“We use AI” leaves the important privacy questions unanswered

An AI privacy notice should explain the actual handling of personal information, not merely announce that an organisation uses AI. For a Canadian service, the reader needs to understand the task, the information involved, the parties receiving it and the available choices or recourse. Those explanations must match the deployed workflow.

Canada's privacy regulators' generative AI principles, published 7 December 2023 and checked for this article, call for understandable information about collection, use and disclosure. They address training and operation, public-facing interactions and AI's role in consequential decisions. These are regulatory principles, not a new blanket AI statute. Identify the applicable federal, provincial and sector-specific law before deciding the legal requirements for a particular organisation.

Begin with a bounded use case: a customer-support drafting assistant, for example, rather than “AI across the business.” Establish what enters the tool, where it comes from, what the tool produces and who uses the output. This hypothetical use case is not a description of a real client deployment.

Inspect the approved configuration and service agreement with the responsible technical and privacy teams. Determine whether the provider can use inputs for its own purposes, what logging occurs and how retention is controlled. Distinguish a setting that was verified from an assumption based on a product name or a general sales page.

A notice saying that data are never retained can become inaccurate if operational logs are retained. Likewise, saying that a person reviews every output requires an actual workflow that makes that review happen. Draft the explanation from verified behaviour and resolve contradictions before publication.

The OPC's meaningful-consent guidance emphasises understandable information about the personal information involved, sharing, purposes and significant risks. It supports making important points prominent while leaving fuller information accessible. A long privacy policy is not automatically evidence that someone understood a specific use.

For an AI-assisted service, a useful short explanation can state the task supported, the categories of information used, the role of the provider and the relevant human involvement. Link to fuller details about handling and contact routes. Do not present this article as a universal wording template: consent requirements and lawful exceptions depend on the applicable law and circumstances.

Where a choice exists, explain what changes if the person declines. Where a choice does not exist, do not invent one for reassuring copy. The privacy team should verify the basis for the processing and the available rights before the interface promises an alternative route or deletion outcome.

“A human is involved” can describe anything from genuine review to an unchecked final click. Explain the role accurately. If AI helps draft a reply, say so in the appropriate context; if its output informs a decision about a person, assess the additional explanation and safeguards that the use requires.

The existing article on meaningful human checks can help the operational team define that role. Its controls do not replace a Canadian legal assessment. Cross-border providers and services also require careful review of the actual arrangements, not a claim that all Canadian information must always stay in Canada.

Assume a fictional service uses an assistant to draft replies. A staff member is meant to review each draft, operational logs are retained, and provider reuse terms have not yet been confirmed. This example supplies no approved privacy wording or lawful-processing conclusion.

Record the statement, evidence reference, responsible owner and unresolved question in the notice review. Treat an unknown as unfinished work, not as a reassuring default.

The useful next action is to resolve the factual gap or change the workflow before the privacy team approves wording. Substituting “may” everywhere is not a complete explanation either: describe verified processing and the applicable choices clearly once they are established. Recheck the table when the provider configuration or sending permissions change.

Maintain a small evidence record connecting each material statement to its owner and source. For a retention statement, retain the relevant configuration and policy evidence. For a review statement, retain the documented workflow. For a contact route, verify that someone is responsible for responding.

Test the notice on a phone as well as a desktop. Ask whether a reader can find the relevant explanation before providing information and whether the detailed version is accessible without navigating a maze. Avoid burying the AI use in a broad sentence about improving services when a more specific explanation is available.

When the provider, model configuration, purpose or decision role changes, assess whether the notice and any required consent process must change before the new use starts. Keep a dated version history. The practical test is simple: can the organisation substantiate what this notice tells this reader about this service? If not, fix the workflow or the wording before relying on the notice.

AI assistance was used in research and drafting. No client engagement, firsthand test or independently verified outcome is claimed.

This article is general information. Verify current requirements and seek qualified advice for your specific circumstances.

Spotted an issue? Contact our editorial desk.