Canadian privacy and professional rules for AI data licensing

Does PIPEDA apply when a Canadian firm licenses data to a US buyer?

Yes. PIPEDA applies to personal information that crosses provincial or national borders, even for firms in Alberta, BC or Quebec.

PIPEDA governs how private-sector organizations collect, use and disclose personal information in commercial activity. Alberta, British Columbia and Quebec have their own private-sector laws that apply instead within those provinces, but PIPEDA still applies to any business whose personal information crosses provincial or national borders. Licensing records to a US buyer is a cross-border transfer.

The Office of the Privacy Commissioner notes that information rendered anonymous, so that it can't be linked back to an identifiable person, is generally not personal information. Business contact information used only for business communication is also treated differently. In practice, the de-identification standard in your buyer agreement matters a great deal.

OPC: Summary of privacy laws in Canada

What does Quebec's Law 25 require?

De-identified information remains personal information, and sending it outside Quebec calls for a privacy impact assessment and a written agreement.

Quebec's private-sector privacy law, as amended by Law 25, treats de-identified information as personal information: identity is no longer direct, but it could still be inferred. Communicating personal information outside Quebec calls for a privacy impact assessment and a written agreement. Firms with Quebec offices or Quebec-resident clients should plan for both. Mostly French-language records also fit fewer programs today, since most buyers say they want English.

Commission d'accès à l'information du Québec

Do professional codes allow licensing client records?

Not without client consent. CPA and law society codes protect confidential client information, so scopes focus on firm-authored material.

• Accountants: CPA Ontario's Code of Professional Conduct (Rule 208) and the other provinces' equivalents restrict disclosing or using confidential client information without consent. CPA Ontario Code
• Lawyers: LSO Rule 3.3-1 requires strict confidence over all information about a client's business and affairs, a duty wider than privilege. LSO Rules, ch. 3
• Engineers, architects and other regulated professionals: check your regulator's code of ethics on client confidential information.

Can contracts or software terms block a licence?

Yes. Engagement letters, MSAs, NDAs and some platform terms limit how records can be used.

Engagement letters, MSAs, NDAs and data processing agreements often define what you can do with records. Software platforms can add limits of their own: one law-firm analysis notes that Slack's API terms bar third-party apps from using API data to train large language models. Frankfurt Kurnit analysis

What about employees' personal information?

Exclude HR and payroll files, and take advice on notice to staff whose emails or chats are included.

Email and chat archives contain your employees' personal information. Excluding HR and payroll files is the minimum. Think about notice to staff, and in some provinces employee privacy rules apply. Ask counsel what's appropriate for your workforce.

How does CASL apply to this service?

CASL requires consent, sender identification and an unsubscribe for commercial emails. Pre-checked consent boxes are not allowed.

Canada's Anti-Spam Legislation requires consent, sender identification and a working unsubscribe for commercial electronic messages. Express consent can't come from a pre-checked box. Our forms use an unticked opt-in box, record the wording you agreed to and when, and every email we send carries an unsubscribe link that works for at least 60 days. Requests are processed within 10 business days. We don't buy lists or scrape directories.

CRTC: CASL frequently asked questions

What should be checked before signing?

1. Written scope listing included and excluded sources
2. Professional-code and engagement-letter review (counsel or practice advisory)
3. De-identification standard and who performs it
4. Permitted uses, onward licensing and exclusivity
5. Security, retention and deletion terms
6. Quebec: privacy impact assessment and written agreement, if applicable
7. Staff notice approach
8. Platform terms reviewed for each tool exported
9. Any intermediary or agent fees disclosed in writing

Read: Law 25 and AI training data →