On December 7, 2023, the Office of the Privacy Commissioner (OPC) announced that it had released principles for responsible, trustworthy, and privacy-protective generative artificial intelligence (AI) technologies.

Who is the intended audience for the principles?

The OPC confirmed that the principles are intended to help organizations developing, providing, or using generative AI. More specifically, the OPC clarified the scope of terms including developers and providers as well as organizations using generative AI. Nevertheless, the OPC highlighted that an organization might shift between or play multiple roles at once, noting that the activities undertaken (including collection, use, or disclosure of personal information) by an organization will also vary within each group.

What are the OPC's generative AI principles?

The OPC outlined nine principles including:

• legal authority and consent;
• appropriate purposes;
• necessity and proportionality;
• openness;
• accountability;
• individual access;
• limiting collection, use, and disclosure;
• accuracy; and
• safeguards.

Concerning necessity and proportionality, the OPC noted that all parties should use anonymized, synthetic, or de-identified data rather than personal information where the latter is not required to fulfill the identified appropriate purpose(s). Finally, on safeguards, the OPC provided that all parties should establish safeguards to protect personal information and mitigate potential privacy risks including maintaining ongoing awareness of, and mitigations against, threats that are of particular concern when using generative AI, which includes but is not limited to prompt injection attacks, model inversion attacks, and jailbreaking.

You can access the principles here.