bill 9 passes in its introduced form, and whether any future amendment extends beyond FIPPA into PIPA's private-sector consent framework, remains to be seen. Retrieving the primary Clearview AI appellate judgment from CanLII, rather than relying on secondary commentary, would also sharpen the evidentiary basis for that finding in a future cycle. Read full brief · 1113 words ###### Latest update · 4 November 2026 #### Regulatory Status The Office of the Information and Privacy Commissioner for British Columbia issued a production order against OpenAI under section 38(1) of the Personal Information Protection Act, escalating its oversight of AI providers' handling of personal information. The order compels OpenAI to produce documents in connection with an investigation into ChatGPT's use of personal information linked to the Tumbler Ridge shooting, and rests on the Commissioner's established jurisdiction over any organization collecting, using or disclosing the personal information of people living in the province. OpenAI has challenged that order before the Supreme Court of British Columbia, placing the Commissioner's investigative authority over foreign AI platform operators squarely in dispute, while separately maintaining that the Commissioner's inquiry amounts to an examination of online platforms generally rather than a targeted look at its own conduct. #### Outlook The province's regulatory posture toward AI providers now turns substantially on the outcome of this court challenge. A result favouring the Commissioner would confirm a broad reading of the province's jurisdictional reach over foreign platform operators; a result favouring OpenAI would constrain it. Either way, the litigation is now the central marker of how assertively the province's privacy framework will be applied to AI-linked personal-data practices going forward. 2 earlier updates not shown here. ###### Standing brief · as of 26 August 2026 #### Regulatory Status British Columbia's data-protection framework saw active movement across multiple modules this cycle. The BC Court of Appeal dismissed Clearview AI's appeal on 2026-02-18, confirming PIPA's extraterritorial application and upholding the OIPC's facial-recognition prohibition. Bill 9, introduced 2026-02-26, would amend the public-sector FIPPA regime's access-request specificity and response-timeline standard and grant the OIPC new inter-regulator information-sharing authority. The OIPC also stated, in a 2026-05-05 letter, that PIPA's consent provisions are not well suited to AI-driven processing, following a joint investigation finding that PIPA does not enable OpenAI to establish implicit consent, and published guidance on its own audit, investigation, and compliance-review authority on 2026-03-23. Updated Public Sector Surveillance Guidelines, requiring privacy impact assessments before new public-body surveillance initiatives, took effect as guidance in January 2026. #### Outlook The pace of Bill 9's legislative progress, whether the legislature responds to the OIPC's call for PIPA statutory review, and confirmation of the Clearview AI judgment's primary text are the clearest near-term items to watch for British Columbia's data-protection posture. Read full brief · 405 words Key regulatory facts for British Columbia, Canada Regulatory Dimension British Columbia, Canada Standing Position Jurisdiction British Columbia, Canada (CA-BC) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 65 sourced findings) Regulator & Framework Comprehensive, actively-enforced private-sector statute with a functioning independent regulator and confirmed federal 'substantially similar' status; recent joint enforcement (OpenAI, TikTok) demonstrates active... Lawful Processing & Special Data Core consent architecture is robust and enforced, but the absence of a codified sensitive-data category and of anonymisation safe-harbours leaves gaps relative to GDPR-style regimes. Data Subject Rights Core access/correction rights are in force and enforced, but PIPA lacks GDPR-equivalent erasure, restriction/objection, and portability rights, which remain at the recommendation stage only. Controller/Processor Duties Accountability and security-safeguard obligations are in force, but the absence of mandatory breach notification and of explicit processor/service-provider accountability are material, long-flagged gaps relative to... Primary Instruments Cited OPC Canada, OPC Canada, OPC Canada, OPC Canada / OIPC BC / OIPC AB / CAI, OIPC BC - News Release Last Confirmed / Updated 2026-11-04 (38 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### British Columbia, Canada: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive, actively-enforced private-sector statute with a functioning independent regulator and confirmed federal 'substantially similar' status; recent joint enforcement (OpenAI, TikTok) demonstrates active jurisdiction. Primary framework Personal Information Protection Act (PIPA), SBC 2003, c. 63 Supervisory authority [Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)](https://www.oipc.bc.ca/) Traffic-light rationale — Green Comprehensive, actively-enforced private-sector statute with a functioning independent regulator and confirmed federal 'substantially similar' status; recent joint enforcement (OpenAI, TikTok) demonstrates active jurisdiction. #### Sub-modules (5) #### Regulator And AuthorityGreen OIPC BC, led by Commissioner Michael Harvey as of May 2026, oversees PIPA (private sector), FIPPA (public sector), and the E-Health Act (health records). Claims (7): - The Information and Privacy Commissioner for British Columbia is responsible for overseeing and enforcing PIPA, FIPPA, and the E-Health Act. - Michael Harvey serves as the Information and Privacy Commissioner for British Columbia as of the May 2026 joint ChatGPT investigation announcement. - OIPC issued a PIPA s.38(1) production order against OpenAI. - The OIPC issued an order under PIPA s.38(1) compelling OpenAI to produce documents in its investigation of ChatGPT's use of personal information connected to the Tumbler Ridge shooting. - Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) — The OIPC BC is established to provide independent oversight and enforcement of FIPPA, PIPA, and the E-Health Act. - Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) — The OIPC BC is the regulator for both the private-sector PIPA and the public-sector FIPPA. - Office of the Information and Privacy Commissioner for British Columbia — OIPC BC is independent from government and enforces both PIPA and FIPPA. #### Act And InstrumentsGreen PIPA (SBC 2003, c. 63) is the operative private-sector instrument; FIPPA (RSBC 1996, c. 165) governs public bodies; the E-Health Act governs health-information custodians. Claims (4): - PIPA is BC's private-sector privacy law, and has been deemed 'substantially similar' to the federal PIPEDA, while FIPPA is BC's public-sector privacy law and the E-Health Act governs health records. - Bill 9 (Freedom of Information and Protection of Privacy Amendment Act, 2026) — Bill 9 was introduced in the BC Legislature on 2026-02-26 and grants the OIPC authority to enter collaboration and information-sharing agreements with other Canadian regulators. - Bill 9 (Freedom of Information and Protection of Privacy Amendment Act 2026) — Bill 9 amends FIPPA (public-sector law); BC's private-sector PIPA has not been amended and no reform bill had been announced as of June 2026. - Bill 9, Freedom of Information and Protection of Privacy Amendment Act, 2026 — Bill 9 was introduced in the BC Legislature on February 26, 2026, amending FIPPA (public-sector only); private-sector PIPA has not been amended and no PIPA reform bill has been announced as of this cycle. #### Material ScopeGreen PIPA applies to the collection, use and disclosure of personal information by private-sector organizations, including employee personal information, subject to statutory exclusions. Claims (2): - Employee personal information held by provincially-regulated organizations in British Columbia is covered by PIPA, unlike PIPEDA which excludes employee information for non-FWUB organizations. - PIPA gives the OIPC jurisdiction over organizations that collect, use or disclose the personal information of BC residents. #### Territorial ScopeGreen PIPA applies to organizations' activity within BC; a real-and-substantial-connection test extends jurisdiction to non-established foreign controllers, as confirmed in the OpenAI and TikTok joint investigations. Claims (3): - Exemption Order SOR/2004-220, issued under PIPEDA, exempts organizations from Part 1 of PIPEDA for collection, use, or disclosure of personal information occurring within British Columbia, making PIPA the operative statute for BC-internal activity even for organizations without physical presence in Canada. - The OIPC-BC and the BC Court of Appeal have confirmed that PIPA's jurisdiction extends to foreign organizations with a real and substantial connection to British Columbia, notwithstanding lack of establishment or employees in Canada prior to product launch. - The Court of Appeal for British Columbia dismissed Clearview AI's appeal, confirming PIPA applies to Clearview and that PIPA does not exempt Clearview from obtaining consent to collect personal information from online sources. #### Regulator Registration And FilingAmber PIPA does not impose a general controller registration or filing requirement on organizations. British Columbia's private-sector data protection regime is anchored in the Personal Information Protection Act (PIPA), SBC 2003, c. 63, overseen by the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC), currently led by Commissioner Michael Harvey. PIPA has been declared substantially similar to the federal PIPEDA, which carves BC-internal commercial/organizational personal-information handling out of PIPEDA's Part 1 via Exemption Order SOR/2004-220, while PIPEDA continues to govern interprovincial/international commercial transactions and federally-regulated works and undertakings (FWUBs). The OIPC BC also oversees the public-sector Freedom of Information and Protection of Privacy Act (FIPPA), RSBC 1996, c. 165, and the health-sector E-Health (Personal Health Information Access and Protection of Privacy) Act, giving it a tri-regime portfolio. Periodic update · new data 2026-11-04 #### Regulator & Framework The Office of the Information and Privacy Commissioner for British Columbia has exercised its power under section 38(1) of the Personal Information Protection Act to compel OpenAI to produce documents, in connection with an investigation into ChatGPT's use of personal information linked to the Tumbler Ridge shooting. This is a binding, in-force exercise of a core investigative power, not a proposal or a draft measure. The Commissioner's jurisdiction under the Act rests on a material-scope test turning on whether an organization collects, uses or discloses the personal information of people living in British Columbia, a test that applies irrespective of where the organization is headquartered. That standing jurisdictional basis is what the Commissioner has now applied, for the first time at this scale, against a major foreign AI provider. #### Outlook The production order is the clearest evidence yet that the Commissioner regards its organization-based jurisdictional test as reaching large AI platform operators headquartered outside Canada. How the Supreme Court of British Columbia treats the resulting challenge will determine whether that reading holds as a durable feature of the province's regulatory framework or is narrowed by judicial review. 3 earlier distinct update(s) Periodic update · new data 2026-09-28 #### Regulator & Framework The Office of the Information and Privacy Commissioner for British Columbia administers both the private-sector Personal Information Protection Act and the public-sector Freedom of Information and Protection of Privacy Act, a dual-statute authority structure that continues to define the province's regulatory architecture. This cycle's principal development sits on the public-sector side: Bill 9, the Freedom of Information and Protection of Privacy Amendment Act, 2026, was introduced in the BC Legislature on 26 February 2026. The Bill would grant the OIPC authority to enter collaboration and information-sharing agreements with other Canadian regulators, extending the Commissioner's capacity to coordinate with counterpart bodies elsewhere in Canada. This is a public-sector FIPPA amendment; the private-sector PIPA statute is not affected by Bill 9 and remains in its existing form. The Bill has not been enacted; it has been introduced and remains before the Legislature, so the collaboration-agreement authority is not yet in force. #### Outlook Whether and when Bill 9 proceeds to enactment will determine when the OIPC's expanded collaboration authority takes effect. The wider question left open by this cycle is whether the dual-statute structure itself, with FIPPA advancing while PIPA remains static, will be addressed as a single reform package or continue to develop on separate legislative timelines. Periodic update · new data 2026-09-22 #### Regulator & Framework The Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) provides independent oversight and enforcement of the province's Freedom of Information and Protection of Privacy Act (FIPPA), the Personal Information Protection Act (PIPA), and the E-Health Act. This cycle's structural development is Bill 9, the Freedom of Information and Protection of Privacy Amendment Act 2026, which amends FIPPA — the public-sector statute — but leaves PIPA, the private-sector law, unamended. As of mid-2026, no reform bill for PIPA had been announced, despite mounting pressure from the Commissioner's office following its findings on AI-related consent gaps. This asymmetry is the key structural fact for the framework this cycle: public-sector information and privacy law is actively being modernised through Bill 9, while private-sector privacy law remains on its existing statutory footing even as the Commissioner has publicly signalled that its consent provisions are strained by contemporary data-driven processing, particularly involving AI. The regulator's dual public/private mandate under FIPPA and PIPA respectively means these two tracks can and do move at different speeds, and this cycle illustrates exactly that divergence. #### Outlook Watch for whether the pressure generated by the OIPC/OPC OpenAI investigation translates into a formal PIPA reform bill, distinct from and following the FIPPA-focused Bill 9 track, which is understood to be progressing separately. Periodic update · new data 2026-09-14 #### Regulator & Framework The Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) remains independent from government and enforces both the Personal Information Protection Act (PIPA), which governs the private sector, and the Freedom of Information and Protection of Privacy Act (FIPPA), which governs public bodies. This cycle produced two material developments in the framework itself. First, Bill 9, the Freedom of Information and Protection of Privacy Amendment Act, 2026, was introduced in the BC Legislature on February 26, 2026, amending FIPPA. Second, and by contrast, private-sector PIPA has not been amended, and no PIPA reform bill has been announced as of this cycle, despite ongoing OIPC advocacy for statutory review of the private-sector regime. The Court of Appeal for British Columbia's dismissal of Clearview AI's appeal is a significant framework-level development in its own right: the court confirmed that PIPA applies to Clearview and that the statute does not exempt the company from obtaining consent to collect personal information from online sources. This is an appellate-level confirmation of PIPA's extraterritorial and biometric-data reach, strengthening the practical scope of the statute even as the underlying legislative text remains unreformed. The asymmetry between active public-sector reform and stalled private-sector reform is the framework-level story of this cycle: BC's regulator and courts are extending PIPA's practical reach through enforcement and litigation even as the legislature has not yet moved to modernise the statute's text for AI-era data practices. #### Outlook Watch for whether Bill 9 receives royal assent, and whether the OIPC's renewed advocacy — prompted by the OpenAI investigation findings — results in an announced PIPA reform bill. The gap between public-sector legislative movement and private-sector statutory stasis is likely to remain the defining framework tension into the next cycle. Sources and claims (16) - [OPC Canada](https://www.priv.gc.ca/en/about-the-opc/what-we-do/provincial-and-territorial-collaboration/provincial-and-territorial-privacy-laws-and-oversight/) — The Information and Privacy Commissioner for British Columbia is responsible for overseeing and enforcing PIPA, FIPPA, and the E-Health Act. - [OPC Canada](https://www.priv.gc.ca/en/opc-news/news-and-announcements/2026/ma_260504/) — Michael Harvey serves as the Information and Privacy Commissioner for British Columbia as of the May 2026 joint ChatGPT investigation announcement. - [OPC Canada](https://www.priv.gc.ca/en/about-the-opc/what-we-do/provincial-and-territorial-collaboration/provincial-and-territorial-privacy-laws-and-oversight/) — PIPA is BC's private-sector privacy law, and has been deemed 'substantially similar' to the federal PIPEDA, while FIPPA is BC's public-sector privacy law and the E-Health Act governs health records. - [OPC Canada](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/02_05_d_26/) — Employee personal information held by provincially-regulated organizations in British Columbia is covered by PIPA, unlike PIPEDA which excludes employee information for non-FWUB organizations. - [OPC Canada / OIPC BC / OIPC AB / CAI](https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-002/) — Exemption Order SOR/2004-220, issued under PIPEDA, exempts organizations from Part 1 of PIPEDA for collection, use, or disclosure of personal information occurring within British Columbia, making PIPA the operative statute for BC-internal activity even for organizations without physical presence in Canada. - [OPC Canada / OIPC BC / OIPC AB / CAI](https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-002/) — The OIPC-BC and the BC Court of Appeal have confirmed that PIPA's jurisdiction extends to foreign organizations with a real and substantial connection to British Columbia, notwithstanding lack of establishment or employees in Canada prior to product launch. - [OIPC BC - News Release](https://www.oipc.bc.ca/documents/news-releases/3260) — OIPC issued a PIPA s.38(1) production order against OpenAI. - [OIPC BC - News Release](https://www.oipc.bc.ca/documents/news-releases/3260) — Bill 9 (Freedom of Information and Protection of Privacy Amendment Act, 2026) — Bill 9 was introduced in the BC Legislature on 2026-02-26 and grants the OIPC authority to enter collaboration and information-sharing agreements with other Canadian regulators. - [Fasken](https://www.fasken.com/en/knowledge/2026/04/faskens-noteworthy-news-privacy-cybersecurity-in-canada-the-us-and-the-eu-april-2026) — The Court of Appeal for British Columbia dismissed Clearview AI's appeal, confirming PIPA applies to Clearview and that PIPA does not exempt Clearview from obtaining consent to collect personal information from online sources. - [Office of the Information and Privacy Commissioner for British Columbia](https://www.oipc.bc.ca/) — The OIPC issued an order under PIPA s.38(1) compelling OpenAI to produce documents in its investigation of ChatGPT's use of personal information connected to the Tumbler Ridge shooting. - [Office of the Information and Privacy Commissioner for British Columbia](https://www.oipc.bc.ca/documents/news-releases/3104) — PIPA gives the OIPC jurisdiction over organizations that collect, use or disclose the personal information of BC residents. - [OIPC BC - News Release](https://www.oipc.bc.ca/documents/news-releases/3260) — Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) — The OIPC BC is established to provide independent oversight and enforcement of FIPPA, PIPA, and the E-Health Act. - [Teresa Scassa's Substack](https://teresascassa.substack.com/p/openai-challenges-bc-privacy-commissioners) — Bill 9 (Freedom of Information and Protection of Privacy Amendment Act 2026) — Bill 9 amends FIPPA (public-sector law); BC's private-sector PIPA has not been amended and no reform bill had been announced as of June 2026. - [DataGuidance](https://www.dataguidance.com/jurisdictions/british-columbia) — Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) — The OIPC BC is the regulator for both the private-sector PIPA and the public-sector FIPPA. - [Office of the Information and Privacy Commissioner for British Columbia](https://www.oipc.bc.ca/) — Office of the Information and Privacy Commissioner for British Columbia — OIPC BC is independent from government and enforces both PIPA and FIPPA. - [Office of the Information and Privacy Commissioner for British Columbia](https://www.oipc.bc.ca/documents/news-releases/3104) — Bill 9, Freedom of Information and Protection of Privacy Amendment Act, 2026 — Bill 9 was introduced in the BC Legislature on February 26, 2026, amending FIPPA (public-sector only); private-sector PIPA has not been amended and no PIPA reform bill has been announced as of this cycle. ### British Columbia, Canada: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core consent architecture is robust and enforced, but the absence of a codified sensitive-data category and of anonymisation safe-harbours leaves gaps relative to GDPR-style regimes. Primary framework Personal Information Protection Act (PIPA), SBC 2003, c. 63 Supervisory authority [Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)](https://www.oipc.bc.ca/) Traffic-light rationale — Amber Core consent architecture is robust and enforced, but the absence of a codified sensitive-data category and of anonymisation safe-harbours leaves gaps relative to GDPR-style regimes. Periodic update · new data 2026-09-28 #### Lawful Processing & Special Data The OIPC's joint investigation with the federal Office of the Privacy Commissioner into OpenAI's personal-information processing produced this cycle's most consequential lawful-processing finding: PIPA does not enable OpenAI to establish implicit consent for its processing of personal information, and the Commissioner stated that PIPA's consent provisions are no longer well suited to AI-driven data processing. This is a live regulatory finding directly implicating the statutory consent basis under which private-sector organisations in British Columbia operate. The finding is significant because it identifies a structural mismatch between PIPA's existing consent framework, built around traditional notice-and-consent mechanics, and the scale and opacity of AI-driven processing. The Commissioner's own investigation report and any remedial order arising from it have not been independently confirmed beyond the Commissioner's letter, so the practical consequences for OpenAI's BC-facing operations, and for other AI processors relying on similar consent theories, remain to be seen. #### Outlook The OIPC's finding creates pressure for legislative attention to PIPA's consent provisions, though no reform proposal specific to consent has yet been introduced; Bill 9 addresses only the public-sector FIPPA. Whether the OpenAI investigation results in a formal order, and whether it prompts a parallel private-sector reform push, are the developments most likely to determine how this finding translates into binding obligations. Periodic update · new data 2026-09-22 #### Lawful Processing & Special Data A joint investigation by OIPC BC and the federal Office of the Privacy Commissioner (OPC) into OpenAI, with findings published in May 2026, found that PIPA does not enable OpenAI to establish implicit consent for its processing of personal information. The Commissioner stated directly that PIPA's consent provisions are no longer well suited to today's data-driven world. This is a Confirmed finding, sourced from the regulator's own public comments, and it is the most consequential lawful-processing development for British Columbia this cycle. The finding matters because PIPA's consent framework is fundamentally implicit-consent-permissive in structure, and the investigation concluded that societal expectations about AI and the organisational risk-mitigation steps involved have moved outside the scope that PIPA's current consent provisions can reasonably accommodate. This is not a finding limited to OpenAI specifically — it identifies a structural feature of the statute itself, one that the Commissioner has flagged as a candidate for reform. No change to the statute has yet occurred; the finding stands as an authoritative regulatory assessment of the existing law's limits, not a legislative amendment. #### Outlook The practical question for organisations relying on implicit consent for AI-adjacent processing in British Columbia is whether this finding will be treated as persuasive guidance ahead of any statutory change, and whether the Commissioner's advocacy for an accelerated PIPA review translates into a formal reform timeline. Periodic update · new data 2026-09-14 #### Lawful Processing & Special Data A joint investigation by OIPC BC and the federal Office of the Privacy Commissioner found that PIPA does not enable OpenAI to establish implicit consent for its data-processing practices. Notably, this finding held even in circumstances where OpenAI's actions were understood to be sufficient to satisfy the federal OPC's own implied-consent standard under PIPEDA, indicating that BC's PIPA applies a more exacting consent threshold than the federal private-sector standard in at least this instance. This is a Confirmed, Tier-1-sourced finding directly from the regulator's own joint investigation report, and it is material: it establishes, for a globally significant AI company, that BC's consent framework does not automatically defer to whatever a federal-standard analysis would permit. The finding functions as a de facto precedent for how PIPA's consent provisions apply to large-scale AI training and data-processing operations, even though the underlying statute has not been formally amended to address AI-specific processing. #### Outlook The key open question is what remedial or compliance steps, if any, OpenAI must take in response to the joint investigation's findings, and whether other AI companies operating in or processing BC residents' data face similar scrutiny under the same implicit-consent reasoning. This finding is also the direct trigger for the OIPC's renewed calls for statutory PIPA reform addressing AI-era consent standards. D2 · Lawful Processing — Full Module Record 4 sub-modules · 72 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### British Columbia, Canada: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core access/correction rights are in force and enforced, but PIPA lacks GDPR-equivalent erasure, restriction/objection, and portability rights, which remain at the recommendation stage only. Primary framework Personal Information Protection Act (PIPA), SBC 2003, c. 63 Supervisory authority [Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)](https://www.oipc.bc.ca/) Traffic-light rationale — Amber Core access/correction rights are in force and enforced, but PIPA lacks GDPR-equivalent erasure, restriction/objection, and portability rights, which remain at the recommendation stage only. #### Sub-modules (5) #### Access RightGreen Individuals may request access to personal information about them held by an organization, subject to enumerated exceptions. Claims (3): - Individuals have a right to know the details of unauthorized access of their personal information and, more broadly, a right to access personal information held about them by an organization subject to statutory exceptions. - Office of the Information and Privacy Commissioner for British Columbia — OIPC BC published an order ('Strata Corporation EPS 6040') under PIPA s.23(1) addressing an individual's request for access to their own personal information from a strata corporation; published ~6 Oct 2026. - Bill 9 (Freedom of Information and Protection of Privacy Amendment Act, 2026) — Bill 9 changes the FIPPA duty to respond to access requests from without delay to without unreasonable delay and requires requests to provide enough detail for an experienced employee to identify the record in a reasonable time. #### Rectification And ErasureAmber PIPA provides a correction right for inaccurate/incomplete information; a standalone erasure/'right to be forgotten' is not currently codified and was flagged by the OIPC as a reform priority going further than the federal C-11 proposal. Claims (1): - The OIPC BC's PIPA-reform recommendations included a 'Right to be Forgotten' proposal on which the federal OPC stated it would go further than the BC recommendation. #### Restriction And ObjectionRed PIPA does not contain a general statutory right to restrict processing or object to processing/profiling; automated-decision-making transparency was among the OIPC's 12 reform recommendations, not yet enacted. Claims (1): - Automated decision-making transparency was among the 12 recommendations made by the OIPC BC for PIPA reform, indicating it is not currently a codified right under PIPA. #### Data PortabilityRed PIPA does not currently include a data-portability right; portability was one of the OIPC's 12 PIPA-reform recommendations. Claims (2): - Data portability was among the 12 recommendations made by the OIPC BC for PIPA reform, confirming it is not a currently codified statutory right. - Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) — OIPC BC has recommended reforming PIPA to introduce data portability and automated-decision-making requirements, which do not currently exist under the Act. #### Deadlines And Response WindowsAmber PIPA requires organizations to respond to access requests within a defined statutory window; exact day-count was not independently re-verified against the current consolidated statute text in this research pass. PIPA provides individuals a right of access to their own personal information held by an organization and a right to request correction of inaccurate or incomplete information. PIPA does not currently contain an explicit right to erasure/be-forgotten, a general right to restrict or object to processing, or a data-portability right; the BC Special Committee's December 2021 reform report recommended adding several of these rights, but as of this run they remain proposed rather than enacted. Periodic update · new data 2026-09-28 #### Data Subject Rights Bill 9 is understood to change the Freedom of Information and Protection of Privacy Act's duty to respond to access requests from a duty to respond without delay to a duty to respond without unreasonable delay. The Bill is also understood to require that access requests provide enough detail for an experienced employee of the public body to identify the record being sought within a reasonable time. Both changes apply to the public-sector FIPPA regime only; the private-sector PIPA access-right provisions are not affected. The practical effect, if enacted, would be a softened response-time standard paired with a tightened specificity requirement on the requester's side. Read together, these amendments shift some of the practical burden of the access-request process toward the requester at the margin, while giving public bodies a more flexible timeline standard than the current without delay wording. #### Outlook The Bill has not been enacted; it remains before the Legislature. Passage would settle whether these changes proceed as introduced or are amended during the legislative process. No corresponding change to the private-sector PIPA access-right regime has been proposed this cycle. Sources and claims (7) - [OPC Canada](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/02_05_d_26/) — Individuals have a right to know the details of unauthorized access of their personal information and, more broadly, a right to access personal information held about them by an organization subject to statutory exceptions. - [OPC Canada](https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/bc_20210622/comp_bc_20210622/) — The OIPC BC's PIPA-reform recommendations included a 'Right to be Forgotten' proposal on which the federal OPC stated it would go further than the BC recommendation. - [OPC Canada](https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/bc_20210622/comp_bc_20210622/) — Automated decision-making transparency was among the 12 recommendations made by the OIPC BC for PIPA reform, indicating it is not currently a codified right under PIPA. - [OPC Canada](https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/bc_20210622/comp_bc_20210622/) — Data portability was among the 12 recommendations made by the OIPC BC for PIPA reform, confirming it is not a currently codified statutory right. - [Office of the Information and Privacy Commissioner for British Columbia](https://www.oipc.bc.ca/) — Office of the Information and Privacy Commissioner for British Columbia — OIPC BC published an order ('Strata Corporation EPS 6040') under PIPA s.23(1) addressing an individual's request for access to their own personal information from a strata corporation; published ~6 Oct 2026. - [Mondaq](https://www.mondaq.com/canada/data-protection/1000274/british-columbia-privacy-czar-recommends-reforms-to-privacy-legislation) — Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) — OIPC BC has recommended reforming PIPA to introduce data portability and automated-decision-making requirements, which do not currently exist under the Act. - [Lawson Lundell LLP](https://www.lawsonlundell.com/publication/changes-are-coming-to-bc-privacy-laws) — Bill 9 (Freedom of Information and Protection of Privacy Amendment Act, 2026) — Bill 9 changes the FIPPA duty to respond to access requests from without delay to without unreasonable delay and requires requests to provide enough detail for an experienced employee to identify the record in a reasonable time. ### British Columbia, Canada: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Accountability and security-safeguard obligations are in force, but the absence of mandatory breach notification and of explicit processor/service-provider accountability are material, long-flagged gaps relative to peer Canadian regimes and GDPR. Primary framework Personal Information Protection Act (PIPA), SBC 2003, c. 63 Supervisory authority [Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)](https://www.oipc.bc.ca/) Traffic-light rationale — Amber Accountability and security-safeguard obligations are in force, but the absence of mandatory breach notification and of explicit processor/service-provider accountability are material, long-flagged gaps relative to peer Canadian regimes and GDPR. Periodic update · new data 2026-09-22 #### Controller/Processor Duties In January 2026, OIPC BC released updated Public Sector Surveillance Guidelines, replacing guidance dating to 2014. The new guidelines require completion of a privacy impact assessment under FIPPA section 69(5.3) before a public body may implement a new surveillance initiative. This is a Confirmed, in-force development affecting public-body accountability duties specifically; it does not alter private-sector controller/processor obligations under PIPA, which remain governed by that Act's existing accountability provisions. The update raises the practical accountability bar for public bodies contemplating surveillance deployments, formalising the privacy-impact-assessment step as a precondition rather than a best-practice recommendation. This sits alongside, but is distinct from, the private-sector consent gap identified in the concurrent OpenAI investigation: the surveillance guidelines address process discipline for public-body surveillance, while the OpenAI findings address the substantive adequacy of PIPA's consent basis for private-sector AI processing. Together they illustrate two separate fronts on which BC's privacy accountability framework is under active scrutiny this cycle — one procedural and public-sector-facing, the other substantive and private-sector-facing. #### Outlook Watch for how public bodies operationalise the new privacy-impact-assessment requirement in practice, and whether any enforcement action tests the boundaries of the FIPPA section 69(5.3) obligation in the coming cycles. D4 · Controller & Processor — Full Module Record 7 sub-modules · 114 words · 12 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### British Columbia, Canada: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Private-sector transfer mechanics are well-settled via the PIPEDA/PIPA interlock, but the 2021 removal of BC's public-sector data-residency mandate in favour of yet-unspecified regulations creates ongoing uncertainty flagged by the regulator itself. Primary framework Personal Information Protection Act (PIPA), SBC 2003, c. 63 / Freedom of Information and Protection of Privacy Act, RSBC 1996, c. 165 Supervisory authority [Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)](https://www.oipc.bc.ca/) Traffic-light rationale — Amber Private-sector transfer mechanics are well-settled via the PIPEDA/PIPA interlock, but the 2021 removal of BC's public-sector data-residency mandate in favour of yet-unspecified regulations creates ongoing uncertainty flagged by the regulator itself. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 105 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### British Columbia, Canada: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Health and employment overlays are well-documented and in force; several other sectoral sub-modules show no BC-specific overlay, which is itself a legitimate finding rather than a research gap. Primary framework E-Health (Personal Health Information Access and Protection of Privacy) Act / Personal Information Protection Act (PIPA) Supervisory authority [Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)](https://www.oipc.bc.ca/) Traffic-light rationale — Amber Health and employment overlays are well-documented and in force; several other sectoral sub-modules show no BC-specific overlay, which is itself a legitimate finding rather than a research gap. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 72 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### British Columbia, Canada: D7 AdTech & Commercial Privacy 6 sub-modules Not assessed ▾ No BC-specific adtech statute exists; coverage relies entirely on PIPA's general consent/purpose principles, which is a materially thinner regime than jurisdictions with dedicated adtech rules (e.g., US-CA CPRA). Primary framework Personal Information Protection Act (PIPA), SBC 2003, c. 63 Supervisory authority [Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)](https://www.oipc.bc.ca/) Traffic-light rationale — Not assessed No BC-specific adtech statute exists; coverage relies entirely on PIPA's general consent/purpose principles, which is a materially thinner regime than jurisdictions with dedicated adtech rules (e.g., US-CA CPRA). #### Sub-modules (6) #### Cookies And TrackersAmber No BC-specific cookie-consent statute exists; general PIPA consent/purpose principles apply to online tracking by BC-regulated organizations. Claims (1): - An organization may collect, use or disclose personal information under PIPA only for a purpose that a reasonable person would consider appropriate in the circumstances, per sections 11 and 14. #### Dark PatternsRed No codified dark-pattern prohibition exists under PIPA. #### Opt Out SignalsRed PIPA does not recognize a codified universal opt-out signal (e.g., Global Privacy Control) mechanism. #### Clean Rooms And DcrRed No clean-room or data-collaboration-room-specific rules exist under PIPA. #### Cross Context AdvertisingAmber PIPA has no CPRA-style 'sale'/'share' construct for cross-context advertising; general consent/purpose-limitation rules apply instead. Claims (1): - An organization may collect, use or disclose personal information under PIPA only for a purpose that a reasonable person would consider appropriate in the circumstances, per sections 11 and 14. #### Direct MarketingAmber Direct marketing by BC organizations is subject to PIPA's general consent principles and, separately, to the federal Anti-Spam Legislation (CASL) for electronic messages, which sits outside PIPA proper. Claims (1): - Sections 6-8 of PIPA-BC require the consent of individuals for the collection, use or disclosure of their personal information, unless an exception applies. PIPA applies general consent and purpose-limitation principles to cookie/tracker use, direct marketing, and cross-context data use, but BC has no dedicated cookie-consent statute, no codified dark-pattern prohibition, no recognition regime for opt-out signals (e.g., Global Privacy Control), and no clean-room/data-collaboration-specific rules. Direct marketing is additionally governed federally by Canada's Anti-Spam Legislation (CASL), outside this JID's PIPA scope. ### British Columbia, Canada: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong, recent case-law-driven biometric protection exists via joint enforcement, but statutory ADM-transparency, genetic-data, and AI-risk-assessment provisions remain absent or only proposed. Primary framework Personal Information Protection Act (PIPA), SBC 2003, c. 63 Supervisory authority [Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)](https://www.oipc.bc.ca/) Traffic-light rationale — Amber Strong, recent case-law-driven biometric protection exists via joint enforcement, but statutory ADM-transparency, genetic-data, and AI-risk-assessment provisions remain absent or only proposed. Periodic update · new data 2026-11-04 #### Algorithmic, Biometric & Surveillance Governance The investigation into ChatGPT's handling of personal information in connection with the Tumbler Ridge shooting places an AI chatbot provider's data practices squarely within the Commissioner's investigative reach, exercised through a binding production order under the Act. The precise scope of what the investigation examines within OpenAI's practices has not been fully clarified in public materials to date. OpenAI, for its part, characterises the inquiry as reaching beyond its own conduct into an examination of online platforms generally, a framing the Commissioner has not confirmed. #### Outlook Whether this matter settles as a narrow inquiry into a single incident or develops into a broader examination of how conversational AI systems handle personal data will depend on how the production-order litigation resolves and on what the Commissioner does with any documents it ultimately obtains. Periodic update · new data 2026-09-28 #### Algorithmic, Biometric & Surveillance Governance The OIPC is reported to have released updated Public Sector Surveillance Guidelines in January 2026, replacing guidelines that had been in place since 2014. The updated guidelines are understood to apply to all public bodies subject to FIPPA, including ministries, local governments, schools, Crown corporations, hospitals, and municipal police forces. This is sourced via secondary law-firm commentary rather than direct confirmation against the guidelines' primary OIPC text, so the specific content changes between the 2014 and 2026 versions have not been independently verified this pass. A twelve-year gap between guidance updates suggests the refresh responds to a substantially changed surveillance-technology landscape across BC's public sector, spanning municipal policing through to hospital and school surveillance practices, though the precise substantive changes remain to be confirmed against the primary document. #### Outlook Confirming the updated guidelines against the OIPC's own primary text would sharpen understanding of what specifically changed for public bodies conducting surveillance activity. Given the breadth of bodies affected, from municipal police forces to school districts, the practical implementation of the updated guidance across such a varied set of public bodies is a development worth tracking further. Periodic update · new data 2026-09-22 #### Algorithmic, Biometric & Surveillance Governance The joint OIPC/OPC investigation into OpenAI, concluded and published in May 2026, is the headline algorithmic-governance development for British Columbia this cycle. The investigation concluded that societal expectations about AI and the organisational risk-mitigation steps involved have moved outside the scope that PIPA's current consent provisions can reasonably accommodate, and specifically found that PIPA does not enable OpenAI to establish implicit consent for its AI training and processing activities. This is a Confirmed finding directly from the regulators' own published comments. In direct response, OIPC Commissioner Michael Harvey encouraged government to advance the timing of the legislature's statutory review of PIPA in light of these AI-related consent gaps, and offered OIPC's support for a statutory reform effort. This is a notable escalation: a joint investigation with a national-level counterpart producing a public call from the provincial Commissioner for accelerated legislative attention specifically because of AI's implications for the province's consent-based privacy law. It signals that algorithmic governance is now a driving force behind privacy-law reform pressure in British Columbia, rather than a peripheral consideration. #### Outlook The determinative question is whether the legislature responds to the Commissioner's call by advancing the statutory PIPA review ahead of its normal six-year cycle. The Interpreter's evidence treats this as a proposed, not yet formalised, possibility with a full year of timing uncertainty. Periodic update · new data 2026-09-14 #### Algorithmic, Biometric & Surveillance Governance This was a material cycle for algorithmic and biometric governance in BC. The Court of Appeal for British Columbia dismissed Clearview AI's appeal, confirming that PIPA applies to Clearview and that the statute does not exempt the company from obtaining consent to collect personal information from online sources — an appellate-level confirmation of PIPA's reach over biometric facial-recognition data sourced from public online platforms. Separately, the OIPC-OPC joint investigation into OpenAI found that PIPA does not enable the company to establish implicit consent for its data-processing practices, even where OpenAI's mitigation steps were understood to satisfy the federal OPC's implied-consent standard under PIPEDA. This finding prompted the Commissioner to renew calls for PIPA reform specifically addressing AI-era consent standards, effectively functioning as a de facto AI risk-assessment precedent under a statute that does not yet contain AI-specific provisions. On the public-sector surveillance side, OIPC BC released updated Public Sector Surveillance Guidelines in January 2026, replacing guidance dating from 2014. These apply to all FIPPA-covered public bodies, including ministries, local governments, schools, Crown corporations, hospitals and municipal police, and reiterate privacy-impact-assessment obligations for surveillance systems deployed by those bodies. Taken together, these three developments — a biometric appellate ruling, an AI-consent enforcement finding, and updated public-sector surveillance guidance — establish BC as an unusually active jurisdiction for algorithmic and biometric governance this cycle, operating substantially through enforcement, litigation and guidance rather than through new statutory text. #### Outlook Watch for whether the OpenAI investigation's findings translate into concrete compliance changes, whether further biometric-technology enforcement follows the Clearview AI precedent, and whether the OIPC's AI-consent-reform advocacy gains legislative traction alongside the currently public-sector-only Bill 9 reform track. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 84 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### British Columbia, Canada: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ No codified statutory age-of-consent or parental-consent regime exists, but active, recent joint enforcement (TikTok 2025) demonstrates the regulator applying general consent principles rigorously to protect minors. Primary framework Personal Information Protection Act (PIPA), SBC 2003, c. 63 Supervisory authority [Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)](https://www.oipc.bc.ca/) Traffic-light rationale — Amber No codified statutory age-of-consent or parental-consent regime exists, but active, recent joint enforcement (TikTok 2025) demonstrates the regulator applying general consent principles rigorously to protect minors. D9 · Children's Privacy — Full Module Record 5 sub-modules · 73 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### British Columbia, Canada: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Order-making powers are real and recently exercised via major joint AI/platform investigations, but the absence of AMPs constrains the deterrent strength of BC's enforcement regime relative to Quebec, the federal CPPA proposal, and GDPR-style regimes. Primary framework Personal Information Protection Act (PIPA), SBC 2003, c. 63 Supervisory authority [Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)](https://www.oipc.bc.ca/) Traffic-light rationale — Amber Order-making powers are real and recently exercised via major joint AI/platform investigations, but the absence of AMPs constrains the deterrent strength of BC's enforcement regime relative to Quebec, the federal CPPA proposal, and GDPR-style regimes. Periodic update · new data 2026-11-04 #### Enforcement & Redress OpenAI has filed a petition in the Supreme Court of British Columbia seeking to quash the Commissioner's production order, arguing the investigation exceeds the statutory and constitutional limits of the Commissioner's authority under the Act. The petition, filed in late October 2026, directly contests the Commissioner's exercise of its section 38(1) compulsion power and sets up a judicial test of how far that power extends over a foreign-based AI platform operator. The outcome of the petition is not yet known. #### Outlook This is now the live enforcement story in the province: a direct judicial test of the Commissioner's authority to compel document production from a major AI provider. Resolution of the petition will set the practical ceiling on how the Commissioner can pursue investigations of this kind going forward, and the case is worth tracking through to judgment. Periodic update · new data 2026-10-25 #### Enforcement & Redress The Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) is understood to have opened an investigation into the City of Kamloops after the City reported that Mayor Reid Hamer-Jackson had disclosed personal information without authorization under the Freedom of Information and Protection of Privacy Act (FIPPA), with the matter first listed on 9 October 2026. The investigation is active and its outcome has not yet been determined. Separately, OIPC BC is understood to have issued an order concerning the City of Port Moody's response to an access request for workplace investigation records, first listed on 6 October 2026, after an applicant sought access to those records under FIPPA. The order addresses the sufficiency of the City's response; the full disposition has not been retrieved. Both matters arise under the existing FIPPA framework rather than under any amended provision, and neither has reached a concluded outcome as at the dates listed above. #### Outlook The Kamloops investigation remains open, with the Mayor's alleged unauthorized disclosure under FIPPA unresolved. The Port Moody access order stands as the more recent dated development in the public-body access-and-disclosure space, with its full terms not yet confirmed. Both matters sit within OIPC BC's ordinary adjudicative and investigative function over public bodies under FIPPA. Periodic update · new data 2026-09-28 #### Enforcement & Redress The OIPC does not currently have administrative-monetary-penalty power under PIPA. The Commissioner has recommended that such power be added, modelled on section 17.1 of the federal Personal Information Protection and Electronic Documents Act, but this recommendation remains unenacted as of this cycle. This standing gap in the OIPC's enforcement toolkit sits in contrast to the Commissioner's own finding, described elsewhere this cycle, that PIPA's consent provisions are no longer well suited to AI-driven data processing: the regulator has identified a substantive gap in the statute it administers but lacks the administrative-penalty power that other Canadian privacy regulators, including the federal Privacy Commissioner under PIPEDA, already hold. Separately, the OIPC is reported to be monitoring a privacy breach involving the Canvas platform and urging prompt breach reporting by both public and private bodies. This is sourced only via a third-party jurisdiction tracker, and no OIPC primary release confirming this specific monitoring activity was independently retrieved this pass, so the claim should be treated as uncertain pending confirmation. #### Outlook Whether the OIPC's standing recommendation for PIPEDA-style administrative-monetary-penalty power is taken up by the Legislature remains open; no legislative vehicle for that specific reform was identified this cycle, and Bill 9 does not address it. Confirmation of the Canvas platform breach-monitoring activity against a primary OIPC source would also sharpen the enforcement picture. Periodic update · new data 2026-09-22 #### Enforcement & Redress The OIPC/OPC joint investigation into OpenAI is this cycle's headline enforcement and oversight activity, concluding that PIPA does not enable OpenAI to establish implicit consent and that the Act's consent provisions are no longer well suited to AI-era data processing. This is a Confirmed finding from a primary regulatory source, functioning as an authoritative oversight determination even though it does not itself impose a financial penalty. Separately, OIPC BC has recommended that it be granted the ability to impose administrative monetary penalties and to enter into PIPEDA-section-17.1-style compliance agreements — enforcement powers that PIPA does not currently confer on the Commissioner. This recommendation, rated Probable, is forward-looking and has not been enacted; it reflects the Commissioner's own assessment that the office's current toolkit is inadequate relative to comparable federal enforcement mechanisms. Read together, this cycle shows a regulator whose substantive findings (the OpenAI consent gap) are outpacing its formal enforcement powers, which remain limited to investigation and public reporting rather than monetary sanction. #### Outlook Watch for whether the enforcement-powers recommendation gains legislative traction alongside, or independently of, the broader PIPA consent-reform pressure generated by the OpenAI investigation. Absent expanded powers, OIPC BC's redress toolkit for findings of this kind remains investigative rather than punitive. Periodic update · new data 2026-09-14 #### Enforcement & Redress Enforcement activity escalated materially in BC this cycle. The Court of Appeal for British Columbia dismissed Clearview AI's appeal, upholding OIPC's original enforcement order and confirming that PIPA applies to the company with no exemption from consent requirements for collecting personal information from online sources. This is a Confirmed, appellate-level enforcement outcome, and it represents the culmination of a multi-year enforcement and litigation process against Clearview AI. Separately, the OIPC's joint investigation with the federal OPC into OpenAI's data-processing practices, while framed primarily as a consent-standard finding, also functions as an enforcement-and-redress matter: it establishes formally that PIPA was not satisfied by OpenAI's mitigation steps, a finding that carries direct redress implications for BC residents whose data was processed by OpenAI without adequate consent under BC's standard. #### Outlook The Clearview AI Court of Appeal decision closes that particular enforcement matter at the appellate level, but its precedential effect on future biometric-technology enforcement in BC is the item to watch. For the OpenAI matter, watch for what redress or remedial steps, if any, follow the joint investigation's findings. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 99 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties