Ontario joins Canada’s privacy regulators to launch principles for the responsible development and use of generative AI

December 7, 2023

Federal, provincial and territorial privacy authorities have launched a set of principles to guide the responsible, trustworthy and privacy-protective development, provision, and use of generative artificial intelligence (AI) technologies in Canada.

While generative AI presents potential benefits across many domains and in everyday life, the regulators note that there are also risks and potential harms to privacy, data protection, and other fundamental human rights if these technologies are not properly developed and regulated.

“Organizations developing, providing, or using generative AI have an obligation to ensure that their activities respect Ontarians’ privacy and human rights, and comply with relevant and applicable laws,” said Patricia Kosseim, Ontario’s Information and Privacy Commissioner. “This set of principles supports transparency and accountability, and can help to mitigate privacy risks, particularly when it comes to how these technologies can disproportionately affect vulnerable and historically disadvantaged groups who may experience systemic discrimination or bias.”

Organizations have a responsibility to ensure that products and services that are using generative AI technologies comply with privacy legislation and other relevant statutes or regulations.

The joint document lays out how key privacy principles apply when developing, providing, or using generative AI models, tools, products and services. These include:

• Establishing legal authority for collecting and using personal information;
• When relying on consent, ensuring that it is valid and meaningful;
• Being open and transparent about the way information is used and the privacy risks involved;
• Taking reasonable steps to ensure the accuracy of input and output data;
• Making AI tools explainable to users and providing users with opportunity to access and correct personal information about them;
• Developing safeguards for the protection of privacy rights; and
• Limiting the sharing of personal, sensitive or confidential information.

Developers are also urged to take into consideration the unique impact that these tools can have on vulnerable and historically disadvantaged groups.

The document provides examples of best practices, including building privacy into how AI tools are developed, and ensuring that generative content which could have a significant impact on an individual is identified as being created by a generative AI tool.

Principles for Responsible, Trustworthy and Privacy-Protective Generative AI Technologies