British Columbia, Canada Data Protection & Privacy Regulation

Lawful Processing & Special Data

The OIPC's joint investigation with the federal Office of the Privacy Commissioner into OpenAI's personal-information processing produced this cycle's most consequential lawful-processing finding: PIPA does not enable OpenAI to establish implicit consent for its processing of personal information, and the Commissioner stated that PIPA's consent provisions are no longer well suited to AI-driven data processing. This is a live regulatory finding directly implicating the statutory consent basis under which private-sector organisations in British Columbia operate.

The finding is significant because it identifies a structural mismatch between PIPA's existing consent framework, built around traditional notice-and-consent mechanics, and the scale and opacity of AI-driven processing. The Commissioner's own investigation report and any remedial order arising from it have not been independently confirmed beyond the Commissioner's letter, so the practical consequences for OpenAI's BC-facing operations, and for other AI processors relying on similar consent theories, remain to be seen.

Outlook

The OIPC's finding creates pressure for legislative attention to PIPA's consent provisions, though no reform proposal specific to consent has yet been introduced; Bill 9 addresses only the public-sector FIPPA. Whether the OpenAI investigation results in a formal order, and whether it prompts a parallel private-sector reform push, are the developments most likely to determine how this finding translates into binding obligations.

Lawful Processing & Special Data

A joint investigation by OIPC BC and the federal Office of the Privacy Commissioner (OPC) into OpenAI, with findings published in May 2026, found that PIPA does not enable OpenAI to establish implicit consent for its processing of personal information. The Commissioner stated directly that PIPA's consent provisions are no longer well suited to today's data-driven world. This is a Confirmed finding, sourced from the regulator's own public comments, and it is the most consequential lawful-processing development for British Columbia this cycle.

The finding matters because PIPA's consent framework is fundamentally implicit-consent-permissive in structure, and the investigation concluded that societal expectations about AI and the organisational risk-mitigation steps involved have moved outside the scope that PIPA's current consent provisions can reasonably accommodate. This is not a finding limited to OpenAI specifically — it identifies a structural feature of the statute itself, one that the Commissioner has flagged as a candidate for reform. No change to the statute has yet occurred; the finding stands as an authoritative regulatory assessment of the existing law's limits, not a legislative amendment.

Outlook

The practical question for organisations relying on implicit consent for AI-adjacent processing in British Columbia is whether this finding will be treated as persuasive guidance ahead of any statutory change, and whether the Commissioner's advocacy for an accelerated PIPA review translates into a formal reform timeline.

Lawful Processing & Special Data

A joint investigation by OIPC BC and the federal Office of the Privacy Commissioner found that PIPA does not enable OpenAI to establish implicit consent for its data-processing practices. Notably, this finding held even in circumstances where OpenAI's actions were understood to be sufficient to satisfy the federal OPC's own implied-consent standard under PIPEDA, indicating that BC's PIPA applies a more exacting consent threshold than the federal private-sector standard in at least this instance.

This is a Confirmed, Tier-1-sourced finding directly from the regulator's own joint investigation report, and it is material: it establishes, for a globally significant AI company, that BC's consent framework does not automatically defer to whatever a federal-standard analysis would permit. The finding functions as a de facto precedent for how PIPA's consent provisions apply to large-scale AI training and data-processing operations, even though the underlying statute has not been formally amended to address AI-specific processing.

Outlook

The key open question is what remedial or compliance steps, if any, OpenAI must take in response to the joint investigation's findings, and whether other AI companies operating in or processing BC residents' data face similar scrutiny under the same implicit-consent reasoning. This finding is also the direct trigger for the OIPC's renewed calls for statutory PIPA reform addressing AI-era consent standards.

Controller/Processor Duties

In January 2026, OIPC BC released updated Public Sector Surveillance Guidelines, replacing guidance dating to 2014. The new guidelines require completion of a privacy impact assessment under FIPPA section 69(5.3) before a public body may implement a new surveillance initiative. This is a Confirmed, in-force development affecting public-body accountability duties specifically; it does not alter private-sector controller/processor obligations under PIPA, which remain governed by that Act's existing accountability provisions.

The update raises the practical accountability bar for public bodies contemplating surveillance deployments, formalising the privacy-impact-assessment step as a precondition rather than a best-practice recommendation. This sits alongside, but is distinct from, the private-sector consent gap identified in the concurrent OpenAI investigation: the surveillance guidelines address process discipline for public-body surveillance, while the OpenAI findings address the substantive adequacy of PIPA's consent basis for private-sector AI processing. Together they illustrate two separate fronts on which BC's privacy accountability framework is under active scrutiny this cycle — one procedural and public-sector-facing, the other substantive and private-sector-facing.

Outlook

Watch for how public bodies operationalise the new privacy-impact-assessment requirement in practice, and whether any enforcement action tests the boundaries of the FIPPA section 69(5.3) obligation in the coming cycles.

Algorithmic, Biometric & Surveillance Governance

The investigation into ChatGPT's handling of personal information in connection with the Tumbler Ridge shooting places an AI chatbot provider's data practices squarely within the Commissioner's investigative reach, exercised through a binding production order under the Act. The precise scope of what the investigation examines within OpenAI's practices has not been fully clarified in public materials to date. OpenAI, for its part, characterises the inquiry as reaching beyond its own conduct into an examination of online platforms generally, a framing the Commissioner has not confirmed.

Outlook

Whether this matter settles as a narrow inquiry into a single incident or develops into a broader examination of how conversational AI systems handle personal data will depend on how the production-order litigation resolves and on what the Commissioner does with any documents it ultimately obtains.

Algorithmic, Biometric & Surveillance Governance

The OIPC is reported to have released updated Public Sector Surveillance Guidelines in January 2026, replacing guidelines that had been in place since 2014. The updated guidelines are understood to apply to all public bodies subject to FIPPA, including ministries, local governments, schools, Crown corporations, hospitals, and municipal police forces. This is sourced via secondary law-firm commentary rather than direct confirmation against the guidelines' primary OIPC text, so the specific content changes between the 2014 and 2026 versions have not been independently verified this pass.

A twelve-year gap between guidance updates suggests the refresh responds to a substantially changed surveillance-technology landscape across BC's public sector, spanning municipal policing through to hospital and school surveillance practices, though the precise substantive changes remain to be confirmed against the primary document.

Outlook

Confirming the updated guidelines against the OIPC's own primary text would sharpen understanding of what specifically changed for public bodies conducting surveillance activity. Given the breadth of bodies affected, from municipal police forces to school districts, the practical implementation of the updated guidance across such a varied set of public bodies is a development worth tracking further.

Algorithmic, Biometric & Surveillance Governance

The joint OIPC/OPC investigation into OpenAI, concluded and published in May 2026, is the headline algorithmic-governance development for British Columbia this cycle. The investigation concluded that societal expectations about AI and the organisational risk-mitigation steps involved have moved outside the scope that PIPA's current consent provisions can reasonably accommodate, and specifically found that PIPA does not enable OpenAI to establish implicit consent for its AI training and processing activities. This is a Confirmed finding directly from the regulators' own published comments.

In direct response, OIPC Commissioner Michael Harvey encouraged government to advance the timing of the legislature's statutory review of PIPA in light of these AI-related consent gaps, and offered OIPC's support for a statutory reform effort. This is a notable escalation: a joint investigation with a national-level counterpart producing a public call from the provincial Commissioner for accelerated legislative attention specifically because of AI's implications for the province's consent-based privacy law. It signals that algorithmic governance is now a driving force behind privacy-law reform pressure in British Columbia, rather than a peripheral consideration.

Outlook

The determinative question is whether the legislature responds to the Commissioner's call by advancing the statutory PIPA review ahead of its normal six-year cycle. The Interpreter's evidence treats this as a proposed, not yet formalised, possibility with a full year of timing uncertainty.

Algorithmic, Biometric & Surveillance Governance

This was a material cycle for algorithmic and biometric governance in BC. The Court of Appeal for British Columbia dismissed Clearview AI's appeal, confirming that PIPA applies to Clearview and that the statute does not exempt the company from obtaining consent to collect personal information from online sources — an appellate-level confirmation of PIPA's reach over biometric facial-recognition data sourced from public online platforms. Separately, the OIPC-OPC joint investigation into OpenAI found that PIPA does not enable the company to establish implicit consent for its data-processing practices, even where OpenAI's mitigation steps were understood to satisfy the federal OPC's implied-consent standard under PIPEDA. This finding prompted the Commissioner to renew calls for PIPA reform specifically addressing AI-era consent standards, effectively functioning as a de facto AI risk-assessment precedent under a statute that does not yet contain AI-specific provisions.

On the public-sector surveillance side, OIPC BC released updated Public Sector Surveillance Guidelines in January 2026, replacing guidance dating from 2014. These apply to all FIPPA-covered public bodies, including ministries, local governments, schools, Crown corporations, hospitals and municipal police, and reiterate privacy-impact-assessment obligations for surveillance systems deployed by those bodies.

Taken together, these three developments — a biometric appellate ruling, an AI-consent enforcement finding, and updated public-sector surveillance guidance — establish BC as an unusually active jurisdiction for algorithmic and biometric governance this cycle, operating substantially through enforcement, litigation and guidance rather than through new statutory text.

Outlook

Watch for whether the OpenAI investigation's findings translate into concrete compliance changes, whether further biometric-technology enforcement follows the Clearview AI precedent, and whether the OIPC's AI-consent-reform advocacy gains legislative traction alongside the currently public-sector-only Bill 9 reform track.

Enforcement & Redress

OpenAI has filed a petition in the Supreme Court of British Columbia seeking to quash the Commissioner's production order, arguing the investigation exceeds the statutory and constitutional limits of the Commissioner's authority under the Act. The petition, filed in late October 2026, directly contests the Commissioner's exercise of its section 38(1) compulsion power and sets up a judicial test of how far that power extends over a foreign-based AI platform operator. The outcome of the petition is not yet known.

Outlook

This is now the live enforcement story in the province: a direct judicial test of the Commissioner's authority to compel document production from a major AI provider. Resolution of the petition will set the practical ceiling on how the Commissioner can pursue investigations of this kind going forward, and the case is worth tracking through to judgment.

Enforcement & Redress

The Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) is understood to have opened an investigation into the City of Kamloops after the City reported that Mayor Reid Hamer-Jackson had disclosed personal information without authorization under the Freedom of Information and Protection of Privacy Act (FIPPA), with the matter first listed on 9 October 2026. The investigation is active and its outcome has not yet been determined.

Separately, OIPC BC is understood to have issued an order concerning the City of Port Moody's response to an access request for workplace investigation records, first listed on 6 October 2026, after an applicant sought access to those records under FIPPA. The order addresses the sufficiency of the City's response; the full disposition has not been retrieved.

Both matters arise under the existing FIPPA framework rather than under any amended provision, and neither has reached a concluded outcome as at the dates listed above.

Outlook

The Kamloops investigation remains open, with the Mayor's alleged unauthorized disclosure under FIPPA unresolved. The Port Moody access order stands as the more recent dated development in the public-body access-and-disclosure space, with its full terms not yet confirmed. Both matters sit within OIPC BC's ordinary adjudicative and investigative function over public bodies under FIPPA.

Enforcement & Redress

The OIPC does not currently have administrative-monetary-penalty power under PIPA. The Commissioner has recommended that such power be added, modelled on section 17.1 of the federal Personal Information Protection and Electronic Documents Act, but this recommendation remains unenacted as of this cycle. This standing gap in the OIPC's enforcement toolkit sits in contrast to the Commissioner's own finding, described elsewhere this cycle, that PIPA's consent provisions are no longer well suited to AI-driven data processing: the regulator has identified a substantive gap in the statute it administers but lacks the administrative-penalty power that other Canadian privacy regulators, including the federal Privacy Commissioner under PIPEDA, already hold.

Separately, the OIPC is reported to be monitoring a privacy breach involving the Canvas platform and urging prompt breach reporting by both public and private bodies. This is sourced only via a third-party jurisdiction tracker, and no OIPC primary release confirming this specific monitoring activity was independently retrieved this pass, so the claim should be treated as uncertain pending confirmation.

Outlook

Whether the OIPC's standing recommendation for PIPEDA-style administrative-monetary-penalty power is taken up by the Legislature remains open; no legislative vehicle for that specific reform was identified this cycle, and Bill 9 does not address it. Confirmation of the Canvas platform breach-monitoring activity against a primary OIPC source would also sharpen the enforcement picture.

Enforcement & Redress

The OIPC/OPC joint investigation into OpenAI is this cycle's headline enforcement and oversight activity, concluding that PIPA does not enable OpenAI to establish implicit consent and that the Act's consent provisions are no longer well suited to AI-era data processing. This is a Confirmed finding from a primary regulatory source, functioning as an authoritative oversight determination even though it does not itself impose a financial penalty.

Separately, OIPC BC has recommended that it be granted the ability to impose administrative monetary penalties and to enter into PIPEDA-section-17.1-style compliance agreements — enforcement powers that PIPA does not currently confer on the Commissioner. This recommendation, rated Probable, is forward-looking and has not been enacted; it reflects the Commissioner's own assessment that the office's current toolkit is inadequate relative to comparable federal enforcement mechanisms. Read together, this cycle shows a regulator whose substantive findings (the OpenAI consent gap) are outpacing its formal enforcement powers, which remain limited to investigation and public reporting rather than monetary sanction.

Outlook

Watch for whether the enforcement-powers recommendation gains legislative traction alongside, or independently of, the broader PIPA consent-reform pressure generated by the OpenAI investigation. Absent expanded powers, OIPC BC's redress toolkit for findings of this kind remains investigative rather than punitive.

Enforcement & Redress

Enforcement activity escalated materially in BC this cycle. The Court of Appeal for British Columbia dismissed Clearview AI's appeal, upholding OIPC's original enforcement order and confirming that PIPA applies to the company with no exemption from consent requirements for collecting personal information from online sources. This is a Confirmed, appellate-level enforcement outcome, and it represents the culmination of a multi-year enforcement and litigation process against Clearview AI.

Separately, the OIPC's joint investigation with the federal OPC into OpenAI's data-processing practices, while framed primarily as a consent-standard finding, also functions as an enforcement-and-redress matter: it establishes formally that PIPA was not satisfied by OpenAI's mitigation steps, a finding that carries direct redress implications for BC residents whose data was processed by OpenAI without adequate consent under BC's standard.

Outlook

The Clearview AI Court of Appeal decision closes that particular enforcement matter at the appellate level, but its precedential effect on future biometric-technology enforcement in BC is the item to watch. For the OpenAI matter, watch for what redress or remedial steps, if any, follow the joint investigation's findings.