Innovating for Privacy, Building Trust: Navigating AI, Data and Regulation
Global Data Centre & Cloud Expo Canada 2026

October 21, 2026
Mississauga, ON

Address by Philippe Dufresne
Privacy Commissioner of Canada

(Check against delivery)

---

Good morning, thank you for the invitation to be here today at the Global Data Centre and Cloud Expo Canada.

I am delighted to be able to join this group of experts, industry leaders, and technology innovators. You are all working on the planning, growth, management, and governance side of the same issues that I deal with as Privacy Commissioner of Canada.

Engagements such as this one are excellent opportunities for me to gain a better understanding of your realities, the context in which you are operating, and your priorities and pain points working in this dynamic field.

This perspective helps to inform the activities of my Office and shape the advice, guidance, and support that I and my Office provide to organizations and to government in order to help them meet privacy obligations and advance appropriate data protection in support of innovation.

With heightened interest on issues related to digital sovereignty, I am sure that this is also a very dynamic moment in time for your industry.

I know that my colleague, Ontario Information and Privacy Commissioner Patricia Kosseim, was here yesterday speaking on the topic of digital sovereignty and the importance of privacy to public trust.

I was pleased to see that “trust” is also a common theme in many sessions of this conference. This is an important consideration in our work.

Trust is hard to earn, but easy to lose. It is an important factor for citizens, consumers, clients, and organizations when choosing who to do business with and where to store their information.

Responsible innovation is essential to building and maintaining trust, which I am sure resonates in many aspects of your work surrounding the growth of data centres.

While this relates more to the physical infrastructure than data protection, I do note commitments from across this industry towards supporting advancing responsible innovation, with a total of 42 companies now having signed on to Canada’s Responsible Data Centre Development Principles.

The idea took centre stage at the ALL IN conference in Montreal last month when Artificial Intelligence and Digital Innovation Minister Evan Solomon described home-grown innovation and data centre construction as an imperative, albeit one that must involve partnerships with like-minded parties.

As artificial intelligence and data-driven technologies continue to transform our lives, privacy, governance, and accountability are increasingly critical for ensuring that the right guardrails are in place.

Recently, leading AI experts have issued warnings about the speed of development of AI, suggesting that it could be moving forward too quickly for safety.

Anthropic CEO Dario Amodei said that AI development needed to slow down to allow risk-prevention measures to keep pace.

In September, Canada was one of 22 countries to adopt a statement that called for a global AI supervisory regime.

To that end, Prime Minister Mark Carney has called for a global technology stability board to oversee AI. Earlier this month, he launched a new National Council on Artificial Intelligence that brings together public- and private-sector stakeholders to provide independent advice.

One of these experts is Professor Yoshua Bengio, whom I had the pleasure of welcoming in the national capital region last year to speak at our G7 Data Protection and Privacy Authorities Roundtable, which I had the honour of hosting in the context of Canada’s G7 presidency.

The Government of Canada recently invested $150 million in LawZero, a non-profit research organization headed by Professor Bengio that is developing safe-by-design AI systems.

For our part, addressing the privacy impacts of technologies, and AI in particular, has been and remains one of my strategic priorities for my Office, and I have been working closely with domestic and international colleagues to ensure that regulation keeps pace with the rapid advance of technology.

My Office is also closely following the government’s ongoing efforts to support Canada’s digital sovereignty, including through its AI for All strategy, and Bill C-36, which would update Canada’s private-sector privacy law.

The importance of innovation and digital sovereignty, along with cross-border data flows and national resilience, were key topics of discussion at a meeting of Canada’s federal, provincial, and territorial privacy commissioners and ombuds last month.

Prioritizing privacy and fostering innovation is not a zero-sum game.

When I was appointed Privacy Commissioner of Canada in June 2022, I presented to the House of Commons and Senate during my confirmation hearings the three pillars of my vision for privacy that:

• Privacy is a fundamental right;
• Privacy supports the public interest and Canada’s innovation and competitiveness; and
• Privacy is an accelerator of Canadians’ trust in their institutions and their participation as digital citizens.

These three elements remain central to my work today and underscore that Canadians should be able to remain active and informed digital citizens, without having to choose between this participation and their fundamental right to privacy.

Many of you here play important roles in shaping this reality, and while complying with privacy law is a requirement for organizations, prioritizing strong data protection will be essential and an enabler for the future success and growth of this sector.

Technological advancement and fundamental rights can and must coexist. Canadians and Canadian organizations are counting on the protection of their data to benefit from technological progress.

This is the context and my outlook for my address to you today, as I speak about the evolving regulatory landscape, responsible data governance, and the principles that organizations should consider as they innovate to build lasting trust.

Regulatory landscape

There are four key considerations that I believe must be at the heart of any discussion of data governance.

With the massive amount of data being collected and shared, the first consideration is that respecting privacy must be a central priority for most organizations today – especially those that are responsible for managing personal data, and when deploying AI technologies.

For example, earlier this year, I conducted an investigation into the Grok chatbot, following reports that it was being used to create sexualized deepfakes.

Through the investigation, I concluded that X Corp. and xAI had violated Canada’s federal private-sector privacy law by launching the Grok AI-powered image-generation tool without implementing appropriate safeguards at the outset, given the potential privacy harms that such a tool could cause.

In May, I announced the result of a joint investigation into OpenAI carried out with my colleagues in Quebec, British Columbia, and Alberta, which concluded that the way that OpenAI had initially trained ChatGPT was not compliant with our respective privacy laws.

There were a number of privacy issues present in the initial training and deployment of ChatGPT, but, throughout the course of the investigation and in response to our findings and recommendations, OpenAI implemented measures to improve privacy protections in the ongoing development and delivery of ChatGPT, including significantly limiting the personal information and sensitive information that is used to train new ChatGPT models.

I expect that the findings of these investigations, and their recommendations, will help to inform privacy and policy direction with respect to other platforms, including AI, and help individuals and organizations to use and deploy these technologies safely, responsibly, and with appropriate safeguards.

Second, I believe that building public trust is essential to the success of technological innovation, and key to maximizing its value.

Public opinion research done by my Office shows that privacy is important to consumers, and many Canadians (41% of respondents) indicated that they had stopped doing business with a company that had experienced a breach.

Prioritizing privacy can be a competitive advantage for organizations.

Third, data and AI governance should align with democratic and ethical values as well as human rights. Privacy is an internationally recognized fundamental right, one that is both an essential precondition for citizens’ other freedoms, and a keystone right for democracy and freedom itself.

The fourth consideration is collaboration, which has been and remains a central focus for me as Privacy Commissioner of Canada, and as the current Chair of the Global Privacy Assembly (GPA), the international forum of data protection and privacy authorities from all over the world.

Through the efforts of networks such as Canada’s federal, provincial and territorial privacy and information commissioners and ombuds, as well as the Global Privacy Assembly, and the G7 Data Protection and Privacy Authorities Roundtable, the privacy community has focused on ensuring that data protection remains at the forefront of policy and industry discussions related to the design, development, deployment, and review of AI systems.

Initiatives, statements, and resolutions that we have issued over the last few years have focused on addressing the impact of new technologies.

Collectively, we have developed principles for responsible AI development, and tackled topics such as educational technology and privacy, age assurance, data-scraping, and AI-generated imagery.

In 2023, for example, a joint statement from our G7 Data Protection and Privacy Authorities Roundtable carried the important reminder that existing privacy laws apply to new technologies.

That said, my Office has long advocated for modernized privacy laws to address the rapidly evolving digital environment.

This spring, the federal government took steps in that direction that represent a major change in Canada’s approach to privacy, data protection, and combatting online harms, especially involving children.

In June, the federal government tabled Bill C-34, the Safe Social Media Act, which aims to protect individuals, particularly children, from harmful online content.

It followed up with Bill C-36, the Protecting Privacy and Consumer Data Act, which proposes to replace PIPEDA.

I look forward to sharing my perspectives on this legislation with Parliament in due course but, overall, I can say that I was pleased to see many of the recommendations that my Office has made over the years reflected in the Bill.

Innovations such as AI, and the speed at which they are being introduced and evolving, require us all to work together to ensure that the protection of individuals’ fundamental right to privacy, including strong data protection principles, is embedded into the tools and services that permeate our personal and professional lives.

Responsible innovation

Which brings me to responsible innovation. Those are the key words for organizations that want to innovate while protecting privacy and building lasting trust.

This was the message in the joint statement issued by my G7 counterparts and I after our meeting in 2025. As we said in that statement, prioritizing privacy can be “an opportunity for creative thinking, focused exploration and unconventional solutions – the very drivers of innovation.”

Privacy leaders have continued to promote this message internationally and domestically. At the Global Privacy Assembly, for example, we have adopted resolutions calling for stronger privacy protections throughout the AI lifecycle and advocated for meaningful human oversight of decisions made by AI systems.

And in collaboration with provincial and territorial colleagues, the OPC developed a set of principles for responsible, trustworthy and privacy-protective generative AI technologies.

It states that developers and providers of AI should embed privacy in the design, conception, operation, and management of their products and services. This includes consideration of the unique impact that these tools have on vulnerable groups – such as children, and those who have historically experienced discrimination or bias – to ensure that there are no unintended consequences of AI use.

An article earlier this year in the Harvard Business Review noted that while privacy-protective measures require investment up front, the measures become reusable infrastructure that allows companies to adapt faster as new regulations emerge.

Which in turn will contribute to a more resilient Canadian economy, as well as a more secure and enriching digital society.

Conclusion

As personal data drives innovation, innovation must be used to protect personal data.

As more data is being collected, shared, used, and stored than ever before, your work is vital to protecting the sensitive data of Canadians and Canadian organizations.

You play a central role in the data protection ecosystem. Because you are at the forefront of development and scaling data centres and digital infrastructure, you are well positioned to identify and address risks, opportunities, and future considerations to ensure the safe handling of vast amounts of information – particularly with the high demand that AI places on data.

I am committed to engaging with experts and partner networks, to working with industry to find solutions, to foster a trusted digital environment for all.

I hope that this is just the start of discussions and ongoing collaboration between our communities, as it is essential that we, along with other stakeholders, governments, and civil society, work together to address the current context and plan for the future.

Thank you again for your attention this morning. I look forward to meeting and speaking more with you, and I hope that you enjoy the rest of the conference.