AMNLegal

AI vendors often claim that using customer data to “improve” or “train” their systems is standard practice, even inevitable. Under PIPEDA, that assumption does not hold. PIPEDA is built on a simple premise: that organizations may only collect, use, or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances, and only with meaningful consent. Training or developing AI models using customer data is not the same purpose as providing the service the customer signed up for. It is a secondary use, and secondary uses require their own legal justification.

Consent under PIPEDA must be informed, specific, and meaningful. Burying AI-training language in a privacy policy or terms of service will rarely be enough, particularly where customers would not reasonably expect their data to be repurposed for model development. The Office of the Privacy Commissioner has consistently warned that organizations cannot rely on vague “service improvement” language to justify new, data-intensive uses. If personal information is involved, express consent is the safer baseline, not implied consent.

Some providers argue that consent is unnecessary if data is de-identified or used internally. That position is risky. Moreover, “internal use” does not exempt an organization from the consent requirement when data is retained, pooled across clients, or reused to train general-purpose models. Innovation does not override statutory limits.

AI providers that want to train on customer data must say so clearly, obtain proper consent, and offer meaningful limits or opt-outs. Customers, for their part, should treat AI-training clauses as material risk terms. It should restrict training to de-identified data, prohibit cross-customer model training, and require deletion at termination.