AI Privacy and Data Protection Guide
Last updated: July 2026.
AI Privacy and Data Protection:
A Guide for People with Disabilities
How to protect your information in an AI-powered world
1. Why This Matters for People with Disabilities
Artificial intelligence is no longer a future technology. It is already shaping the systems that people with disabilities rely on every single day. Benefits assessments, healthcare triage, employment screening, housing applications, insurance underwriting, and assistive service platforms are all increasingly driven by AI. That means decisions about your life are increasingly being made by algorithms, and those algorithms are hungry for data.
For people with disabilities, this is not a theoretical privacy concern. It is a practical one with real consequences. The data that AI systems collect, analyse, and share includes some of the most sensitive information a person can have: medical diagnoses, functional assessments, prescription histories, mental health records, therapy notes, and information about how you move through the world with assistive devices. That data does not stay in one place. It flows between platforms, gets sold to third parties, feeds into risk models, and can resurface in ways you never anticipated.
The disability community has always had to navigate systems that were not designed with their interests in mind. AI adds a new layer to that challenge. The systems are less transparent, the data collection is more pervasive, and the decisions being made are harder to challenge. But the picture is not all bleak. Canadian law gives you real rights over your personal information, and understanding those rights is the first step to using them.
This guide is written for people with disabilities who want to understand what data is being collected about them, how it is being used, and what they can do to protect themselves. It is also written for family members, support workers, and advocates who help people navigate these systems. You do not need a background in technology or law to use this guide. It is written in plain language, with practical steps and clear explanations.
The barriers people with disabilities face are not built into their bodies or minds. They are built into systems, and AI systems are no different. A system that lacks transparency, that aggregates sensitive data without consent, or that produces discriminatory outcomes is a system with a design problem, not a reflection of the people it harms. This guide is written from that perspective: the problem is in the system, and the solution is accountability, rights, and advocacy.
Privacy matters to everyone, but the stakes are higher when your disability status is one of the most sensitive pieces of information you hold. A privacy breach for someone without a disability might mean unwanted marketing. For a person with a disability, it can mean being denied insurance, screened out of a job, or having your benefits flagged for review by an automated system. That asymmetry of risk is why the disability community deserves a guide written specifically for its situation.
Throughout this guide, you will find practical advice alongside explanations of your legal rights. The two go together. Knowing your rights helps you ask the right questions, push back when you need to, and get help when things go wrong. The practical steps help you reduce your exposure before problems arise.
Canada has a reasonably strong legal framework for privacy protection, and it is evolving. There are also significant gaps, and those gaps often fall hardest on people with disabilities. This guide will help you understand both the protections you have and the areas where you need to be most careful.
2. What Data Is Being Collected About You
The scope of data collection in the digital age is difficult to fully grasp. Every app you use, every website you visit, every service you interact with, and every device you carry is generating data about you. For people with disabilities, that data often includes uniquely sensitive information about health, function, mobility, cognition, and daily life.
Apps and Digital Services
When you download a health app, a fitness tracker, a medication reminder, or a wellness platform, you are typically agreeing to terms of service that grant the company broad rights to collect and use your data. This data can include your name and contact information, but it also includes your health and symptom logs, your sleep patterns, your activity levels, your mood ratings, and your location throughout the day.
Even apps that seem straightforward collect more than you might expect. A pharmacy app knows what medications you take and at what doses. A ride-sharing app knows where you go and how often. A grocery delivery app knows what you eat. Individually, these data points seem minor. But when they are combined, they can build a detailed picture of your disability, your daily routine, your vulnerabilities, and your needs, often without your knowledge.
AI systems are designed specifically to find patterns in this kind of data. They are very good at inferring things about people that those people never directly disclosed. An AI system might infer that you have a particular condition based on your purchase history, your browsing habits, and your location data, even if you never told anyone. That inference then becomes a data point in your profile, and it may be used in ways that affect decisions about you.
Health and Benefits Systems
Healthcare systems in Canada are increasingly using digital records and AI-assisted tools. Your provincial health card is linked to records of every medical encounter you have had within the system: diagnoses, procedures, prescriptions, referrals, and imaging results. Benefit programs like the Ontario Disability Support Program (ODSP) and the Canada Pension Plan Disability benefit (CPP-D) hold detailed records of your assessments, medical documentation, and correspondence.
These records are subject to strong legal protections, but they are not immune to data breaches, to misuse, or to requests from other parties. In Ontario, the Personal Health Information Protection Act (PHIPA) governs how your health information is handled. But as provincial health systems modernise and integrate AI tools, new risks emerge around how data is analysed, how it is shared within the system, and how long it is retained.
Veterans Affairs Canada, the Workplace Safety and Insurance Board (WSIB), and private insurance companies all hold significant amounts of data about people with disabilities. These organizations use that data to make decisions about eligibility, benefits levels, and coverage. Some are beginning to use AI tools to assist with those decisions, which means algorithmic systems are making recommendations that affect your access to support.
Employment Screening Tools
If you have applied for a job online in the last several years, there is a reasonable chance that your application was processed by an AI system before a human ever looked at it. Resume scanners, automated shortlisting tools, and AI-powered video interview platforms are now widely used by employers. These tools can screen out applicants based on patterns in their background, communication style, or assessment results, sometimes in ways that have a disproportionate impact on people with disabilities.
Employment screening AI often collects data beyond your resume. Video interview platforms analyse your facial expressions, tone of voice, and word choice. Online assessments track not just your answers but your response time, your hesitation patterns, and your cursor movements. This behavioural data is fed into models that generate a score or a recommendation, and that score may be the thing that decides whether you ever hear back from an employer.
The problem for people with disabilities is that these models are often trained on data that does not represent diverse populations. A model trained on the communication patterns of people without disabilities may flag atypical communication styles, slower processing speeds, or adapted interview behaviours as negative signals. The result can be discrimination that is invisible, automated, and hard to challenge.
Assistive Technology and Connected Devices
This is an area of particular concern for people with disabilities, because assistive technology is uniquely personal. Your hearing aids may transmit data to an app about your listening environments and usage patterns. Your power wheelchair may have sensors that log your routes, your speed, your sitting position, and your battery usage. Your augmentative and alternative communication (AAC) device records the phrases you use most often, the contexts in which you communicate, and your communication patterns over time.
Continuous glucose monitors, sleep apnea therapy devices, insulin pumps, cochlear implant processors, and prosthetics with electronic components are all capable of generating and transmitting data. Some of this data is transmitted to your healthcare provider for clinical purposes. Some of it is transmitted to the device manufacturer. The terms of service for many medical device companion apps allow the manufacturer to collect, analyse, and in some cases share or sell that data.
Smart home devices present a related set of concerns. Voice assistants that help people with mobility or vision-related disabilities navigate their homes are always listening. They process voice commands in the cloud, which means recordings of your speech, your daily routine, and your conversations may be stored on company servers. Environmental sensors, smart lights, automated door openers, and connected thermostats all generate data about your daily patterns.
The connecting thread is that many of the tools that give people with disabilities greater independence also create new channels through which intimate data flows to corporations and platforms. The benefits of these technologies are real. But so is the data exposure, and it deserves to be taken seriously.
How Data Connects Across Platforms
One of the most important things to understand about modern data collection is that data does not stay in one place. Platforms share data with third parties, sell data to data brokers, and participate in advertising networks that aggregate information from dozens of sources. A data broker might combine your pharmacy records with your location data, your social media activity, and your purchase history to build a profile that accurately predicts your disability status, your income, your mental health, and your daily needs.
This cross-platform aggregation is largely invisible to the people whose data is being collected. You consented to each individual collection event when you agreed to various terms of service. But you likely had no idea that the data would be combined in this way, and you had no meaningful opportunity to consent to the combined profile. This is one of the core problems with how data privacy works today, and it is a problem that affects people with disabilities more acutely because of the sensitivity of the data involved.
3. Your Rights Under Canadian Law
Canada has a federal privacy law that applies to most private-sector organizations operating in the country. That law is the Personal Information Protection and Electronic Documents Act, known as PIPEDA. It was enacted in 2000 and has been the foundation of Canadian private-sector privacy law ever since. While it has been updated over the years, advocates have long argued that it needs more substantial modernisation to address the realities of AI-driven data collection.
PIPEDA: Your Federal Privacy Rights
PIPEDA is based on ten fair information principles. These principles set out what organizations must do when they collect, use, and disclose your personal information. The principles include accountability (organizations must designate someone responsible for privacy), identifying purposes (they must tell you why they are collecting your data), consent (they must obtain your agreement), limiting collection (they can only collect what they need), and safeguards (they must protect your information from loss, theft, or unauthorised access).
The most practically important rights PIPEDA gives you are these: you have the right to ask any federally regulated private-sector organization for access to the personal information it holds about you, and you have the right to have that information corrected if it is wrong. These rights are broader than people often assume. PIPEDA applies to private-sector organizations that collect, use or disclose personal information in the course of commercial activity, not only to federally regulated businesses such as banks, airlines and telecommunications companies. Which law covers you depends on where you live. Alberta, British Columbia and Quebec have their own private-sector privacy laws that have been declared substantially similar to PIPEDA, and organizations operating within those provinces are generally covered by the provincial law instead. Quebec’s Law 25 in particular sets stronger requirements than PIPEDA on consent, transparency and automated decision-making. Outside those three provinces, PIPEDA generally applies to commercial organizations directly. PIPEDA still governs federally regulated businesses everywhere, and cross-border and interprovincial data flows, regardless of province. They also apply to private companies that do business across provincial lines.
Making an access request under PIPEDA is your starting point for understanding what data an organization has about you. You can send a written request to the organization's privacy officer. The organization has 30 days to respond. If they cannot fulfil your request within 30 days, they must notify you and give a reason. If they refuse your request, they must explain why. If you are not satisfied with their response, you can file a complaint with the Office of the Privacy Commissioner.
Consent under PIPEDA must be meaningful. That means the organization must explain what information it is collecting, why, and how it will be used, in language that a reasonable person can understand. Burying consent in dense terms of service that no one reads is not meaningful consent, and the Privacy Commissioner has said so. Sensitive personal information, including health information and information about a person's disability, requires explicit consent, not just implied consent.
You can withdraw your consent at any time. When you do, the organization must stop collecting and using your information, though it may retain information for legal, regulatory, or contractual reasons. Withdrawing consent may mean you can no longer use some services. But you have the right to make that choice, and no organization can penalise you unreasonably for exercising it.
Bill C-27 and the Consumer Privacy Protection Act
The federal government has spent several years trying to modernise PIPEDA. The most recent attempt was Bill C-27, which would have enacted the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act (AIDA). Bill C-27 was introduced in 2022 and died on the Order Paper when Parliament was prorogued in January 2025. It has not been reintroduced, and the government has signalled that any future privacy reform will not take the same form. Until something replaces it, PIPEDA as enacted in 2000 remains the operative federal private-sector privacy law, alongside the provincial statutes noted above. It is not law. Its proposals still matter, because they signal the direction the federal government has said it wants to take, and a future bill is likely to revisit the same ground.
The CPPA, had it passed, would have strengthened privacy rights in several important ways. It proposed a right to data portability, meaning you could request your data in a format that allows you to transfer it to another service. It proposed a right to de-index or delete your information in some circumstances. It would have increased the penalties for privacy violations significantly. And it would have required organizations to be more transparent about automated decision-making systems. Because Bill C-27 did not pass, these are not current rights, but they show where reform is expected to head.
The AIDA, the AI portion of Bill C-27, would have created a regulatory framework for high-impact AI systems, requiring developers and deployers of AI to assess and mitigate bias, to maintain records, and to be transparent about how their systems work. Because Bill C-27 died, Canada currently has no AI-specific statute in force. The federal government has said it intends to pursue AI regulation, most likely as legislation separate from privacy reform. For people with disabilities this still matters, because many of the AI systems that make decisions about benefits, employment, and services are exactly the high-impact systems a future AI law would be expected to cover.
Bill C-27 itself was not revived, but in June 2026 the federal government tabled a new privacy bill, Bill C-36 (the Protecting Privacy and Consumer Data Act). If it passes, it would replace the private-sector half of PIPEDA with a modern framework that recognizes privacy as a fundamental right, creates a new privacy regulator, sharply raises penalties, and requires more transparency about automated decision-making. As with the earlier attempts, it is a bill, not yet law, and it can still change or stall in Parliament. AI-specific rules are expected to come as a separate bill rather than being folded into this one.
While these reforms are not yet law, they reflect the direction of travel. Staying informed about privacy law developments in Canada is worthwhile, and the Office of the Privacy Commissioner publishes plain-language guidance on these changes as they develop.
Provincial Privacy Legislation
British Columbia has its own provincial privacy legislation, the Personal Information Protection Act (BC PIPA), which applies to private-sector organizations operating within the province. BC PIPA is substantially similar to PIPEDA and gives BC residents similar rights of access, correction, and complaint. If you live in BC and have a privacy concern about a provincially regulated organization, you can file a complaint with the BC Information and Privacy Commissioner.
Alberta also has its own private-sector privacy legislation, the Personal Information Protection Act (Alberta PIPA). Like BC PIPA, it applies to private-sector organizations and creates rights similar to those under federal PIPEDA.
Quebec has made particularly significant changes to its privacy framework. In 2021, Quebec passed Law 25 (formerly Bill 64), which substantially updated the province's Act Respecting the Protection of Personal Information in the Private Sector. Law 25 took effect in stages between 2022 and 2024 and introduced several rights not available under PIPEDA: the right to data portability, the right to de-indexation (the right to have your personal information removed from a technology or search result in some circumstances), and significantly strengthened requirements around automated decision-making.
Under Law 25, if an organization makes a decision about you based solely on automated processing of your personal information, you have the right to be informed of this, to know what personal information was used, and to have a person review the decision. This is one of the strongest protections against purely algorithmic decision-making currently available in Canadian law. If you live in Quebec, this right applies to you now.
Health Information: Special Protections
Health information is subject to additional protections beyond general privacy legislation. In Ontario, the Personal Health Information Protection Act (PHIPA) governs how health information custodians, including hospitals, doctors, pharmacists, and health agencies, handle your personal health information. PHIPA gives you the right to access your health records, to request corrections, and to withhold consent to certain uses of your health information.
Every province has its own health information privacy legislation. In British Columbia, it is the E-Health (Personal Health Information Access and Protection of Privacy) Act. In Alberta, it is the Health Information Act. In New Brunswick, it is the Personal Health Information Privacy and Access Act. These laws apply to public-sector health providers and create strong protections for your health data within those systems.
The practical implication for people with disabilities is that the organizations you interact with most frequently, healthcare providers, benefit administrators, and social services, are subject to some of the strongest privacy protections in Canadian law. That does not mean those protections are always followed, but it does mean you have clear legal rights to assert when they are not.
Filing a Complaint with the Privacy Commissioner
If you believe an organization has violated your privacy rights under PIPEDA, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC). You can do this online at the OPC website, by phone, or by mail. The OPC will investigate your complaint, attempt to resolve it, and issue findings. While the OPC does not have the power to impose fines directly under PIPEDA, its findings carry significant weight and organizations generally comply.
Bill C-27 would have created a new Personal Information and Data Protection Tribunal with the authority to impose significant financial penalties on organizations that violate the CPPA. Because the bill did not pass, that tribunal does not exist, and the OPC investigation process remains the main federal avenue for redress. Stronger enforcement of this kind is a likely feature of any future privacy bill.
At the provincial level, each province with its own privacy legislation has a corresponding privacy commissioner or information commissioner who handles complaints. These offices are generally accessible and have staff who can help you understand your options and the complaint process. Filing a complaint does not require a lawyer, and there is no fee.
4. The Disability Data Problem: Why Your Information Is Especially Sensitive
Not all personal information carries the same weight. Canadian privacy law recognizes this by treating certain categories of information as especially sensitive, requiring stronger protections and higher standards of consent. Disability-related information sits firmly in this sensitive category, and for good reason.
Why Disability Data Is in a Different Class
A person's disability status can affect their ability to get insurance, to find employment, to access housing, and to participate in social and economic life. That is not because people with disabilities are less capable. It is because those systems have often been built with explicit or implicit assumptions that disadvantage disability. When AI systems are trained on historical data that reflects those biases, they tend to reproduce and sometimes amplify them.
The sensitivity of disability data is not just about discrimination, though that is a serious concern. It is also about the intimate nature of the information itself. Your medical records, your therapy notes, your functional assessment reports, your accommodation requests, and your documentation for benefit programs all tell a detailed story about your body, your mind, your supports, and your daily life. That is information most people would share only with trusted healthcare providers, family, and close friends. The idea that it might be flowing through corporate data pipelines without your knowledge is a legitimate cause for concern.
Under Canadian privacy law, health information and information that could reveal a person's disability status are considered sensitive personal information. This means organizations must obtain explicit and informed consent before collecting it, must limit their use of it to the purposes for which it was collected, and must take heightened precautions to protect it. The challenge is enforcing these requirements in a world where data collection is often indirect, inferred, or embedded in systems that most people do not think of as health data collectors.
Medical Records and Benefit Documentation
The documentation required to access disability benefits is substantial. To qualify for ODSP, CPP-D, the Disability Tax Credit, or accommodation in an educational or employment setting, you typically need to provide medical documentation from one or more healthcare providers. This documentation describes your diagnoses, your functional limitations, the treatments you have received, and the impact of your disability on your daily life.
Once that documentation enters a system, it can persist for a very long time. Government benefit agencies retain records for years or decades. Insurance companies hold medical history records that affect future applications. Employment accommodation files may be accessible to HR staff beyond those who need to know. Healthcare records shared for assessment purposes may flow between providers, insurers, and administrators in ways that are not always clear to you.
This is not an argument against seeking benefits or accommodations, which are your rights. It is an argument for being thoughtful about what you share, with whom, and for what purpose. You have the right to ask organizations why they need specific information, how it will be used, and who will have access to it. Exercising that right is not being difficult. It is protecting yourself.
The Aggregation Problem
One of the trickiest privacy challenges in the AI age is what researchers call the aggregation problem. Individual pieces of data that seem harmless on their own can combine to reveal sensitive information you never intended to disclose.
Consider this example: your pharmacy purchase history shows that you buy a particular medication every month. Your fitness app shows that your daily step count is significantly lower than average. Your ride-sharing app shows that you frequently travel to a specific medical facility. Your grocery delivery app shows that you order adapted cooking tools and large-print playing cards. No single one of these data points identifies you as a person with a disability. But combined, they paint a clear picture that an AI system can read with high confidence.
This is not a hypothetical scenario. Data brokers routinely aggregate data from multiple sources to build detailed profiles of individuals. Those profiles are sold to insurers, employers, marketers, and other buyers. Because the aggregation happens at a remove from the original data collectors, it is often outside the scope of the consent you gave when you signed up for each individual service. This is one of the most significant gaps in current Canadian privacy law.
Insurance Underwriting and Disability Data
Life insurance, disability insurance, and critical illness insurance are areas where disability status and health history have direct financial consequences. Canadian insurers are permitted to use health information in underwriting decisions, subject to human rights legislation. The tension between insurers' desire for detailed health data and individuals' privacy and equality rights is ongoing.
The concern in the AI age is that insurers may use inferred or aggregated data that goes beyond what was disclosed in a formal application. If an insurer can access or purchase data that accurately predicts disability status or health risk, it might use that data in pricing and underwriting decisions without the applicant being aware. This is an area where Canadian human rights legislation and privacy law intersect, and where advocacy groups have been raising concerns.
If you believe an insurer has used your disability status or health information improperly in a coverage or underwriting decision, you may have remedies under both privacy law (a complaint to the Privacy Commissioner) and human rights law (a complaint to the applicable human rights tribunal). The two avenues are not mutually exclusive.
Employment Screening and Disability Discrimination
Algorithmic employment screening is a growing source of concern for people with disabilities. AI resume scanners, automated video interview tools, and online cognitive and personality assessments are increasingly used as first filters in hiring processes. These tools can inadvertently, or in some cases deliberately, screen out candidates who communicate differently, process information differently, or have employment history patterns that reflect the realities of living with a disability.
Under the Canadian Human Rights Act and provincial human rights codes, disability discrimination in employment is prohibited. Employers have a duty to accommodate to the point of undue hardship. But when the screening is automated and opaque, discrimination is harder to identify and harder to challenge. If you suspect that an automated hiring tool has screened you out on the basis of disability, that is potentially a human rights matter, not just a privacy matter.
Canadian human rights commissions have been examining algorithmic discrimination. The Canadian Human Rights Commission has published guidance on this issue, and complaints based on algorithmic screening are being accepted and investigated. This is an evolving area, but the legal framework exists to challenge discriminatory automated screening.
5. AI Systems That Make Decisions About You
One of the most significant shifts in the use of AI is the move toward automated or algorithm-assisted decision-making in systems that directly affect people's access to benefits, services, employment, and housing. For people with disabilities, who often rely heavily on these systems, understanding how these tools work and what rights you have is critical.
Benefits Eligibility Algorithms
Government benefit programs are under increasing pressure to manage costs and process high volumes of applications efficiently. AI and algorithmic tools are being explored and, in some cases, already deployed to assist with eligibility screening, case management, fraud detection, and benefit level determination. Programs like ODSP, CPP-D, and Veterans Affairs benefits are all areas where these pressures exist.
The concern with benefits algorithms is not just about efficiency. It is about fairness and accuracy. Algorithmic tools trained on historical data reflect historical patterns, including historical patterns of who was approved for benefits and why. If the historical approval patterns reflect systemic biases, the algorithm will reproduce those biases at scale. People who fall outside the patterns the system has been trained on, including people with complex, multiple, or episodic disabilities, may be flagged for rejection or additional scrutiny.
In Canada, there has been significant controversy over algorithmic tools used in social services. Ontario's Social Assistance Management System (SAMS) and various fraud detection algorithms used by provincial and federal benefit programs have faced criticism for producing errors and disproportionately affecting marginalised groups. Advocacy organizations have called for greater transparency about when algorithmic tools are used in benefit decisions and what human oversight exists.
As of now, Canadian benefit programs are not required to disclose when algorithmic tools are used in individual decisions, though this may change as privacy law modernises. What you do have is the right to ask for a review of any adverse decision, and in most programs, you have the right to appeal. That appeal process typically involves a human decision-maker who reviews the facts of your case.
AI in Healthcare
AI tools are being adopted across the healthcare system at a rapid pace. Triage tools assess the urgency of your condition before a clinician sees you. Diagnostic AI analyses imaging and test results to support clinical decision-making. Administrative AI manages scheduling, referrals, and documentation. Predictive tools flag patients who may be at risk of readmission or deterioration.
For patients with disabilities, AI in healthcare raises both opportunity and risk. On the positive side, AI tools can potentially support more accurate diagnosis and more personalised care. On the risk side, AI tools can embed clinical biases, perform worse on populations underrepresented in training data, and reduce the time a human clinician spends engaging with the patient as an individual.
A documented concern in the literature is that AI diagnostic tools can perform less accurately on people with disabilities, chronic conditions, or complex health presentations, precisely because these populations are often underrepresented in the training data. This is not a minor technical concern. A triage AI that underestimates the urgency of your condition because your presentation does not match the training set can have serious clinical consequences.
You have the right, under provincial health information legislation, to access your health records and to understand how decisions about your care are being made. If an AI tool has been used in a decision about your care, you can ask your healthcare provider about it. Most provincial health information laws also give you the right to withhold consent to non-essential uses of your health information, including research uses.
Employment Screening AI
The use of AI in hiring has grown substantially over the past decade. Applicant tracking systems (ATS) use keywords and scoring algorithms to rank resumes before a human sees them. AI video interview platforms score candidates based on linguistic patterns, facial expressions, and vocal characteristics. Online psychometric assessments are administered and scored by AI, with scores fed directly into shortlisting decisions.
These systems present a particular challenge for people with disabilities. A candidate who uses augmentative communication technology may not speak in the vocal patterns a video interview AI was trained on. A candidate with ADHD may answer questions in a non-linear way that a language model scores negatively. A candidate with depression may have had a gap in employment history that a resume scanner flags as a negative indicator.
The practical advice here is to be aware that these systems exist and to document your applications carefully. If you requested an accommodation in the application process and were not provided one, that is a potential human rights complaint. If you were unsuccessful after passing through an AI-screened process and you suspect disability discrimination, the Canadian Human Rights Commission and provincial human rights tribunals are the appropriate avenue.
Rental Housing Platforms and Tenant Screening
The rental housing market is increasingly mediated by digital platforms that use AI to match tenants with landlords and to conduct tenant screening. Tenant screening tools may pull credit scores, rental history, income verification, and publicly available information about an applicant. Some platforms use AI to generate an overall risk score for a prospective tenant.
For people with disabilities, who may have interrupted employment histories, income from disability benefits, or credit histories affected by the financial impacts of disability, these screening tools can present real barriers. Human rights legislation prohibits discrimination based on disability in housing across all provinces and territories. If a screening tool systematically disadvantages people whose income comes from disability benefits, or people with credit histories reflecting medical crises, that may constitute discriminatory screening under human rights law.
The intersection of AI tenant screening and disability rights is an area where advocacy is ongoing. If you believe a rental platform or landlord has screened you out on discriminatory grounds, you can file a complaint with the applicable provincial human rights commission. You do not need to prove the landlord intended to discriminate. You need to show that the effect of the screening was discriminatory.
Your Right to Human Review
One of the most important emerging principles in AI governance is the right to a human review of automated decisions. Under Quebec's Law 25, this right already exists for certain automated decisions. A future federal privacy law is expected to extend this right more broadly; the CPPA proposed in the now-lapsed Bill C-27 would have done so. Under the EU's AI Act and GDPR, this right has been in place for several years and is influencing the direction of Canadian law.
The principle is straightforward: if a fully automated system makes a decision about you that has significant consequences for your life, you should have the right to have that decision reviewed by a human being. The AI recommendation is not the final answer. A person must be accountable for the final decision.
Even where this right is not yet explicitly codified in Canadian law, most government benefit programs and regulated service providers have internal appeal and review processes. You have the right to request a review or appeal an adverse decision. Do not accept an automated rejection as the final word. Ask for a human review. Put the request in writing. This creates a record and triggers a process.
6. Practical Steps to Protect Your Privacy
Understanding your rights is important. Putting practical protections in place is equally important. The steps below are not about fear or paranoia. They are about making informed choices about your data. You do not need to implement all of them at once. Start with the steps that seem most relevant to your situation and add more over time.
Reviewing App Permissions on Your Phone
Your phone is likely one of the biggest sources of data collection in your life. The apps on your phone may have access to your location, your contacts, your camera, your microphone, your health data, and your storage. Most of these permissions can be reviewed and changed.
On an iPhone, go to Settings, then Privacy and Security. You will see a list of data types (Location Services, Contacts, Calendar, Photos, Camera, Microphone, etc.). Tapping on any of these shows you which apps have requested access and whether you have granted it. You can change these permissions at any time without deleting the app.
On an Android phone, go to Settings, then Privacy, then Permission Manager. The layout varies somewhat by phone model and Android version, but you should be able to see which apps have access to which permissions. You can revoke any permission that does not seem necessary for the app to work.
As a general principle, grant apps only the permissions they need to do their job. A grocery delivery app needs your location to deliver to your address. It probably does not need access to your microphone. A fitness app may need access to your health data. It probably does not need access to your contacts. If an app asks for a permission that seems unrelated to its function, that is worth pausing over.
Making a PIPEDA Access Request
If you want to know what personal information a specific private-sector organization holds about you, you can send a written request. Address it to the organization's Privacy Officer or Chief Privacy Officer. Your letter or email should state that you are making a request under the Personal Information Protection and Electronic Documents Act (PIPEDA), that you are requesting access to all personal information the organization holds about you, and that you are requesting information about the purposes for which it is held and any third parties with whom it has been shared.
Keep your request simple and direct. The organization has 30 days to respond. If they refuse, they must explain why. Common reasons for refusal include that the information is subject to solicitor-client privilege, that disclosing it would reveal information about third parties, or that it would harm law enforcement investigations. If you believe the refusal is not legitimate, you can complain to the Office of the Privacy Commissioner.
You can also request correction of any inaccurate information. If your record contains an error (wrong diagnosis, incorrect address, outdated information), you have the right to request that it be corrected. If the organization disagrees that a correction is warranted, you have the right to have a notation added to your file stating that you dispute the information.
Opting Out of Data Collection
Many apps and services offer the ability to opt out of certain types of data collection, particularly for marketing and analytics purposes. These opt-outs are often not easy to find. They are buried in settings menus, privacy dashboards, or links in privacy policy pages. But they exist, and exercising them reduces your data footprint.
Digital advertising opt-outs are available through industry self-regulatory organizations. In Canada, the Digital Advertising Alliance of Canada (DAAC) offers a tool at youradchoices.ca that allows you to opt out of interest-based advertising from participating companies. This does not stop all data collection, but it reduces the use of your data for targeted advertising.
You can also opt out of data broker profiles. Data brokers like Acxiom, Spokeo, and others maintain profiles on individuals that they sell to third parties. Many of these companies offer opt-out processes, though they can be cumbersome. Searching for a company's name plus the word 'opt out' or 'data removal' will usually find their removal process. It is time-consuming, but each removal reduces your exposure.
Privacy-Protective Tools
A Virtual Private Network (VPN) is a service that encrypts your internet connection and routes your traffic through a server in a location of your choosing. This makes it harder for websites, your internet service provider, and others to track your browsing activity by your IP address. VPNs are not perfect privacy solutions, and the quality of VPN services varies significantly. Look for a reputable VPN provider with a clear no-logs policy, meaning they do not store records of your internet activity. Proton VPN and Mullvad are two well-regarded options with Canadian servers.
Privacy-focused browsers offer better default protections than mainstream browsers. Firefox with privacy-protective settings enabled, Brave, and the Tor Browser are three options that block more tracking by default than Chrome or Safari. If switching browsers is not practical, browser extensions like uBlock Origin can block many common tracking scripts.
Two-factor authentication (also called 2FA or two-step verification) is one of the most effective steps you can take to protect your online accounts. It means that even if someone gets your password, they cannot access your account without also having your phone or a second authentication factor. Enable two-factor authentication on your email account, your benefits portals, your banking apps, and any health-related platforms. Most services offer this in their security settings.
Password managers help you use unique, strong passwords for each service without having to memorise them all. Reusing passwords across services is a significant security risk. If one service is breached, all your accounts with the same password become vulnerable. Password managers like Bitwarden (free and open-source), 1Password, or the built-in tools in modern iPhones and Android phones make using unique passwords practical.
Being Cautious About Health and Wellness Apps
The market for health and wellness apps is enormous and largely unregulated from a privacy perspective. Apps that help you track your symptoms, manage your medications, connect with mental health support, or monitor your physical activity can be genuinely useful. But they are not all equally trustworthy with your data.
Before downloading a health or wellness app, look up its privacy policy. Search for the app name and 'privacy policy.' Read the policy for the following: Does the company sell your data to third parties? Does the company share your data with advertisers or data brokers? Is your data stored in Canada or in another jurisdiction? Can you delete your data from their systems? What happens to your data if the company is sold?
Apps that are classified as medical devices in Canada are regulated by Health Canada and subject to stricter requirements. But most consumer wellness apps are not classified as medical devices. They are consumer software products, and their data practices are governed only by general privacy law. Treat them accordingly.
Where possible, prefer apps from organizations with clear and accessible privacy policies, that store your data in Canada or in jurisdictions with strong privacy laws, and that allow you to delete your data permanently. Be particularly cautious about mental health apps, substance use support apps, and apps related to sensitive conditions, because the data those apps hold is among the most sensitive you have.
Questions to Ask Before Using a New Service
Whenever you are about to sign up for a new app, platform, or service that will collect personal information, it is worth pausing to ask a few questions. What personal information does this service collect? Why does it need that information? How long will it keep my information? Who does it share my information with? Can I delete my data if I want to? What happens to my data if the company is sold or closes?
You do not always get clear answers to these questions from a privacy policy written in dense legal language. But asking the questions is a habit worth building. The more routine it becomes to think about these things before signing up for a service, the better your data hygiene will become over time.
7. When AI Makes a Wrong Decision About You
Even with the best privacy protections in place, you may find yourself in a situation where an automated system has made a decision about you that is wrong, unfair, or discriminatory. Knowing what to do in that situation is as important as knowing how to prevent it.
Denied a Benefit by an Automated System
If you receive a denial notice for a government benefit and you believe the decision was made by or substantially influenced by an automated system, the first step is to request a written explanation. You have the right to know the reasons for an adverse decision affecting your benefits. If the explanation is vague or clearly does not reflect your individual circumstances, that is a signal that an automated tool may be involved.
Most government benefit programs have an internal review or reconsideration process. Request a reconsideration in writing, clearly stating the reasons why you believe the decision was wrong. Provide supporting documentation. Request that the reconsideration be conducted by a human decision-maker. Keep copies of everything you send and receive.
If the internal review process does not produce a satisfactory outcome, most programs have a formal appeals tribunal. In Ontario, ODSP decisions can be appealed to the Social Benefits Tribunal. CPP-D decisions can be appealed to the Social Security Tribunal of Canada. Veterans Affairs decisions can be reviewed by the Veterans Review and Appeal Board. These tribunals give you the right to a hearing and a decision by a panel that is independent of the original decision-maker.
If you need help with a benefits appeal, legal aid clinics, disability advocacy organizations, and community legal workers can often provide free or low-cost assistance. Community Legal Education Ontario (CLEO) publishes plain-language guides on ODSP and CPP-D appeals. The Income Security Advocacy Centre (ISAC) in Ontario is a specialist resource for income benefit disputes. Similar organizations exist in other provinces.
Denied a Job Through Automated Screening
If you believe you were screened out of a job application through an automated process and that the screening may have discriminated against you on the basis of disability, there are several steps you can take. First, document everything: the job posting, your application, any communications from the employer, and the outcome. Take screenshots where possible.
Second, consider requesting feedback from the employer. Employers are not always willing to explain why a candidate was unsuccessful, and AI screening systems often do not produce explanations. But asking creates a paper trail, and occasionally you will learn something useful about why you were screened out.
Third, if you believe the screening was discriminatory, file a complaint with the applicable human rights commission. In Ontario, this is the Human Rights Tribunal of Ontario. Federally regulated employers are covered by the Canadian Human Rights Commission. You have one year from the discriminatory act to file a complaint under most human rights legislation. The complaint process is free, and human rights staff can help you understand whether your situation meets the threshold for a complaint.
Challenging a Tenant Screening Decision
If you have been turned down for a rental unit and you believe a tenant screening algorithm discriminated against you on the basis of disability, the process is similar to the employment screening situation. Document the application, the screening outcome, and any communications. If the landlord cited income from disability benefits as the reason for refusal, that is a clear human rights issue in most provinces. Provincial human rights codes generally prohibit discrimination in housing based on disability and source of income.
Tenant complaints can be filed with the applicable provincial human rights commission. In many cases, you can also raise housing discrimination concerns with your local tenant advocacy organization, legal aid clinic, or community law office. Some tenant advocacy organizations have specific expertise in discrimination cases and can advise you on your options.
Filing a Privacy Complaint
If your privacy concern relates to how an organization has collected, used, or disclosed your personal information, the complaint route runs through the applicable privacy commissioner. At the federal level, this is the Office of the Privacy Commissioner of Canada (OPC). The OPC website has an online complaint form that walks you through the process step by step.
Your complaint should clearly describe: the organization you are complaining about, what personal information is involved, what you believe the organization did wrong (or failed to do), what harm resulted or may result, and what outcome you are seeking. You do not need to use legal language. Plain, clear description of what happened is sufficient.
The OPC will assess your complaint to determine whether it falls within its jurisdiction and whether it discloses a potential violation of PIPEDA. If it does, the OPC will investigate. Investigation can involve requesting information from the organization, interviewing staff, and reviewing records. The investigation concludes with findings that are sent to both you and the organization. If the OPC finds that a violation occurred, it will typically recommend remedial steps and the organization usually complies.
Human Rights Complaints Involving Disability Discrimination
When the issue involves not just a privacy violation but disability discrimination, human rights legislation provides an additional avenue. A complaint to a human rights commission or tribunal is separate from a privacy complaint, and the two can run at the same time. You do not have to choose one or the other.
Human rights complaints involving AI and algorithmic discrimination are a growing area of law. The Canadian Human Rights Commission has acknowledged this trend and is developing expertise in it. Provincial commissions are doing the same. If you believe an AI system discriminated against you because of your disability, even if the discrimination was unintentional, you may have a human rights complaint.
The standard in human rights law is not that the discriminator intended to discriminate. It is that the effect of the treatment was discriminatory. An algorithm that systematically produces worse outcomes for people with disabilities is potentially discriminatory regardless of whether the company intended that result. This is sometimes called adverse effect discrimination or systemic discrimination, and Canadian human rights law recognizes it.
Getting Help
Navigating privacy complaints, benefits appeals, and human rights complaints can be complex and time-consuming. There are organizations that exist specifically to help people with disabilities navigate these systems. Disability advocacy organizations at the provincial and national level can often provide referrals, information, and in some cases direct advocacy support.
The Council of Canadians with Disabilities (CCD) is a national cross-disability organization that advocates on systemic issues, including digital rights and algorithmic discrimination. Inclusion Canada (formerly the Canadian Association for Community Living) provides advocacy for people with intellectual disabilities. The Canadian National Institute for the Blind (CNIB) advocates specifically for people with vision-related disabilities. Provincial organizations like ARCH Disability Law Centre in Ontario provide legal services to people with disabilities navigating systemic barriers.
Legal aid is available in every province for individuals who cannot afford a lawyer. Eligibility criteria vary by province and by the type of legal matter, but legal aid clinics and community legal clinics often assist with human rights complaints, benefits appeals, and privacy matters. Contacting your local legal aid office or community legal clinic is a good starting point when you need help.
8. You Have Rights in the Digital World
The story of AI and data privacy can feel overwhelming. The systems involved are technically complex, legally dense, and often designed in ways that prioritize data collection over individual rights. For people with disabilities, who have lived experience navigating systems that were not designed with their needs in mind, there can be a temptation to feel that these systems are simply too large and too entrenched to push back against.
That is not the right conclusion to draw. Privacy rights are real, enforceable rights in Canada. Human rights protections against discrimination, including algorithmic discrimination, are real and are being tested and developed in the courts and tribunals right now. The Office of the Privacy Commissioner has consistently advocated for stronger protections, including stronger protections for disability-related information. Human rights commissions are developing expertise in AI discrimination. Advocacy organizations are building expertise and winning cases.
The disability rights movement has a long history of taking on entrenched systems and changing them. From the physical accessibility movement to the campaign for the Convention on the Rights of Persons with Disabilities, the history of disability advocacy is a history of people asserting that the barriers are in the systems, not in them, and demanding that the systems change. AI is the latest arena for that same advocacy.
At the individual level, you are not powerless. You can review and limit what data you share. You can make access requests to understand what organizations know about you. You can use privacy-protective tools to reduce your data footprint. You can request human review of adverse automated decisions. You can file complaints when your rights are violated. Each of these actions matters.
At the collective level, the disability community's voice in the design and governance of AI systems matters enormously. AI systems are designed by people, trained on data that was collected by people, and deployed in systems built by people. When the people designing those systems do not include people with disabilities, the systems will reflect that absence. Advocacy for inclusive design, for disability representation in AI development teams, for disability impact assessments before AI systems are deployed, and for accountability mechanisms when AI systems cause harm is part of the same work.
This guide is intended as a starting point, not an ending point. Privacy law is evolving rapidly. AI governance is developing. The intersection of disability rights and digital systems is a growing area of advocacy and law. Staying informed, connecting with advocacy organizations, and sharing information with others in the disability community are all ways of being part of that larger movement.
You have rights in the digital world. You have the right to know what data is held about you. You have the right to have it corrected. You have the right to meaningful consent. You have the right to a human decision-maker when an algorithm affects your life. You have the right to access the systems and services that others access, without being filtered out by tools that were not designed with you in mind. These rights exist. The work is to make them real.
Knowing your rights is the beginning. Using them, advocating for them, and demanding that the systems catch up to the people they are supposed to serve, that is the work. And it is work the disability community has always known how to do.
Living Unlimited | livingunlimited.ca
This guide is for informational purposes only and does not constitute legal advice. For advice about your specific situation, consult a qualified lawyer or your provincial legal aid service.
Sources. PIPEDA requirements in brief and Provincial laws that may apply instead of PIPEDA, Office of the Privacy Commissioner of Canada. Complaints: Office of the Privacy Commissioner. Quebec: Commission d’accès à l’information. Alberta and British Columbia each administer their own Personal Information Protection Act through their provincial Information and Privacy Commissioner.
Privacy law in Canada is actively changing. Bill C-27 died in January 2025 and reform is expected to return in a different form. Confirm the current position before relying on any statement here about what the law requires.