Key takeaways
- On October 26, 2026, OpenAI petitioned the BC Supreme Court to quash a production order from the BC Office of the Information and Privacy Commissioner, issued in September as part of a June 2026 investigation into how ChatGPT handled personal information connected to the February 2026 Tumbler Ridge school shooting.
- The OIPC is testing whether ChatGPT’s use of that personal information, as contained in and derived from prompts, uploaded content, and usage data, in the delivery of its responses was one a reasonable person would consider appropriate, explicitly weighing whether responses can influence behaviour.
- OpenAI calls the investigation duplicative of the May 2026 joint federal-provincial probe and the order overbroad, while the OIPC says OpenAI would disclose only through a legal proceeding. Either outcome changes how AI vendors answer regulators, which is why the answer belongs in your risk register now.
On Monday, OpenAI asked the BC Supreme Court to quash a production order from British Columbia’s privacy commissioner. The commissioner’s office announced the challenge itself, in a news release dated October 27, and said it was making an active investigation public only because OpenAI’s court filing had put it there. When a regulator breaks its own silence rule, the fight is serious.
The fuse has been burning for months. In February, the OIPC asked OpenAI for information about its policies, its practices, and the specific interactions ChatGPT had with the user. OpenAI did not hand it over voluntarily. In June, the commissioner opened a formal investigation. OpenAI then told the office that, consistent with its privacy commitments to users, it could release the material only through a legal proceeding. In September, the commissioner used its powers under BC’s Personal Information Protection Act to order production anyway. This week, OpenAI petitioned for judicial review of the order and challenged the investigation itself.
That makes three parallel tracks on the same shooting. British Columbia sued OpenAI in San Francisco federal court in September as a government plaintiff, seeking recovery costs and an injunction on threat-escalation practices. In May, the federal commissioner, the BC commissioner, and Alberta’s information commissioner published a joint report finding OpenAI had violated federal and provincial privacy law in how ChatGPT collects and handles users’ personal information. Now there is a standalone BC investigation and a courtroom fight over documents. Three tracks, three precedents. I am tracking all three, and you should too.
The test: is a chatbot’s reply a “use” of your personal information?
The sentence that matters most in the OIPC’s release states the question under investigation: whether the use of personal information, including as contained in and derived from prompts, uploaded content, usage data, and interactions with other users, in the delivery of the service, that is, ChatGPT’s responses, is one that a reasonable person would consider appropriate in the circumstances, including the potential for responses to influence behaviour.
Read that again, because it is doing more work than it looks. The commissioner is treating ChatGPT’s responses as a use of personal information, and the information at issue includes what is derived from prompts, not just what was typed into them. Most AI vendor assessments I review treat the prompt as input, analyze collection and storage, and stop. The output side, what the model’s replies do with your prompts, rarely gets classified as a distinct use of personal information subject to the appropriate-purposes test. BC’s PIPA, section 18, says an organization may use personal information only for purposes a reasonable person would consider appropriate. The OIPC is now asking whether delivering AI responses built from a user’s personal information, where those responses can influence behaviour, clears that bar. If that reading survives, it lands directly in your vendor files: your data protection impact assessment needs a line item for what the model’s outputs do with prompt-derived information, scored as a privacy harm in its own right.
What OpenAI is arguing, fairly stated
OpenAI’s petition, as described in contemporaneous reporting on the filing (see AI Brief’s summary), runs several lines: the investigation is a duplicative second look after the May joint investigation; the production order is overbroad and unnecessary; it demands the shooter’s chat logs, which the company says it already gave to police, plus internal records about whether to refer the account to law enforcement; and the whole thing exceeds the commissioner’s mandate, raises Charter issues, and offends the commissioner’s own privacy obligations. On jurisdiction, the company revived the argument that the federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies and BC’s PIPA does not, an argument the May joint report said had already been “thoroughly addressed in previous joint investigations.”
Strip the courtroom framing and there are two real fights. The first is scope: how far a privacy commissioner’s document order can reach into a company’s internal records when the underlying question is about an AI product’s behaviour. The second is the one I expect practitioners to recognize as the harder tradeoff. OpenAI says its privacy commitments to users mean it can release this information only through a legal proceeding. That is a defensible posture, and it is also the reason the OIPC needed a production order at all. Voluntary cooperation failed, so compulsion took its place. Note the honesty of that sequence the next time a vendor tells you it “cooperates with regulators.” Voluntarily, or only on court order? The answer belongs in your risk register, because it sets the clock on your own incident timeline.
Three tracks, three precedents
| Track | Forum | What it decides | What it sets for you |
|---|---|---|---|
| BC government plaintiff suit, filed Sept 2026 | San Francisco federal court | Whether OpenAI owes recovery costs and must change threat-escalation practices | De facto standards for AI vendor escalation chains |
| Joint investigation, reported May 2026 | OPC, OIPC-BC, Alberta CAI | Whether ChatGPT’s collection and handling of personal information met federal and provincial law | Consent, collection-limitation, and transparency baselines |
| Standalone BC investigation and production-order fight | OIPC-BC, BC Supreme Court | Whether responses-as-use of prompt-derived personal information meets the reasonable-person test; how far a commissioner’s document order reaches | Whether outputs count as “uses” in your DPIAs; how your vendor answers regulators |
The tracks interact. If the court narrows the production order, future commissioners will draft orders more carefully and vendors will have a playbook for resisting them. If the reasonable-person reading of outputs-as-use survives, every AI vendor assessment in BC, and by persuasive force elsewhere in Canada, gains a new line item. And if the province’s lawsuit produces an injunction on escalation practices, that becomes the contract language you will be asked to sign.
What to put in your vendor files
Set OpenAI’s guilt or innocence aside. The homework here is two entries most AI vendor questionnaires do not have yet.
Classify outputs as uses of personal information. Update your DPIA template so that model responses derived from prompts, uploaded content, and usage data are assessed as distinct uses of personal information under the appropriate-purposes test, including whether responses could influence behaviour. If your template stops at collection and storage, it is missing the exact question the commissioner in Victoria is asking.
Ask how your vendor answers regulators, not just how it answers you. Add the question: when a privacy regulator asks for documents touching our users’ data, do you disclose voluntarily or only through a legal proceeding? A vendor that waits for an order adds months before the regulator sees the records. Whether the BC court blesses that waiting game is still undecided, and it is the thread to watch in this story.
Actionable takeaway: Pull your highest-risk AI vendor contract and write two lines: model outputs derived from prompts are assessed as uses of personal information, and how the vendor answers regulators is documented in the risk register. The commissioner is running the reasonable-person test on ChatGPT’s responses right now. Run it on your vendors before a regulator runs it on you.