Clinic research identifies privacy drift and shadow AI as Ontario public-sector institutions challenges
A new independent research report by the Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic (CIPPIC) warns that changing contractual terms governing cloud and artificial intelligence (AI) services can expose Ontario’s public-sector institutions to privacy risks after they approve and deploy the technology.
The report examines “privacy drift,” the gradual expansion or alteration of privacy-related rights and obligations that materially change privacy conditions and data exposure over time, either through contractual changes or insufficient enterprise controls.
The October 2026 report, “Beyond the Initial Agreement: How Privacy Drift Affects Modern Third-Party Contracting,” identifies two pathways for privacy drift: changes within approved enterprise systems and employees’ use of unauthorized AI tools, known as shadow AI.
The researchers found that cloud and AI providers rely on interconnected contractual documents, including master agreements, privacy policies, data processing addenda and service-specific terms. Providers can update these documents on different schedules, potentially changing privacy obligations without renegotiating the original agreement.
The report examines Microsoft and Google as case studies, identifying regulatory changes, new AI features and expanded rights over user-related data as principal drivers of privacy drift.
It also highlights risks involving “user-adjacent data,” including metadata, diagnostic information, interaction histories and device signals. Such information can reveal personal details and support profiling even when providers restrict the use of customer content for AI training.
The researchers warn that point-in-time privacy impact assessments may become insufficient as vendors introduce new features or modify contractual terms after procurement.
The report also identifies shadow AI as a separate governance concern. Employees who use consumer AI services or personal accounts for institutional work may bypass enterprise privacy safeguards and expose information to different retention and data-use conditions.
The researchers reviewed Ontario’s legislative framework, including the Freedom of Information and Protection of Privacy Act, the Municipal Freedom of Information and Protection of Privacy Act and the Enhancing Digital Security and Trust Act, 2024.
They found that existing measures impose privacy governance obligations on public-sector institutions but do not establish corresponding vendor-side controls sufficient to address continuously changing contractual arrangements.
The report concludes that public-sector organizations need continuous monitoring, periodic reassessment and governance measures that account for evolving contractual and technical conditions.
