The Office of the Information and Privacy Commissioner (OIPC) of Alberta has developed a Frequently Asked Questions document for Albertans concerned about the recent online publication of the List of Electors.

On April 30, 2026, Elections Alberta informed the OIPC of the alleged breach of the List of Electors (LoE) by a third party. The LoE contains the personal information of millions of Albertans, including full names, addresses, postal codes, phone numbers, and unique elector identifier numbers.

In the last week, the OIPC has received more than 180 emails and phone calls with questions, concerns, comments and requests regarding this incident. Due to this high volume, the OIPC is unable to respond to each person individually. In addition, some of the matters in the citizen enquiries are not within the jurisdiction of the OIPC.

The questions or concerns received from Albertans include:

• How can I know what personal information about me was included in the List of Electors? I want access to this information. I want to know if my information has been compromised and used without my knowledge.
• How can I protect myself from possible harms as a result of the information on the List of Electors being made publicly available?
• I want to know if my name appears on any citizen petition and if it does, I want it removed.
• I want those involved in this breach to be prosecuted.
• I want a public inquiry into the matter.

In order to assist Albertans, the OIPC has now posted an FAQ on its website, which should clarify what the OIPC’s role in this type of matter is, what law governs a matter of this kind, what the Commissioner can and cannot do, what Albertans can do, and what action the OIPC has taken in this case.

Citizens are encouraged to review the FAQs before reaching out to the OIPC.

Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act. The Commissioner operates independently of government.

For more information:

Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
Mobile: (587) 983-8766

www.oipc.ab.ca

The Information and Privacy Commissioner of Alberta, Diane McLeod, has launched an investigation into allegations that the Centurion Project Ltd. has collected, used and disclosed personal information derived from the Alberta List of Electors, which, if true, may be in violation of the Personal Information Protection Act (PIPA). The Centurion Project was notified of the investigation on May 6, 2026.

“Section 36(1)(a) of PIPA authorizes me to conduct an investigation on my own motion to ensure compliance with any provision of PIPA,” said McLeod. “I have decided to exercise my authority to investigate these allegations. I also have authority under PIPA to order compliance where non-compliance is found during an investigation.”

Initially, the investigation will examine the following issues:

1. Does Centurion have the authority to collect the personal information directly and/or indirectly pursuant to section 11 of PIPA?
2. Does Centurion have the authority to use the personal information pursuant to section 16 of PIPA?
3. Does Centurion have the authority to disclose the personal information pursuant to section 19 of PIPA?
4. Has Centurion made reasonable security arrangements to protect the personal information as required under section 34 of PIPA?
5. Does Centurion have an obligation to comply with the duty to notify as set out in section 34.1 of PIPA and if so, has it met this obligation?

Additional issues may be considered based on evolving circumstances or in response to evidence received.

At the conclusion of this formal investigation, the OIPC may make findings and recommendations or issue an order to remedy any non-compliance.  The Commissioner may also issue a public investigation report.

Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act. The Commissioner operates independently of government.

For more information:

Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
Mobile: (587) 983-8766

www.oipc.ab.ca

The investigation concluded that the initial development of ChatGPT was not compliant with provincial and federal privacy laws and identified a number of privacy issues that were present in the training and deployment of certain ChatGPT models. The report contains a number of recommendations and also notes that OpenAI has begun to take steps to address privacy concerns relating to the ongoing development and operation of ChatGPT.

The investigation was originally triggered by a complaint in April 2023 alleging collection, use and disclosure of personal information without consent. The joint investigation was announced in May 2023. It examined whether OpenAI’s collection, use and disclosure of the personal information of individuals in Canada, in relation to its AI-powered chatbot, ChatGPT, complied with federal and provincial private sector privacy laws. The investigation examined the workings of certain versions or models of ChatGPT that were in use at the time the investigation began in 2023. These models were ChatGPT 3.5 and ChatGPT 4.

“From the Alberta perspective, I want to note first that it is unfortunate and disappointing that technology companies have moved ahead so quickly with new developments and innovations, without first ensuring that they are adhering to privacy legislation,” said Alberta Information and Privacy Commissioner Diane McLeod. “Our investigation found that that OpenAI did not appear to turn its mind adequately to privacy compliance in its development and deployment of ChatGPT, which is very troubling. The first ChatGPT model was launched in 2022, nearly two decades after privacy law in Canada applied to the private sector.”

Throughout the course of the investigation and in response to findings and recommendations made by the regulators, OpenAI began to take steps to improve privacy protections in the ongoing development and delivery of ChatGPT. However, further work is required.

“An important aspect of this investigation is that each of the four regulators investigated compliance with the specific legislation that they oversee,” said McLeod. “As a result, the conclusions reached by each office varied due to the differences in the laws that they enforce. In the case of our office, we were investigating whether the development of ChatGPT was compliant with Alberta’s Personal Information Protection Act or PIPA, which governs private organizations such as corporations, unincorporated associations, professional regulatory organizations, trade unions and partnerships.”

The Act in British Columbia is similar to Alberta’s law, so both OIPC Alberta and OIPC BC found that OpenAI’s models are based on data scraped off publicly-accessible websites, for which OpenAI has not obtained, and cannot obtain, consent under PIPA-BC and PIPA-Alberta. While both offices are encouraged by the new measures aimed at compliance taken by OpenAI since this investigation began, and those which it has further committed to implement, none of them are sufficient to meet the foundational requirement for consent in the Alberta and BC laws. Despite this finding, OIPC Alberta joins OIPC BC, the Commission d’accès à l’information du Québec (CAI) and OPC in making the joint recommendations and in monitoring the implementation of the measures to which OpenAI has committed.

“The privacy laws we currently have in Canada were drafted and enacted during a time when today’s incredible advancements in technologies, such as AI, would have strained believability,” added McLeod. “Legislators now face the challenge of modernizing privacy laws in ways that will enable AI companies to continue to develop these innovative technologies, but only in a manner that safeguards privacy, reduces potential harms to citizens, and requires accountability and transparency. My hope is that OpenAI has learned from this investigation and that other technology companies that are developing and deploying AI or other novel technologies also learn from this report that privacy must be a top priority and cannot be an afterthought.”

Given the potential impacts of AI on the privacy of Canadians, the federal and provincial privacy authorities conducted this joint investigation to leverage combined expertise and resources to enforce privacy laws effectively while avoiding duplication of efforts. This collaboration demonstrates a shared commitment to protecting Canadians’ fundamental right to privacy.

Please view the report and the overview at the links below:

• Joint Investigation Report
• Report Overview [OPC website]

Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act. The Commissioner operates independently of government.

For more information:

Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
Mobile: (587) 983-8766

www.oipc.ab.ca

Backgrounder to News Release: Summary of joint investigation into OpenAI’s ChatGPT

The Office of the Privacy Commissioner of Canada (OPC), along with the Commission d’accès à l’information du Québec, the Office of the Information and Privacy Commissioner for British Columbia, and the Office of the Information and Privacy Commissioner of Alberta, conducted a joint investigation into OpenAI’s ChatGPT to assess whether the company’s collection, use, and disclosure of Canadians’ personal information complied with federal and provincial privacy laws.

• Overview and key findings
• Jurisdictional differences and investigative outcomes
• OpenAI’s response and future commitments
• Key takeaways for organizations

Overview and key findings

The investigation focused on ChatGPT’s early models, examining how OpenAI sourced its training data – including publicly-scraped content, licensed datasets, and user interactions – and whether it adhered to the key privacy principles such as consent, transparency, and data accuracy.

The regulators’ findings highlighted privacy concerns related to the scale and sensitivity of data collected, and the adequacy of user consent, among other issues. As a result, the regulators concluded that the way that OpenAI had initially trained ChatGPT was not compliant with federal and provincial privacy laws. Specifically, the regulators found:

• Overcollection of personal information: OpenAI gathered vast amounts of personal information without adequate safeguards to prevent use of that information to train its models. This could include sensitive details such as individuals’ health conditions and political views, as well as information about children.
• Lack of valid consent and transparency: OpenAI did not obtain valid consent for the collection of personal information, as required under privacy laws. Many users were unaware that their data was collected and used to train ChatGPT. OpenAI did not clearly explain that personal information collected from publicly-accessible sources could include data from social media, discussion forums, and other similar websites.
• Factual inaccuracies and fabricated “hallucinations”: OpenAI provided insufficient notifications about potential inaccuracies in ChatGPT responses. Until recently, it had not conducted an assessment to validate the accuracy of any personal information included in ChatGPT responses to user prompts.
• Access, correction and deletion: OpenAI did not provide all individuals with an easily accessible and effective mechanism to access, correct, and delete their personal information.
• Lack of accountability: OpenAI released ChatGPT without having fully addressed known privacy risks, and without establishing data-deletion rules. This exposed individuals to risks of harm, including privacy breaches, inaccuracy of information, and discrimination on the basis of information provided about them.

Jurisdictional differences and investigative outcomes

While privacy legislation in British Columbia, Alberta, and Québec is considered substantially similar to the federal private-sector privacy law, each jurisdiction investigated compliance with the specific laws that they oversee. The conclusions reached by each office varied due to the differences in the laws that they enforce.

OpenAI’s response and future commitments

OpenAI has indicated it has already put in place measures which address some of the concerns raised in the report of findings, most importantly by significantly limiting the use of personal information and sensitive information that is used to train new ChatGPT models. OpenAI has indicated that it has retired its earlier ChatGPT models that were trained in a manner that contravened Canadian privacy laws.

Open AI has indicated that its current models powering ChatGPT were developed and deployed using the new safeguards, which has helped to improve their privacy practices by:

• Limiting use of personal information: OpenAI has implemented a filtering tool to detect and mask personal information (such as names or phone numbers) in publicly accessible internet data and licensed datasets used to train its models. The tool significantly reduces the amount of private and sensitive information used in training.

• Improving accuracy: OpenAI has introduced a new web search feature which, when activated, conducts real-time web searches and references specific web sources for the content output by ChatGPT, allowing users to verify information independently.

• Improving access: OpenAI has improved the auto-response email that users receive when they submit an access request, better explaining how different types of personal information can be accessed.

• Facilitating corrections: OpenAI leverages the web search feature to process correction requests, allowing the models to retrieve up-to-date publicly accessible information about an individual and use that information in its response.

• Enhancing correction and deletion: OpenAI has developed a technical solution to block specific personal details about a public figure from appearing in model outputs, ensuring that ChatGPT continues to provide access to relevant public information while respecting privacy rights.

• Implementing retention policies: OpenAI has implemented formal retention policies and schedules to govern the retention and deletion of personal information processed in connection with ChatGPT.

Future improvements

OpenAI has also committed to implementing additional measures within specific timeframes to improve openness, access, retention, and children’s privacy:

• [Concurrently with the publication of the Report of Findings] OpenAI will publish more information explaining its privacy practices, including information about the sources of content used to train its models.

• [Within three months of the issuance of the Report of Findings] OpenAI will provide notice that chats may be reviewed and used to train models, and advise users not to share sensitive information, before the individual inputs their first user prompt in the signed-out ChatGPT web version.

• [Within six months of the issuance of the Report of Findings] OpenAI will make it easier to understand and use the data exports that it provides to users who request their personal information. They will also better explain the avenues available to users who want to challenge the completeness, accuracy, or nature of the information provided.

• [Within six months of the issuance of the Report of Findings] OpenAI will confirm to the offices that it has implemented strong protection for future datasets which are retired and used only as historical references, so they are not used for active model development. The company will also regularly review whether these datasets should still be kept.

• [Within six months of the issuance of the report of findings] OpenAI will test protective measures for the minor family members of public figures, who are themselves not public figures, to ensure that the models refuse requests for their name or date of birth.

OpenAI will provide quarterly reports to the OPC and its provincial partners to demonstrate compliance with the above commitments until they have all been met.

Key takeaways for organizations

Organizations have a responsibility to ensure that products and services that are using AI comply with existing domestic – both federal and provincial – and international privacy legislation and regulation.

The Principles for responsible, trustworthy and privacy-protective generative AI technologies can help support organizations in developing, providing or using generative AI in Canada.

Further resources for organizations:

• Joint statement on AI-generated imagery and the protection of privacy
• AI, privacy, and your business
• OIPC Alberta publishes report to provincial government on how to develop a framework governing use of artificial intelligence (AI) in Alberta

The Office of the Information and Privacy Commissioner (OIPC) of Alberta is still working to obtain more information regarding the unauthorized release of personal information from the List of Electors generated by Elections Alberta.

On the morning of Thursday, April 30^th, the OIPC was informed by Elections Alberta of a potential breach of the List of Electors by a third party.

Throughout the day, additional information was obtained from various sources, including news releases issued by the Office of the Chief Electoral Officer, enquiries from reporters, and news stories, regarding the involvement of a group called The Centurion Project.  According to these sources, the group had made public on its website a list of 2.9 million Albertans’ names, addresses and, in some cases, phone numbers; that the source of this information was the List of Electors maintained by the Chief Electoral Officer of Alberta; and that the list may have come from a political party that had legitimate access to the list.

“My office is still working to determine the facts of this case,” said Commissioner Diane McLeod. “However, it appears this matter may fall outside my jurisdiction. My office does not have jurisdiction over personal information contained in the List of Electors that may have been disclosed by a political party. This is because the Personal Information Protection Act (PIPA) does not apply to political parties. As this matter unfolds, we will continue to work to determine whether we have jurisdiction over The Centurion Project. If so, I will investigate to determine whether any violations of PIPA occurred in acquiring the personal information and making it publicly accessible.”

“What happened here is very serious,” added McLeod. “More than 2.9 million Albertans have had their personal information breached. For some of these individuals there is likely a real risk of significant harm given that their home address and phone numbers have been made public. This could be especially harmful for certain individuals. Some examples might be those who work for law enforcement, who are public officials, who are fleeing intimate partner violence and other vulnerable individuals. This incident demonstrates that it is high time for political parties to be made subject to PIPA.”

The List of Electors is obtained under the Election Act from the Chief Electoral Officer as is authorized by that Act. This Act (section 18) requires the Chief Electoral Officer to distribute a List of Electors to political parties, non-party-affiliated members of the Alberta Legislative Assembly, and to potential candidates in certain circumstances and for specified purposes. The Election Act governs use and disclosure of this information by those who are permitted to receive it. While the Election Act has some controls concerning the List of Electors, this law does not protect the privacy rights of Albertans concerning their personal information and does not have the strong privacy protections that are in PIPA to protect these rights.

“This is evidence of a concerning gap in Alberta’s privacy laws as it relates to the collection, use and disclosure of personal information by political parties,” concluded McLeod. “This gap has been recognized by my office, which has been calling for PIPA to be amended to include political parties for decades. During the PIPA review, which is still underway, we renewed the call for political parties to be made subject to the Act. Of note is that BC’s PIPA, which is substantially similar to Alberta’s, does apply to BC’s political parties. I am once again calling on government to make political parties subject to PIPA in the next set of amendments to the Act.”

Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act. The Commissioner operates independently of government.

For more information:

Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
Mobile: (587) 983-8766

www.oipc.ab.ca

The Office of the Information and Privacy Commissioner (OIPC) of Alberta has developed new resources to help public bodies comply with the requirement to establish and implement a privacy management program (PMP) under Alberta’s Protection of Privacy Act (POPA) and Protection of Privacy (Ministerial) Regulation.

The new resources outline the privacy management program requirements for public bodies under POPA and its regulation and build on earlier best-practice guidance from privacy commissioners in Alberta, British Columbia, and Canada.

“By following the approach described in these resources, public bodies will be better prepared to meet their legal responsibilities under POPA,” said Information and Privacy Commissioner Diane McLeod. “This includes protecting privacy, providing appropriate access to personal information, and supporting accountability, transparency, and fairness.”

POPA came into force in June 2025. However, the legislation provided a one-year grace period for public bodies to have a PMP in place.

The guidance will help public bodies understand how to develop a PMP and what the OIPC will be looking for when assessing the PMPs of public bodies. It uses a ‘building block’ approach to guide public bodies through the development of their PMPs and provides a useful checklist of PMP requirements for public bodies, including the enhanced requirements for public bodies that process sensitive or high volumes of personal information.

In addition, the OIPC has developed a companion document for public bodies when contracting service providers. This is because public bodies need to consider both the work of their employees and any contracted service providers when developing PMPs.

“The massive privacy breach in December 2024 that affected educational institutions using PowerSchool education technology is a compelling example of the need for public bodies to develop and maintain high standards for protecting sensitive personal information, including when using service providers,” added McLeod.

Both resources are available on the OIPC website at oipc.ab.ca. Click here to view the Guidance for Public Bodies in Developing Privacy Management Programs and here to view the Guidance for Public Bodies when Contracting Service Providers.

Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act. The Commissioner operates independently of government.

For more information:

Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
Mobile: (587) 983-8766

www.oipc.ab.ca

The Office of the Information and Privacy Commissioner (OIPC) of Alberta has launched a Privacy Impact Assessment (PIA) Template and a PIA Completion Guide that align with the current requirements of the Protection of Privacy Act (POPA) and its regulations, which came into effect in 2025.

The completion of PIAs by public bodies is mandatory under POPA in certain circumstances. Some of these PIAs must be submitted to the Commissioner for review and comment. The purpose of a review by the OIPC is to assess whether the public body has adequately turned its attention to its compliance obligations under POPA and will, as represented in the PIA, be compliant with POPA when implementing the project.

The template and guide will assist public bodies in completing privacy impact assessments under POPA and help ensure that any PIAs submitted to the OIPC for review and comment contain the information necessary for our review. Any public body that is required to submit a PIA to the OIPC under POPA must use the template.

The two documents are now available on the OIPC website.

“We developed the template and guide specifically to assist public bodies in Alberta,” said Information and Privacy Commissioner Diane McLeod. “However, at recent events that I have attended across Canada, in speaking about our launch of these resources, I have been approached by others looking to leverage these resources for completing PIAs in their respective jurisdictions. While this template was designed specifically to align with POPA, it contains basic PIA requirements and will also be a useful reference for those in the field of privacy responsible for completing PIAs, regardless of location.”

This set of PIA resources is the first of three to be issued by the OIPC. Once Alberta’s health information law and private sector privacy law are amended and the amendments proclaimed in force, the OIPC will create similar resources for use by custodians and organizations to meet PIA requirements under those laws.

A Notice to Public Bodies has been published on the News and Events page of the OIPC website, describing the template and guide. From there, public bodies can link to the template and guide. They may also access the tools via the Resources page of the website, or by clicking on the Submit A Privacy Impact Assessment link on the website’s home page.

The completion guide will help public bodies in filling out the template. The guide aligns with the template on a question-by-question basis and provides additional context, a description of and what is expected of each question.

The template and guide will be updated from time to time as additional guidance becomes available, based on feedback from public bodies, or when otherwise necessary.

“We welcome feedback from public bodies regarding their experiences using the template and guide,” added McLeod. “We will take any suggestions or comments into consideration when making changes. Public bodies may provide feedback when they submit their PIAs and in addition, we will host an online engagement forum after the PIA template has been in use for some time, so that public bodies may share their experiences with the template and provide feedback and suggestions.”

Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act. The Commissioner operates independently of government.

For more information:

Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
Mobile: (587) 983-8766

www.oipc.ab.ca

Since the enactment of the Protection of Privacy Act (POPA), the Office of the Information and Privacy Commissioner (OIPC) has developed a new Privacy Impact Assessment (PIA) Template (POPA PIA Template) and a POPA PIA Completion Guide (POPA PIA Guide) that align with the current requirements of POPA and its regulations.

The completion of PIAs by public bodies is mandatory under POPA in certain circumstances. Some of these PIAs must be submitted to the Commissioner for review and comment.

The POPA PIA Template and POPA PIA Guide will assist public bodies in completing a PIA, as required, and help ensure that any PIAs submitted to the OIPC for review and comment contain the necessary information.

The two documents are now available on the OIPC website.

Table of Contents

• • Who should use the POPA PIA Template
  • How the POPA PIA Template will help
  • The POPA PIA Guide
  • A brief transition period: PIAs previously prepared and ready for submission
  • Moving forward: What to expect next
  • Need help?

Who should use the POPA PIA Template

The purpose of a review by the OIPC is to assess whether the public body has adequately turned its attention to its compliance obligations under POPA and will, as represented in the PIA, be compliant with POPA when implementing the project.

Any public body that is required to submit a PIA to the OIPC under POPA must use the POPA PIA Template. The OIPC will not accept a PIA from a public body that does not use the template.

The template is also available for public bodies to use when completing PIAs that are prescribed under POPA but are not required to be submitted to the Commissioner. Since the Commissioner may request copies of those PIAs under section 26(3) of POPA, the OIPC strongly recommends that public bodies use the template for completing these PIAs as well.

As well, the template is available and recommended for those bodies doing POPA-related PIAs voluntarily.

Be sure to use ONLY the POPA PIA Template and POPA PIA Guide when submitting a PIA to the Commissioner under POPA. Other material on our website that deals with PIAs, such as the Privacy Impact Assessment Requirements Guide, is directed toward PIA submissions under the Health Information Act (HIA).

How the POPA PIA Template will help

The POPA PIA Template provides overarching guidance in the first few sections, entitled Introduction, Common Questions, and Read Before Completing Your PIA.

In some cases, the need to complete certain parts of the template depends on the type of project and whether it includes aspects such as data matching, a common or integrated program or service, or the use of automated decision systems such as artificial intelligence (AI).

Public bodies should download a new copy of the template from the OIPC website each time they submit a new PIA to the Commissioner, rather than relying on previous versions of the template, as changes may have been made to the template since their last download.

PIAs should be submitted by attaching the completed PIA template, along with associated appendices, to an email, to be sent to PIA@oipc.ab.ca. Email is not a secure form of communication, so the OIPC recommends that security measures be applied to attachments sent by email.

IMPORTANT: If the POPA PIA Template is not completed appropriately, the PIA submission will be deemed incomplete and will not be reviewed by the OIPC. If this occurs, the OIPC will notify public bodies in writing.

The POPA PIA Guide

The OIPC has prepared a supplementary POPA PIA Completion Guide to assist public bodies in filling out the template. The guide aligns with the template on a question-by-question basis and provides additional context, a description of and what is expected of each question.

The POPA PIA Template and POPA PIA Completion Guide will be updated from time to time as additional guidance becomes available, based on feedback from public bodies, or when otherwise necessary.

A brief transition period: PIAs previously prepared and ready for submission

If a public body has a PIA ready for submission, which was created without access to the POPA PIA Template and POPA PIA Completion Guide, it is still advisable for those public bodies to refer to these new documents and submit their PIA using the new OIPC template.

During the first few weeks after the launch of the template by OIPC, if public bodies do not use the template, they should, at the very least, review these POPA PIA resources and make sure the requirements identified in those resources have been addressed in the PIA. The key issue is to ensure section 7(3) of the M-Regulation is met, i.e. a privacy impact assessment must provide a level of detail commensurate with the complexity of the practice, program, project or service the privacy impact assessment relates to.

If a public body submits the PIA without use of these materials, there is a risk it will not meet the OIPC requirements for review.

AS OF MAY 1, 2026, THE OIPC WILL NOT ACCEPT ANY PIA SUBMISSION THAT DOES NOT USE THE POPA PIA TEMPLATE.

Moving forward: What to expect next

The OIPC welcomes feedback from public bodies regarding their experiences using the POPA PIA Template and POPA PIA Completion Guide. We will take any suggestions or comments into consideration when making changes to the template. Public bodies may provide feedback when they submit their PIAs. Please include feedback in a separate document and attach it to the email that includes your PIA submission.

In addition to accepting this type of feedback, the OIPC will be hosting an online engagement forum after the PIA template has been in use by public bodies for some time, so that public bodies may share their experiences with the template and provide feedback and suggestions.

The PIA FAQ on the OIPC website is currently being revised and once complete, it will be posted on the OIPC website.

The POPA PIA Template references Privacy Management Programs (PMPs). The duty for public bodies to have an operational PMP will come into effect on June 11, 2026. The OIPC is currently developing PMP guidance to assist public bodies. Once available, the PMP guidance will be published on the OIPC website.

Need help?

If you have questions, please contact the OIPC at generalinfo@oipc.ab.ca or call 780-422-6860 (tollfree 1-888-878-4044).

The results of the latest Global Privacy Enforcement Network (GPEN) sweep highlight how child-friendly practices can protect children’s privacy online. Along with emerging concerns, the sweep identifies improvements in some regards.

The global sweep included 27 data protection and privacy authorities from around the world, including the Office of the Information and Privacy Commissioner (OIPC) of Alberta. The sweep examined almost 900 websites and apps that are used by children. While some are designed for children’s use, others are used by the general population but are popular with children.

“Children’s privacy remains a key priority for our office, as stated in our annual business plan,” said Information and Privacy Commissioner of Alberta Diane McLeod. “Participation in this annual initiative helps us to raise awareness about how children’s personal information is used. Our focus for the most recent sweep focussed on popular games aimed at children, even those as young as five years old, as well as educational applications and social media. We are pleased to see that protections for children have been enhanced in some regards, but new concerns have also arisen.”

The findings in Alberta align largely with findings around the globe. For example, one finding from the Alberta part of the sweep is that apps aimed specifically at children are more likely to have child-friendly privacy practices, compared to those aimed at a larger audience (but still popular amongst children).

As part of the global initiative, the Alberta OIPC looked at the platforms’ mechanisms and practices regarding the collection of users’ personal information, as well as those relating to transparency, age assurance and limitations on data collection.

By replicating a 2015 children’s privacy sweep done by GPEN, participating authorities were able to compare how online services protected children then and now.

Overall, the sweep found good practices to protect children and their personal information, such as notifications advising children not to use their real names or upload images, as well as having location-sharing disabled by default.

However, the sweep also found concerning practices and increases in some privacy risks to children over the last decade. For example, compared to 2015, more of the online services used by children now require users to provide their personal information to access the full functionality of the platform. In addition, more platforms indicated in their privacy policies that they may share personal information with third parties.

The sweep found increased use of age assurance mechanisms to limit children’s access to online services but also found that such measures could easily be circumvented. This is a particular concern when websites and apps have inappropriate content or high-risk data processing and design features for children.

“The privacy sweep is not an investigation, nor is it intended to conclusively identify compliance issues or legal contraventions,” said McLeod. “Instead, concerns identified during the sweep may support targeted advice and engagement with organizations or enforcement actions in the future.”

Quick Facts

Sweep participants evaluated websites and mobile applications based on five indicators, which largely mirrored those considered in the 2015 sweep.

• Age assurance: For 72% of websites and mobile applications reviewed, participants were able to circumvent age assurance measures, most often where self-declaration was used.
• Collection of children’s data: More than half (59%) of the websites and mobile applications required the collection of an email address to access the full functionality of the platforms, followed by 50% requiring usernames, and 46% requiring geo-location. Overall, participants noted an increase in the collection of certain types of information compared to 2015.
• Protective controls: 71% of the websites and mobile applications did not have information about protective controls and privacy practices that were tailored to children.
• Account deletion: More than one third (36%) of the websites and mobile applications did not provide an accessible way to delete accounts.
• Inappropriate content and high-risk design features: Only 35% of the websites and mobile applications identified as having high-risk data processing and design features for children had privacy information, such as a pop-up, directing a young person to seek permission from their parents to continue using the website or app.

The privacy sweep is an annual initiative aimed at increasing awareness of privacy rights and responsibilities, encouraging compliance with privacy legislation, and enhancing cooperation between international data protection and privacy authorities.

This year’s sweep was coordinated by the Office of the Privacy Commissioner of Canada, the United Kingdom Information Commissioner’s Office, and the Office of the Data Protection Authority of the Bailiwick of Guernsey.

The Global Privacy Enforcement Network was established in 2010 upon recommendation by the Organisation for Economic Co-operation and Development (OECD). The network’s aim is to foster cross-border cooperation among privacy regulators in an increasingly global market in which commerce and consumer activity relies on the seamless flow of personal information across borders. Its members work together to strengthen personal privacy protections in this global context. The informal network is comprised of more than 80 data protection and privacy authorities from around the world.

Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act.  The Commissioner operates independently of government.

Click here to read the GPEN news release, with links to this year’s GPEN Sweep report (in English and French) found at the bottom of the news release.

For more information:

Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
Mobile: (587) 983-8766

www.oipc.ab.ca

The Office of the Information and Privacy Commissioner (OIPC) of Alberta has joined other data protection authorities from around the globe today to publish a Joint Statement on AI-Generated Imagery.

The statement represents the united position of 61 authorities. It has been issued in response to serious concerns about artificial intelligence (AI) systems that generate realistic images and videos depicting identifiable individuals without their knowledge and consent. The signatories are especially concerned about potential harms to children.

The statement outlines key expectations and fundamental principles for all organisations developing and using AI content generation systems including:

• To implement robust safeguards to prevent the misuse of personal information and the generation of non-consensual intimate imagery and other harmful materials, particularly where children are depicted.
• To ensure meaningful transparency about AI system capabilities, safeguards, acceptable uses and the consequences of misuse.
• To provide effective and accessible mechanisms for individuals to request the removal of harmful content involving personal information and to respond rapidly to such requests.
• To address specific risks to children through implementing enhanced safeguards and providing clear, age-appropriate information to children, parents, guardians and educators.

The co-signatories of the joint statement aim to share information on their approaches to addressing these concerns, including in the areas of enforcement, policy and education.

The statement has been coordinated by the International Enforcement Cooperation Working Group (IEWG) of the Global Privacy Assembly (GPA).

The Alberta OIPC has been actively advocating for appropriate safeguards on AI to protect Albertans from harm, including in comments during reviews of the Freedom of Information and Protection of Privacy Act, the Health Information Act (HIA) and the Personal Information Protection Act (PIPA). Specifically, this work includes:

• Comments to the Government of Alberta on regulation of AI in healthcare after reviewing proposed amendments to HIA, December 2025;
• Guidance on development of privacy impact assessments for use of AI Scribes, September 2025;
• Report for the Government of Alberta summarizing considerations and recommendations for a legal and policy framework to regulate the use of AI in Alberta, July 2025;
• Comments to the Government of Alberta on legislation replacing the FOIP Act, November 2024;
• Submission for the PIPA review, touching on AI and numerous building blocks for AI regulation, May 2024;
• Launch, along with other Canadian privacy regulators, of the Principles for Responsible, Trustworthy and Privacy-Protective Generative AI Technologies, December 2023; and
• Guidance for small custodians on the use of AI, November 2023.

Aside from the OIPC of Alberta, other Canadian signatories of today’s joint statement include the Office of the Privacy Commissioner of Canada, the OIPC for British Columbia, the OIPC for Newfoundland and Labrador, and the Commission on Access to Information of Quebec. International signatories are based in such areas as Europe, South and Central America, Australia, Asia and Africa.

Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act.  The Commissioner operates independently of government.

For more information:

Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
Mobile: (587) 983-8766

www.oipc.ab.ca

The Office of the Information and Privacy Commissioner (OIPC) of Alberta is marking international Data Privacy Week by highlighting its ongoing work to protect the privacy rights of children and youth.

Data Privacy Week is celebrated around the world each year. In 2026, it takes place from January 26^th through January 30^th.

“In an increasingly digital world, children’s personal information is collected, used, altered, and shared in ways and on a scale that requires heightened care, accountability, and oversight,” said Information and Privacy Commissioner of Alberta Diane McLeod. “Children and youth are among the most vulnerable users of digital services, particularly when technology is used in education, or for social purposes. That said, I am pleased to see progress in terms of positive and necessary measures being taken. For example, Alberta’s new Protection of Privacy Act (POPA) designates children’s information as sensitive, requiring additional protection and due care. It is my hope and recommendation that upcoming changes to Alberta’s private sector privacy legislation will also further enhance privacy protection for children and protect them from associated harms. Protecting the privacy of children is a top priority for my office, as highlighted in my 2026-29 Business Plan.”

In recent years, the OIPC has undertaken and participated in various significant initiatives focused on children’s privacy. Some notable initiatives that took place in the last year are:

• In November 2025, the Alberta OIPC joined privacy regulators across Canada in issuing a joint statement on protecting the privacy of children and youth in the classroom through responsible educational technologies. The statement called on governments, school authorities, and technology providers to ensure that educational technologies are designed and used in ways that respect children’s privacy, minimize data collection, and provide meaningful safeguards.
• That same month, the Alberta OIPC published an investigation report into the PowerSchool privacy breach, which affected many schools and school boards in Alberta and elsewhere. The Alberta OIPC and its counterpart in Ontario coordinated their investigations to enhance collaboration and information-sharing in the handling of cross-jurisdictional investigations. The key focus of the investigations was on safeguarding students’ personal information. The resulting reports underscored the heightened obligations that organizations have when handling children’s personal information and the serious consequences that can arise from inadequate security practices. The Commissioners called on their respective governments to support the education sector by using their procurement lever to strengthen the bargaining power of educational bodies when negotiating agreements with edtech service providers, in order to enable educational bodies to meet their privacy law requirements.
• The Alberta OIPC participated in the 2025 Global Privacy Enforcement Network (GPEN) sweep, which focused on children’s privacy in online apps and educational technology. As part of the sweep, the OIPC of Alberta examined whether apps used by children in the province were providing clear information, limiting data collection, and offering appropriate protections for children and youth. The results of the sweep will be published in 2026.
• Also in 2025, the Alberta OIPC worked jointly with various provincial and federal counterparts on a joint investigation into TikTok. The investigation found that TikTok’s age-assurance measures and privacy protections were inadequate, and that advertisers were able to target youth, based on their profiles. The findings highlight systemic risks associated with platforms that fail to design services with children’s privacy in mind. Earlier work of the federal, provincial, and territorial privacy regulators promotes good privacy design practices and calls on organisations to prevent ‘deceptive design’ practices, which are used on websites and mobile apps to influence, manipulate, or coerce users to make decisions that are not in children’s best interests.

The Alberta OIPC regularly works with federal, territorial and other provincial privacy regulators to maximize the efficiency and impact of its work. Joint investigations, guidance development and resolutions allow regulators to address cross-jurisdictional privacy issues more effectively, particularly where children’s personal information is involved. The Alberta OIPC also participates in international groups, when doing so advances the interests of Albertans.

“Children deserve to learn and play without having their personal information misused or exploited, including while participating in online activities,” McLeod added. “They should not be subjected to harm due to the pursuit of profit by others. During Data Privacy Week, we re-affirm our commitment to work with partners in Alberta, across Canada, and internationally to ensure that children’s privacy remains at the centre of our privacy protection efforts.”

Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act.  The Commissioner operates independently of government.

For more information:

Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
Mobile: (587) 983-8766

www.oipc.ab.ca