Can a Canadian company sell its data to AI companies?

Yes: a Canadian company can license its own records to an AI buyer, but the people named in them decide how. Under PIPEDA, personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law, and a buyer training its own model is a new purpose. The exception for selling a business does not help, because it does not apply to a deal whose primary purpose or result is the sale of personal information. So the records that sell leave de-identified, to the regulator's standard of no serious possibility that the information may be reidentified. In Alberta, British Columbia and Quebec a provincial law governs what happens within the province and PIPEDA the step across a border; Quebec's is the strictest. Buyers do take Canadian companies: several name Canada beside the US on their own forms.

This guide is for founders, officers and advisers of a Canadian company, operating or closing, that has been asked about its data or wants to know what it is worth. It covers what the company can sell, what PIPEDA and the provincial laws (Quebec's above all) require, sending records to a US buyer, who buys and what they pay, and the steps. It is research from public sources, not legal advice.

Contents

1. What the company can sell
2. Consent and the new purpose
3. The exceptions, and why they rarely fit
4. De-identification: the federal standard
5. Quebec
6. Sending records to a buyer in the United States
7. Who buys from Canada, and what they pay
8. A company that is closing or has closed
9. The steps
10. Questions people ask

What the company can sell

The company owns its working records: the email, chat and documents its staff wrote in the course of their work, its tickets, project files and code. Those are what buyers of company records pay for, because they show how the work was done. Three kinds of record need sorting first:

• Records about customers and contacts. PIPEDA governs them, because a paid licence of records is a transaction of a commercial character. In Alberta, British Columbia and Quebec the provincial law governs them within the province, and PIPEDA still applies to transactions involving personal information transferred across borders, as a licence to a US buyer is.
• Records about staff. PIPEDA covers employees' information only where the employer is a federal work, undertaking or business; for other employers it depends on the province's own law. Either way, personnel files are cut out whole, and staff names are removed from working records.
• Records that belong to someone else. Client files under contracts that give the output to the client, and data the company itself licensed from a supplier, stay out unless that party agrees.

Consent and the new purpose

PIPEDA's rule for a new use is direct: when personal information is to be used for a purpose not previously identified, the new purpose shall be identified prior to use, and the consent of the individual is required. A customer who opened a support ticket, or a contact who emailed the company, was not told that the record would train an AI model. The regulator adds that particular attention belongs to disclosures to third parties that may use the information for their own purposes, which is exactly what a buyer of training data does.

Even with consent, the purpose itself has to pass a second test: the company may collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances. And consent by opting out is acceptable only where the information is demonstrably non-sensitive and shared in a limited, well-defined way, which free-text email, tickets and recordings rarely are. The regulator's principles for generative AI ask every party to know and document their legal authority for the disclosure.

For most companies that settles it: asking every former customer and contact for consent is impractical, so the records are de-identified before any buyer sees them.

The exceptions, and why they rarely fit

The business transaction exception. PIPEDA lets companies share personal information without consent to complete a sale of the business, but not in a transaction of which the primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information. A licence whose value is the records is that kind of transaction.

The research exception. Disclosure without consent is allowed for statistical, or scholarly study or research, purposes that cannot be achieved without disclosing the information, where it is impracticable to obtain consent and the organization informs the Commissioner first. All three conditions apply, and commercial model training is not what the provision describes, so a holder should not build a licence on it.

A new law. Bill C-36 would replace this part of PIPEDA, but it is still awaiting second reading in the House of Commons, with no step since first reading. PIPEDA stays the law until a new one is passed and in force.

De-identification: the federal standard

PIPEDA does not define "anonymous". Applying the Federal Court's "serious possibility" test (Gordon v. Canada (Health), 2008 FC 258), the Privacy Commissioner found in the Loblaw case that an organization must ensure that there is no serious possibility that the information retained may be reidentified, either alone or in combination with other information. Removing names, emails and phone numbers was not enough in that case. In practice a de-identified lot for an AI buyer:

• replaces names of people and companies, addresses, phone numbers, account and customer numbers, consistently across the records so they still read as one company's work;
• cuts out whole the files about health, finances or employment;
• is checked by a person against the original before it leaves, with the method written down.

Our de-identification standard sets out each step and what is removed.

Quebec

A company in Quebec answers to Quebec's private-sector Act as well, and it is stricter in three ways:

• Handing records to a buyer needs consent. A licence is a communication to a third person, and no person may communicate to a third person the personal information he holds on another person, unless the person concerned consents to, or this Act provides for, such communication. Any new use inside the company is limited too: personal information may not be used except for the purposes for which it was collected unless the person consents or an exception applies, and the research exceptions apply to study, research or statistics.
• De-identified is still personal. Quebec's Act treats information that no longer allows the person to be directly identified as de-identified, still personal information, with a duty to limit the risk of re-identification. Only anonymized information leaves the Act, and anonymization must be irreversible, carried out under the supervision of a person qualified in the field with a written risk analysis.
• Sending outside Quebec needs an assessment first. Before communicating personal information outside Québec, the company must complete a privacy impact assessment, and may proceed only if it shows adequate protection.

For a Quebec company, an anonymized lot is the likeliest to sell, though the Act allows anonymized information to be used for serious and legitimate purposes and whether a commercial licence is one is untested.

Sending records to a buyer in the United States

Canada keeps no list of approved countries and does not forbid sending personal information abroad, and PIPEDA applies to the cross-border step. A licence to a US buyer that trains its own model is a disclosure for a new purpose, so personal information in it shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual. The regulator's cross-border guidance is written for a different case, a provider processing for the company: there a transfer is a use, not a disclosure, the sender stays accountable for it in the recipient's hands and people should be told that their information may be processed in a foreign country and be accessible to its authorities. A lot that is properly de-identified before it leaves avoids most of this.

Who buys from Canada, and what they pay

Several buyers name Canada on their own forms:

• Mode's referral programme takes companies based in one of four countries, Canada among them.
• Handshake's data partnerships page asks which country the company is in, with Canada one of its four answers.
• Turing says companies can be based in most regions, with the most demand in the US, UK, Canada and a few more.

Prices for one company's records run wide, and buyers' own estimators offer a company in Canada, the UK or Europe 0.71 times what they offer the same company in the US; our valuation applies that. The smallest sale we take on is $23,000, the weighted average of what a small company's records have sold or been offered for on record. The buyer board lists every buyer we track with its rules and terms.

A company that is closing or has closed

A federal corporation that has started to dissolve ceases to carry on business except to the extent necessary for the liquidation, but still exists until its certificate of dissolution, so it can sell its records in that period. After dissolution, property it had not disposed of vests in the Crown, and any interested person may apply to have it revived. Software vendors delete a cancelled company's data on their own schedule (Microsoft within 180 days at most, Atlassian within 60 days), so a closing company exports first. Who owns a dissolved company's data covers the rest.

The steps

1. Export each system that holds the company's records, with its structure, before any subscription lapses.
2. Value it first. A free valuation from the company's own answers, or from exports measured on its own computer, says whether a sale is worth the preparation: value your data.
3. Sort what the company owns from client files, licensed data and personnel files.
4. De-identify to the federal standard, or anonymize to Quebec's for a Quebec company, and keep the record of how.
5. Describe it to every buyer whose rules fit at once, without naming the company.
6. License non-exclusively, for named uses, with the company as licensor.

When we run the sale, our fee is a share of what the buyer pays ( 12% of the first $250,000, 10% up to $1 million, 8% up to $3 million and 6% above $3 million), due only out of a completed sale: how a sale works.

Questions people ask

Is it legal for a Canadian company to sell customer data to an AI company? Not as identifiable records without consent: PIPEDA requires the consent of the individual before information can be used for a new purpose. Records de-identified to the point where there is no serious possibility of re-identification are how such sales are made.

Does the business transaction exception cover a data licence? No. It does not apply to a transaction whose primary purpose or result is the sale of personal information.

Can we rely on the research exception? Not for a commercial licence: it needs research purposes that cannot be achieved otherwise, consent that is impracticable, and notice to the Commissioner before the disclosure.

Can the records go to a US buyer? Yes. Canada has no list of approved countries, but a licence to a buyer is a disclosure for a new purpose, so identifiable records need the people's consent; de-identified records avoid that. A Quebec company first completes a privacy impact assessment.

Will the new privacy law change this? Not yet: Bill C-36 is awaiting second reading, and PIPEDA applies until a new law is in force.

What this means for you

A Canadian company's records can sell to AI buyers, and several buyers ask for Canadian companies by name. What decides the sale is preparation: the company's own records sorted from everyone else's, people removed to the regulator's standard, and, in Quebec, anonymization and an assessment before anything leaves the province. The valuation is free, needs no upload, and tells you whether that work is worth doing.

Value your data, read how a sale works, or see the rights a sale rests on.