Confidentiality, PIPEDA, and AI data leakage

Lesson 3 of 7 in AI Tools at Work — Practical, Ethical, Safe · 25 minutes

When you paste text into a public AI tool, it leaves your organization. Sometimes it stays on the AI vendor's servers; sometimes it gets reviewed by humans; sometimes it's used to train future models. This lesson teaches you what to never paste, and how Canadian privacy law makes some leaks illegal.

What you'll learn

Identify the categories of data that should never be put into a public AI tool
Understand PIPEDA basics — what counts as 'personal information' under Canadian law
Recognize famous AI data leak incidents and what we learn from them
Apply an anonymization workflow before using AI

From the lesson

When you talk to an AI tool, you're talking to a service running on someone else's computer — usually in the United States. Whatever you paste in is no longer 'inside' your organization. Free tools (ChatGPT.com, Claude.ai with a personal account, Gemini.google.com) usually retain your input, may have humans review it for safety, and may use it to train future models. Enterprise tools, with the right contract, don't do these things — but you have to know which one you're using. The cost of getting this wrong can be a lost job, a privacy breach reportable to the Privacy Commissioner, and in some cases a lawsuit.

1. PIPEDA in 90 seconds

The Personal Information Protection and Electronic…