Submission of the Office of the Privacy Commissioner of Canada on Enhancing trust in artificial intelligence through increased transparency

September 23, 2026

Sébastien Lauzier
Director, AI and Data Policy
Marketplace Framework Policy Branch
Innovation, Science and Economic Development Canada
235 Queen St
Ottawa, Ontario  K1A 0H5

Subject: OPC Submission on Enhancing trust in artificial intelligence through increased transparency

Dear Sébastien Lauzier:

Thank you for the opportunity to comment on the discussion document Enhancing trust in artificial intelligence through increased transparency.

As you correctly note in that document, increased transparency can “support informed consumer behaviour, foster trust, enable experimentation, research, and innovation, and reinforce fair competitive behaviour amongst companies”. This echoes a key message from the 2025 G7 Data Protection and Privacy Authorities Roundtable statement^{Footnote 1}: “when individuals have confidence that their data is protected and used lawfully and responsibly, trust exists; where trust exists, innovation is embraced.” Building public trust is essential to realizing AI’s potential benefits, and transparency will be a key factor in doing so.

Considering this, our remarks are prefaced by expressing appreciation for the Government’s focus on the topic of AI transparency and we concur with the five identified areas where transparency issues arise. Addressing these areas will be an important step towards ensuring and promoting responsible innovation.

General comment – Understandability

To frame this response, we offer an observation regarding the meaning of “availability” in the context of AI transparency. The “Context” section of the discussion document states that, “In its broadest meaning transparency refers to the availability of information about AI systems ….” For transparency to achieve the objective described in the paper, information about AI systems must not only be available, but also be understandable and accessible at the points in time at which it is relevant to an individual’s decision-making.

For example, the Personal Information Protection and Electronic Documents Act (PIPEDA) provides that, for consent to be meaningful, an organization’s purposes must be “stated in such a manner that the individual can reasonably understand” (Principle 4.3.2), and that consent is only valid where the individual would “understand the nature, purpose and consequences” of the processing (s. 6.1). These provisions illustrate that transparency requires more than making information available; it also requires consideration of whether the information is presented in a manner that enables individuals to understand the relevant practices and make informed decisions.

The discussion document appropriately recognizes considerations relating to accessibility and understandability. Future work on AI transparency could nevertheless benefit from explicitly identifying, as an objective, the provision of information necessary for informed decision-making in a format and at a point in time that enables individuals to understand and use that information.

Responses

The remainder of our comments are in response to select questions within the five identified areas in the discussion document in which transparency issues may arise, and on which the government is considering whether and what action may be required.

We would be happy to elaborate on the information provided or to answer any questions you may have in future discussions.

AI-generated content

When and for what kinds of content is it most important to know if something was created or modified by AI?

Much of the discussion document’s section on ‘AI-generated content’ focuses on improving the ability of individuals to determine whether content they see online is AI-generated, with the goal of helping those individuals to make appropriate decisions and be less prone to harm (such as deception by mis- or disinformation, fraud, etc.). This is a reasonable focus but may downplay the potential benefits to individuals who are the subject of AI-generated content.

For instance, an organization making a decision about an individual may be less likely to rely on inaccurate synthetic content if it is clearly labelled as such. The proposed Protecting Privacy and Consumer Data Act in Bill C-36 would establish mechanisms to give individuals better control over their personal information online, including synthetic content, such as through a right to deletion – but this would be complemented by AI transparency, further mitigating potential harms.

Recognizing that transparency with respect to AI-generated content can serve both to empower individuals who receive or encounter the content and to protect individuals who are the subjects of that content would strengthen the development of any future government approach to AI transparency.

Who in the value chain should be responsible for providing transparency around AI-generated content?

While we acknowledge that AI transparency should be a shared responsibility, data protection authorities have given particular consideration to the transparency role of organizations both developing and using generative AI technologies. In February 2026, 66 data protection authorities signed the Joint Statement on AI-generated imagery and the protection of privacy^{Footnote 2} which identified fundamental principles that should guide all organisations developing and using AI content generation systems. Specific to AI transparency, these include:

• Ensuring meaningful transparency about AI system capabilities, safeguards, acceptable uses and the consequences of misuse;
• Providing effective and accessible mechanisms for individuals to request the removal of harmful content involving personal information and respond rapidly to such requests; and,
• Addressing specific risks to children through implementing enhanced safeguards and providing clear, age-appropriate information to children, parents, guardians and educators.

AI Interaction

When and why is it important to know that you’re interacting with an AI system?

From a privacy perspective, there are two situations where it is particularly important that individuals be aware that they are interacting with an AI system.

First, individuals should be informed when organizations use automated decision systems to make or inform significant predictions, recommendations or decisions about them. Awareness of such systems is important to enable individuals to understand how decisions affecting them are made and, where available, to exercise appropriate recourse mechanisms, such as requesting an explanation or making representations in support of a review of the decision. We note that the proposed Protecting Privacy and Consumer Data Act would include certain transparency and recourse mechanisms in this context.

Second, individuals should understand when their personal information is being collected or used by an AI system. As highlighted in the discussion document, this includes situations in which an AI system engages directly with the individual, such as an AI chatbot, as well those in which AI-enabled technologies collect information about individuals without their direct interaction with the system. The privacy implications in these latter circumstances may be particularly significant because an individual may not have a meaningful opportunity to avoid the collection or use of their information. Transparency in these circumstances can nevertheless provide individuals with important information about how their personal information is being collected and used, and give them the opportunity, where possible, to exercise their privacy rights.

What factors make a disclosure of AI use meaningful and effective for the user?

As the discussion document notes, “transparency around AI interactions may enable Canadians to make more informed choices around when and how they are engaging with AI ….” This is analogous to the issue of obtaining meaningful consent for the processing of personal information, which requires that individuals understand what they are consenting to.

To that end, the OPC’s Guidelines on Obtaining Meaningful Consent^{Footnote 3} can act as a foundation for any upcoming work on transparency for AI interactions. In that document, we identify four key elements upon which additional emphasis must generally be placed: what personal information is being collected; with which parties personal information is being shared; for what purposes personal information is being collected, used or disclosed; and, the risks of harm and other consequences. While specific to the privacy context, we nonetheless believe that these factors could be adapted for AI transparency.

We also agree with the discussion document that there can be a risk of over-disclosure. For instance, in the OPC’s submission on the former Bill C-27, we acknowledged that limiting the requirement to provide a general account of the organization’s use of an automated decision system to those uses that could have a significant impact would “likely strike a reasonable balance between providing transparency for individuals and compliance effort for organizations”.^{Footnote 4} A similar balance could be found that ensures that AI transparency efforts do not ultimately overwhelm individuals attempting to make meaningful choices about their interactions.

Finally, we also note that the effectiveness of any AI transparency efforts could be compromised if they are incompatible or inconsistent with existing transparency mechanisms, such as privacy notices. Individuals should not, for example, have to review different documents to determine how their personal information is being collected and used depending on whether an AI system is involved. Similarly, the granularity of information about the processing of their personal information should not significantly vary based on the presence of an AI system in an interaction (as opposed to being based on the impact of a process). The interrelation between current and any proposed mechanisms should be made clear.

Information about AI systems

What kinds of information about [AI system capabilities, limitations and governance practices] would you like to know in order to help you make informed choices about when and how to use AI? What kind of information about AI do businesses need to adopt AI safely and responsibly?

In both guidance and our investigative work, the OPC has emphasized the importance of disclosing the limitations and intended uses of AI systems.

For example, the principles for responsible, trustworthy and privacy-protective generative AI technologies published by Canada’s federal, provincial and territorial information and privacy commissioners state that developers and providers of generative AI systems should “inform organizations using generative AI about any known issues or limitations about the accuracy of generative AI outputs”, such as particular use cases or inputs that tend to lead to inaccurate outputs.^{Footnote 5} In that document, we noted that such limitations can be caused by issues with the training dataset, for instance where it is time bounded or from a single, non-representative source, meaning that some degree of transparency for training data is also necessary.

We also recommended that organizations using generative AI should “evaluate the impacts of any accuracy issues or limitations disclosed by the provider or developer of the generative AI system… on the use of the system,” noting that if such disclosures are not available, organizations should “consider whether the use of the system remains appropriate and/or legally authorized”. That is, if organizations are not able to assure themselves that an AI system is appropriate and intended for their proposed purpose, they would be well-advised to reconsider its use.

In the investigative context, the disclosure of system limitations was a key issue raised in the investigation of OpenAI’s ChatGPT system by the federal, Quebec, Alberta, and British Columbia privacy commissioners’ offices.^{Footnote 6} To minimize the potential for inaccurate personal information to be generated and used, one of our key recommendations was for OpenAI to:

“Implement measures to ensure that, when interacting with ChatGPT, users in Canada, including business users, are made aware of the current limitations of the models in terms of the general level of accuracy of personal information included in outputs, so that they can determine whether outputs are sufficiently accurate for the intended purposes.”

In that investigation, we also recommended that OpenAI:

“With respect to its LLMs, provide the general public with plain language, comprehensive and easily accessible information about:

1. the categories and sources of information used to build the training datasets;
2. how the models function, including how this can lead to inaccurate outputs; and
3. the existing limitations on model explainability.”

We have made similar recommendations with respect to AI-enabled technologies; for instance, in our recent guidance on age assurance, we stated that developers of age assurance systems must “disclose to relying parties any known limitations in effectiveness, if they cannot be addressed.”^{Footnote 7}

AI-based systems can make for powerful tools, but they are not omnipotent. It is important for both individual and business users to understand their limitations.

AI incidents

What types of information related to AI use and risk trends would be most useful?

As described above, it is important for developers and providers of AI systems to be clear about known issues and limitations. A mechanism that allows users of AI systems to report failure cases – along with regular testing by developers themselves – would support this.

With respect to breaches of personal information, AI systems (and their developers, providers and users) would generally be subject to current and future legislation with respect to the reporting of breaches of security safeguards. However, we note that the receipt of timely and complete information about AI incidents involving personal information is a critical factor in harm mitigation. We have stated prior that the language in PIPEDA that allows for reports to be made “as soon as feasible after the organization determines that the breach has occurred” has led to delays. In our submission on the former Bill C-27, we stated:

“Currently, 40% of breach reports under PIPEDA are received more than three months after the breach occurred. This delay impacts the OPC’s ability to fulfill its oversight role and to offer organizations timely advice on mitigating measures. It also prevents individuals from protecting themselves when a breach occurs, leaving them exposed for an unnecessarily extended period of time.”^{Footnote 8}

In developing any AI incident reporting mechanisms, it will be important to ensure that practical considerations, such as reporting timelines, be addressed.

AI agents

The OPC’s work on agentic AI systems is on-going, including through international engagement such as in the Global Privacy Assembly. We would be happy to share information on this topic as it becomes available.

Conclusion

In closing, the OPC brings substantial experience in advising organizations on how to communicate complex information about the collection, use and disclosure of personal information in clear, meaningful ways — including in the context of new and emerging technologies. We are well-positioned to support the development of AI transparency requirements, particularly as they relate to AI systems that collect, use or disclose personal information, and would welcome the opportunity to contribute further expertise as this important work progresses. We thank ISED for the opportunity to comment and look forward to continued engagement on this issue.

Sincerely,