--- title: "Canada — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/canada/algorithmic-biometric-and-surveillance-governance/ source_html: /jurisdictions/canada/algorithmic-biometric-and-surveillance-governance/index.html description: "Canada — Algorithmic, Biometric & Surveillance Governance: algorithmic_biometric_and_surveillance_governance Algorithmic, Biometric & Surveillance Governance 1 sub-module 1 claim Not assessed ▾ # No standing position recorded for this cate" generated_at: 2026-10-25T04:46:50Z content_sha256: d79a585c9823567a06566f7a8beaeb1e906c1b81171d4b30ec161bd74429bb93 generator: "fe-fleet/md-twin@1.0" --- # Canada — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor ### D8Algorithmic, Biometric & Surveillance Governance1 sub-module1 claimNot assessed▾# No standing position recorded for this category. #### Sub-modules (1) #### Ai Risk AssessmentsNot assessed No narrative recorded for this sub-module. Claims (1): - Artificial Intelligence and Data Act (AIDA) has no successor: AIDA, the AI-governance component of the former Bill C-27, has no legislative successor: Bill C-36 (PPCDA), introduced 15 June 2026, addresses only privacy and consumer data, not AI regulation. Category narrative 274 words #### Algorithmic, Biometric & Surveillance Governance The Artificial Intelligence and Data Act, the AI-governance component of the former Bill C-27, has no legislative successor. Bill C-36, the Protecting Privacy and Consumer Data Act, introduced 15 June 2026, addresses only privacy and consumer-data matters, not AI regulation. This is a negative finding of direct significance: Canada currently has no dedicated federal AI-governance statute moving through the legislative process, a materially different position from the one that existed while AIDA was bundled into Bill C-27 prior to the January 2025 prorogation. In the continued absence of dedicated AI-governance legislation, AI-adjacent personal-information practices in Canada are understood to be addressed through existing general-purpose privacy law. The joint OPC/CAI/BC/Alberta investigation into OpenAI's ChatGPT service, applying PIPEDA's section 5(3) appropriate-purposes test and finding a consent deficiency, illustrates this: Canadian privacy regulators are applying established PIPEDA tools to AI-system data practices rather than waiting for dedicated AI legislation that currently has no clear path forward. This gap is understood to leave algorithmic accountability, biometric processing, and automated-decision-making oversight in Canada dependent on the general adequacy of PIPEDA's existing principles for these more specialised contexts, a dependency that commentary suggests may become more strained as AI systems' scale and complexity increase, though no specific statutory gap beyond the absence of a dedicated AI statute has been identified this cycle. #### Outlook Whether any future legislative vehicle for AI-specific governance will be introduced, and on what timeline, is not established. For the foreseeable period, AI-adjacent personal-information practices in Canada are understood to remain governed through the application of general PIPEDA principles, as demonstrated by the joint OpenAI/ChatGPT investigation, rather than through dedicated algorithmic-governance statute. Read full narrative · 274 words Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance The Office of the Privacy Commissioner of Canada, together with Quebec's Commission d'acces a l'information and the privacy regulators of British Columbia and Alberta, published a joint finding on May 6, 2026 concerning OpenAI OpCo, LLC. The finding, published as PIPEDA Findings number 2026-002, concluded that the manner in which OpenAI initially collected personal information from publicly accessible websites and licensed third-party sources to train its models was overbroad and therefore inappropriate, given the scale, nature and sensitivity of the data collected and used. This is a Confirmed, in-force finding from Canada's primary federal privacy regulator acting jointly with three provincial counterparts, representing one of the more significant AI-training-data enforcement actions issued by a Canadian privacy authority to date. The joint and multi-regulator nature of the finding is itself notable: it reflects coordinated action across the federal regulator and three provincial regulators with their own independent statutory mandates, rather than a single regulator acting alone, suggesting a degree of cross-jurisdictional alignment on how AI-training-data collection practices should be assessed under Canada's various privacy statutes. This enforcement activity occurs against the backdrop of Canada's continued absence of an enacted, federal AI-specific statute. Bill C-27, which would have enacted the Artificial Intelligence and Data Act, spent over two years in committee review and never reached a final vote, dying when the bill did not survive prorogation. Canada's AI-related privacy enforcement, including the OpenAI finding, therefore currently proceeds entirely under existing general-purpose privacy statutes, PIPEDA at the federal level and Law 25 and equivalent provincial statutes, rather than under any AI-specific legal framework, since no enacted replacement for the Artificial Intelligence and Data Act exists as at this cycle. #### Outlook Whether the joint OpenAI finding's overbroad-collection standard becomes a template applied to other AI-training-data investigations by Canadian privacy regulators, and whether any federal AI-specific statute re-emerges following Bill C-27's failure to pass, both remain open questions not resolved by this cycle's material. 1 earlier distinct update(s) Periodic update · new data 2026-10-11 #### Algorithmic, Biometric & Surveillance Governance The Artificial Intelligence and Data Act is confirmed dead rather than merely paused: it died along with the remainder of Bill C-27 at prorogation on 5 and 6 January 2025 and has not been reintroduced in any form. Bill C-36, Canada's current federal privacy-reform vehicle, does not revive a standalone AI statute; instead, it confines AI-adjacent oversight to automated-decision-making transparency provisions within the proposed successor privacy law. This means Canada's algorithmic-governance landscape, for the foreseeable term, will be shaped through general privacy legislation's automated-decision-making transparency requirements rather than through dedicated AI-specific rules, a materially narrower scope than AIDA would have provided. #### Outlook Whether Bill C-36's automated-decision-making transparency provisions prove adequate to the governance gap AIDA's death leaves behind will likely become clearer only once the bill progresses beyond first reading and its specific transparency obligations are tested against real automated-decision-making deployments. Evidence 1 Sources and claims (1) - Probableunavailable — Artificial Intelligence and Data Act (AIDA) has no successor: AIDA, the AI-governance component of the former Bill C-27, has no legislative successor: Bill C-36 (PPCDA), introduced 15 June 2026, addresses only privacy and consumer data, not AI regulation.