#
No standing position recorded for this category.
Sub-modules (1)
Data Access SharingNot assessed
No narrative recorded for this sub-module.
Claims (1):
- OpenAI OpCo, LLC found non compliant: The OPC, Quebec's CAI, and the BC and Alberta privacy commissioners jointly investigated OpenAI OpCo LLC (PIPEDA Findings #2026-002), finding that appropriate purposes existed for ChatGPT's development but that valid consent was not obtained for certain collection, use and disclosure of personal information.
The joint, multi-regulator character of the investigation is itself notable: coordination across the federal OPC and three provincial regulators on a single AI-adjacent matter illustrates an emerging pattern of cross-sectoral regulatory cooperation specifically targeted at large-scale AI systems processing personal information, rather than each regulator acting independently on its own jurisdictional slice. This coordination pattern is understood to reflect the practical reality that AI systems such as ChatGPT operate across provincial boundaries, making siloed single-regulator investigation less effective for assessing nationwide data practices.
The finding that appropriate purposes existed, but that valid consent was lacking for certain processing, draws a specific legal line: PIPEDA's dual test of purpose-appropriateness and consent-validity operates independently, and an AI developer may satisfy one prong while failing the other. This distinction is understood to be directly relevant to other AI developers and deployers handling Canadian personal information, as it signals which specific PIPEDA requirement, consent mechanics rather than purpose-legitimacy, was found deficient in this instance.
Outlook
The practical remedial steps OpenAI is expected to take in response to the PIPEDA Findings #2026-002, including any changes to consent mechanisms for ChatGPT's Canadian users, had not been established this cycle. This joint investigation is understood to be a likely reference point for how the OPC and provincial regulators coordinate on future AI-system investigations involving personal information across Canadian jurisdictions.
Sectoral Watch
Canada's open-banking framework reached a significant milestone with the Royal Assent of Bill C-15 on March 26, 2026, which repealed the original Consumer-Driven Banking Act enacted in 2024 and replaced it with a comprehensive new Consumer-Driven Banking Act. Division 9 of Part 5 of Bill C-15 carries out this repeal-and-replace, establishing the Bank of Canada as the lead regulator responsible for accreditation and supervision of entities participating in the open-banking ecosystem. This is a structural, architecture-level development: Canada now has a second-generation open-banking statute in place of its original 2024 framework, with a named lead regulator and an accreditation-and-supervision model built into the statute itself.
The Act's data-protection dimension lies in its establishment of a data-mobility right situated within the Personal Information Protection and Electronic Documents Act, intended to facilitate economy-wide data sharing rather than being confined to the banking sector alone in its underlying legal basis, even though its initial implementing focus is the financial-services open-banking context. This sectoral development therefore sits at the boundary between data-protection law proper and financial-services market-access regulation, with the Consumer-Driven Banking Act providing the sector-specific implementing mechanism for a more general PIPEDA-level right.
Draft Consumer-Driven Banking Regulations reported in commentary following the Act's passage would, among other operational requirements, require participating entities to maintain a minimum monthly API uptime standard, make a substantial period of transaction history available to accredited third parties, and renew customer consent on a recurring basis rather than treating consent as a one-time event. These operational requirements, while reported in secondary commentary rather than confirmed against the regulations' own text this cycle, illustrate the kind of granular, consent-renewal-oriented compliance obligations that are likely to accompany the Act's eventual full implementation.
Outlook
The Consumer-Driven Banking Act's practical effect on data sharing depends on the Bank of Canada's accreditation process for participating entities and on the finalisation of the Consumer-Driven Banking Regulations, including the reported API-uptime, transaction-history and consent-renewal requirements, none of which were confirmed as finalised against primary regulatory text this cycle.
1 earlier distinct update(s)
Sectoral Watch
The Department of Finance pre-published draft Consumer-Driven Banking Regulations in the Canada Gazette on 27 June 2026, opening a sixty-day comment period that closed on 26 August 2026. The Office of the Privacy Commissioner filed formal comments on that same closing date, giving the privacy regulator a direct, documented role in shaping the financial-data-sharing framework before it is finalised. A staggered commencement has been proposed, beginning with accreditation requirements rather than full operational rollout. This is an active rulemaking in which the privacy regulator is a formal participant rather than an after-the-fact commentator, distinguishing it from the more passive sectoral-watch postures typical of other financial-data frameworks.
Outlook
The finalised regulations, once published, will be the first concrete indication of how far the Department of Finance has incorporated the Privacy Commissioner's formal comments of 26 August 2026, particularly regarding the staggered, accreditation-first commencement structure.
Sources and claims (1)
- Probableunavailable — OpenAI OpCo, LLC found non compliant: The OPC, Quebec's CAI, and the BC and Alberta privacy commissioners jointly investigated OpenAI OpCo LLC (PIPEDA Findings #2026-002), finding that appropriate purposes existed for ChatGPT's development but that valid consent was not obtained for certain collection, use and disclosure of personal information.