Canada — British Columbia PIPA: AI Compliance Requirements
British Columbia's Personal Information Protection Act (PIPA BC, SBC 2003) applies to private sector organizations in BC collecting, using, or disclosing personal data, including through AI automated decision-making. BC PIPA is substantially similar to PIPEDA. The BC OIPC (Office of the Information and Privacy Commissioner) enforces PIPA and has published specific AI guidance on automated decision-making, privacy impact assessments, and consent. Any organization with employees, customers, or operations in BC must comply.
Summary of publicly-available regulatory text as of 2026-08-22. Verify against current official sources before relying on this for compliance decisions. Not legal advice.
Key Facts
January 1, 2004
January 1, 2004
CAD 100,000 per violation — enforced by BC OIPC
What Your Business Must Do
2 compliance requirements identified. Critical requirements carry the highest risk of enforcement action.
BC PIPA Consent and Disclosure for AI
High PriorityBC PIPA requires meaningful consent before using personal information in AI systems for BC residents. Disclose AI use in privacy policies, obtain appropriate consent for AI-driven profiling or automated decisions, and implement processes to honor access requests for personal data used in AI decisions. BC has stricter consent requirements than federal PIPEDA.
Deadline: January 1, 2004
BC PIPA (SBC 2003)Privacy Impact Assessment for High-Risk AI (BC OIPC)
Medium PriorityBC OIPC guidance requires PIAs for high-risk AI processing. Conduct a PIA for AI systems making consequential decisions about BC residents (hiring, benefits, credit, healthcare). Review OIPC guidance at oipc.bc.ca.
Deadline: January 1, 2004
BC PIPA (SBC 2003), reasonable-purposes test, as applied by OIPC BC AI guidanceWho Does This Apply To?
Applies to private-sector organisations in British Columbia that collect, use, or disclose personal information — including through AI automated decision-making — relating to BC employees, customers, or operations. BC's PIPA (SBC 2003) is substantially similar to federal PIPEDA and is enforced by the BC OIPC. In scope: any organisation using personal information in AI systems for British Columbia residents (meaningful consent and privacy-policy disclosure required; BC's consent requirements are stricter than federal PIPEDA), and AI systems making consequential decisions about BC residents in hiring, benefits, credit, or healthcare (a Privacy Impact Assessment is expected under the OIPC's reasonable-purposes test). The joint federal-provincial Clearview AI investigation (Joint Report of Findings, 3 Feb 2021) produced a binding order to cease collecting and delete British Columbians' facial images. Maximum exposure: CAD 100,000 per violation (offence fines prosecuted in court; the BC OIPC itself issues binding cessation, deletion, and remediation orders rather than administrative monetary penalties).
Recent Enforcement Actions
Against: Clearview AI, Inc.
SourceAgainst: OpenAI OpCo, LLC
SourceRecent Regulatory Guidance
OIPC BC — Privacy in the Age of Artificial Intelligence (2024)
OIPC BC's AI guidance laid out PIPA application to AI: (1) BC private-sector organizations must apply PIPA's reasonable-purposes test before deploying AI to process BC-resident personal information; (2) accountability and openness obligations require documented AI governance, including DPIAs for high-risk processing; (3) individuals retain the right to access information used in AI-driven decisions and to challenge inaccuracies; (4) cross-border transfers of BC personal information to AI vendors must include appropriate contractual protections; (5) employees and customers must be told when AI is used in decisions affecting them. OIPC BC monitors federal AIDA developments and the BC Government's AI policy framework.
Key Case Law & Precedent
OPC + OIPC BC + OIPC AB + CAI QC v. Clearview AI Inc. (Joint Investigation, February 2021; upheld on appeal, BCCA, February 2026)
Joint Federal-Provincial Privacy Authorities of Canada; Court of Appeal for British Columbia · 2021-2026Foundational joint Canadian privacy authorities' investigation finding Clearview AI's facial-image scraping for its biometric database violated federal PIPEDA and provincial PIPA (BC), PIPA (AB), and PPIPA (QC). OIPC BC's portion of the order required Clearview to cease processing British Columbians' images. CYCLE 19 (2026-08-22): now a confirmed appellate precedent — the BC Court of Appeal dismissed Clearview's appeal in full (2026 BCCA 67, 2026-02-18), including on the extraterritoriality question. The investigation remains the leading Canadian precedent on AI biometric processing and is the template OIPC BC applies in subsequent AI-profiling enforcement under PIPA's reasonable-purposes test.
Outcome: Cease-and-desist orders from federal OPC and provincial DPAs; mandatory deletion of Canadians' facial-image data; order UPHELD on appeal by the BC Court of Appeal, 2026-02-18 (2026 BCCA 67), appeal dismissed
Case referenceFrequently Asked Questions
Does Canada — British Columbia PIPA apply to my business?
British Columbia's Personal Information Protection Act (PIPA BC, SBC 2003) applies to private sector organizations in BC collecting, using, or disclosing personal data, including through AI automated decision-making. BC PIPA is substantially similar… Use Aegis Firma's free scanner to get a personalized assessment in under 5 minutes.
What is the penalty for non-compliance?
The maximum penalty under Canada — British Columbia PIPA is: CAD 100,000 per violation — enforced by BC OIPC. Fines are typically scaled by company size, severity of violation, and whether violations were willful or accidental.
How do I comply with Canada — British Columbia PIPA?
The 2 requirements above cover the core obligations. The fastest path to compliance is: (1) conduct an AI risk assessment, (2) document your AI systems, (3) implement transparency disclosures where required. Aegis Firma generates all required documents automatically.
Official Source
https://www.oipc.bc.ca/guidance-documents/2280Last updated: 2026-08-22 — verify at source before relying on this information.
Don't leave compliance to chance
Aegis Firma scans your AI tools, tells you exactly which regulations apply, and generates all required documents — in 30 minutes.
Start your free compliance scan