Your staff are almost certainly using artificial intelligence (AI) tools already. Someone is drafting emails in ChatGPT, someone is summarising meeting notes with Microsoft Copilot, and someone has pasted a client spreadsheet into a free chatbot to "clean it up." These tools can save real time. They can also send personal information about your clients and staff to a service you have no agreement with.

This article explains, in plain English, how Canadian privacy law applies to AI tools at work, what staff should never paste in, why the type of account matters, and how to put a short acceptable-use policy in place.

Not legal advice. This article summarises public guidance from Canadian privacy regulators. For decisions about your specific obligations, speak with a lawyer who practises privacy law.

Which privacy law applies to you

Most private businesses in British Columbia fall under the BC Personal Information Protection Act (PIPA), overseen by the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC). Federally regulated businesses, and personal information that crosses provincial or national borders in the course of commercial activity, can fall under the federal Personal Information Protection and Electronic Documents Act (PIPEDA), overseen by the Office of the Privacy Commissioner of Canada (OPC). Some businesses deal with both.

Neither law mentions ChatGPT by name. They do not need to. Both laws already say what you may collect, how you may use it, who you may share it with and how you must protect it. Typing personal information into an AI tool is a use, and often a disclosure to the company that runs the tool. The same rules apply.

What the regulators have said

In December 2023, the federal, provincial and territorial privacy regulators, including the OIPC BC, jointly published Principles for responsible, trustworthy and privacy-protective generative AI technologies. The principles apply to organizations that develop AI tools and to organizations that use them. Several points matter directly to a small business:

  • Legal authority. Know and document your legal authority, such as consent, for using personal information with an AI tool.
  • Limit personal information. Use anonymised, de-identified or non-personal information wherever possible. The principles say personal information should go into prompts only when authorised and necessary.
  • Sensitive information. Sensitive or confidential information should go into a prompt only where authorised, and should be protected in proportion to its sensitivity.
  • Accountability stays with you. The organization, not the AI system, is accountable for decisions. People affected by significant decisions should be able to challenge them and ask for human review.
  • Openness. Be open about how AI tools are used with personal information, and tell people when AI is part of a decision about them.

The OIPC BC has also published guidance on PIPA and AI scribes for healthcare organizations in BC, which is useful reading for clinics that are considering AI note-taking tools.

Two parts of BC PIPA are worth knowing here. Section 4 says an organization is responsible for personal information under its control, including information held by others on its behalf. Section 34 says an organization must protect personal information in its custody or under its control by making reasonable security arrangements. If staff paste client information into a tool your business has no agreement with, it becomes hard to show either.

What staff must not paste in

The simplest rule is this: if you would not email it to a stranger, do not paste it into an AI tool that your business has not approved. In practice, keep the following out of any unapproved tool:

Never paste into an unapproved AI tool

  • Names together with contact details, dates of birth or addresses of clients, patients or staff
  • Social Insurance Numbers, driver's licence numbers, passport numbers or health card numbers
  • Health, medical, counselling or treatment information
  • Banking, credit card or payroll details
  • Employee files: performance reviews, discipline, medical leave, salary
  • Client contracts, legal matters, financial statements or anything marked confidential
  • Passwords, access codes, network details or security settings

Removing the name is not always enough. A detailed description of a person's situation, combined with their town and job, can still identify them. When in doubt, describe the task in general terms ("write a polite reminder about an overdue invoice") rather than pasting the real record.

Business accounts versus consumer accounts

The same AI product can come in very different versions. A free or personal account is covered by consumer terms between the individual and the vendor. A business account is covered by an agreement between your organization and the vendor, usually with commitments about how data is handled.

Microsoft is a clear example. Microsoft documents that when Copilot and Copilot Chat are used with a work or school account, prompts and responses are covered by its enterprise data protection terms under the Data Protection Addendum, with Microsoft acting as a data processor, and that prompts and responses are not used to train its foundation models. Your existing access controls, sensitivity labels and retention policies also apply. A personal Microsoft account signed in on the same computer does not carry those business commitments.

Other vendors offer similar business and enterprise plans with their own terms. Before you approve any tool, read the vendor's current business terms and privacy documentation and check three things:

  1. Is our data used to train the vendor's models, and can that be turned off for the whole organization?
  2. How long are prompts and files kept, and can we delete them?
  3. Can we manage who has access, and remove a user when they leave?
Comparison of personal and business AI accounts Personal or free account • Consumer terms with the individual • Business cannot see or manage use • Training settings chosen by the user • Stays with the person when they leave Approved business account • Agreement between business and vendor • Admin controls who has access • Data handling set in the contract • Access removed on the last day
Check the vendor's current business terms. Features differ by plan.

Other risks to manage

  • Wrong answers. AI tools can produce confident text that is simply incorrect. Anything that goes to a client, a regulator or a court must be checked by a person.
  • Decisions about people. Using AI to screen job applicants, assess clients or rate staff raises the accountability and openness points in the regulators' principles. Keep a person responsible for the decision and be ready to explain it.
  • Browser add-ons and meeting bots. Many AI features arrive as browser extensions or meeting assistants that read everything on screen or join calls. Treat these as new software that needs approval.
  • Privacy breaches. If personal information is pasted into the wrong place, treat it as a possible privacy breach. Under PIPEDA, organizations must report breaches that create a real risk of significant harm to the OPC, notify affected individuals and keep a record of every breach for two years. BC PIPA does not currently require organizations to notify individuals or the commissioner, but the OIPC BC encourages organizations to report breaches and offers tools to help. Our PIPEDA breach notification playbook walks through the assessment.

A short sample acceptable-use policy

A policy does not need to be long to be useful. Here is a starting point you can adapt. Have it reviewed against your own situation before you adopt it.

Sample: AI tools acceptable-use policy

  1. Approved tools only. Staff may use only the AI tools listed by management, signed in with their work account. Personal accounts must not be used for work.
  2. No personal or confidential information goes into any AI tool unless the tool is approved for that type of information and the use is necessary for the task.
  3. Remove details first. Where possible, remove names and identifying details, or describe the task in general terms.
  4. A person checks the output. Staff are responsible for checking AI output for accuracy before it is sent, filed or relied on.
  5. No decisions about people by AI alone. AI may assist, but a named person makes and records any decision about a client, applicant or employee.
  6. Be open. Where AI is used in a way that affects clients, we tell them.
  7. New tools need approval. Browser add-ons, meeting assistants and new AI apps must be approved before use.
  8. Report mistakes right away. If personal information is entered into the wrong tool, report it to the privacy officer the same day.
  9. Review. This policy and the approved list are reviewed at least once a year.

Share the policy with every staff member, ask them to acknowledge it, and include it in onboarding. Make it part of every new hire checklist, next to account setup and multi-factor authentication.

Where to start this week

Ask your team which AI tools they use today. You will likely find more than you expected. Decide which ones to approve, move people onto business accounts, publish the short policy above and name a person to answer questions. Our PIPEDA and BC PIPA compliance page has more on the broader privacy picture.

Want Help Setting Up AI Tools Safely?

Hexafusion helps Vancouver and Lower Mainland businesses choose approved AI tools, configure business accounts and access controls, and write a clear staff policy. Call us at 604-332-1500 or send us a message.

Contact Hexafusion    604-332-1500

Related articles: PIPEDA Breach Notification Playbook · Compliance in Canada by Industry · Mobile App Security and BYOD in BC

← Back to Blog