Statement by the Privacy Commissioner of Canada to the Standing Committee on Access to Information, Privacy and Ethics on its study of artificial intelligence

February 2, 2026
Ottawa, ON

Opening statement by Philippe Dufresne
Privacy Commissioner of Canada

(Check against delivery)

---

Mr. Chair, Members of the Committee.

Thank you for the invitation to appear as part of your study on the challenges posed by artificial intelligence (AI) and its regulation.

Addressing the privacy impacts of the fast-moving pace of technological advancements is one of my strategic priorities. This has also been a significant focus of my domestic, international and cross-regulatory work over the last few years given its rapid and broad adoption by individuals and organizations in Canada and globally.

Privacy is an important and timely issue for Canada. As more and more personal data is being collected, used, and shared, data protection becomes increasingly significant for Canadians and Canadian organizations.

The protection of personal information is particularly important in the context of AI, as personal information can be used to train and operate these systems.

Recently, I announced an expanded investigation into the social media platform X, and its Grok chatbot. The investigation will examine the emerging phenomenon of AI being used to create deepfakes, which can present significant risk to Canadians, including children.

I expect that the results of this investigation, as well as my ongoing investigation into OpenAI, will help to inform privacy and policy direction with respect to AI, and help individuals and organizations to use and deploy these technologies safely, responsibly, and with appropriate protections for personal data.

Investigations by my Office in the past two years have demonstrated how Canadian law is able to address major privacy issues that can have serious impacts on individuals.

For example, my investigation into Aylo, which operates Pornhub and other pornographic websites, addressed non-consensual sharing of intimate images. My joint investigation with my U.K. counterpart into the 23andMe breach examined an incident that impacted the highly sensitive personal information of 7 million customers, including more than 300,000 Canadians.

Last fall, I announced the results of my investigation with my provincial counterparts into TikTok, which highlighted the importance of protecting children’s privacy online. Because of our investigation, the company has implemented, and continues to implement improvements to its privacy practices in the best interests of its users, especially children.

Technologies such as AI can bring economic, social, and public interest benefits. The value of this innovation will be maximized when it is accompanied by trust.

A survey conducted by my Office last year found that a significant majority of Canadians are concerned about how their personal information is collected and used – including 83 per cent indicating concern about their privacy when using AI tools.

Many have taken actions to protect themselves and most indicated that they are less willing to share their personal information with organizations compared to five years ago.

This further underscores the strategic advantage for organizations to develop and deploy AI, and other technologies, in a responsible, privacy-preserving manner.

It is key for developers and providers of AI to embed privacy in the design, conception, operation, and management of their products and services, and to consider the unique impact that these tools have on children as well as on groups that have historically experienced discrimination or bias.

Organizations that use AI should be transparent about this use, and accountable for any AI-generated decisions about individuals, such as whether to grant someone a loan or a job.

As technologies continue to evolve rapidly, and become increasingly integrated into personal and professional lives, it is our collective role – of regulators and policy makers – to ensure that privacy is protected for current and future generations.

Canada’s privacy laws must be able to meet this challenge, and to do so will require modernization.

With respect to AI, my recommended amendments to Canada’s federal privacy laws include recognizing privacy as a fundamental right, as well as establishing requirements to implement privacy by design and to conduct privacy impact assessments for high-impact data processing.

Personal information is at the heart of artificial intelligence, and therefore privacy legislation should, in my view, be at the heart of AI regulation.

Thank you, and I look forward to your questions.