Who Sees Your Claims Data? Insurers, AI Vendors, and Canada's Fine Print

Intact Financial's 2025 privacy policy lists sub-processors spanning the United States, Ireland, and India for claims analytics and cloud storage. Desjardins' does too, though its list leans more heavily on Quebec and Canadian-based providers. Every major Canadian insurer now runs some portion of claims processing, fraud detection, or underwriting through third-party AI and cloud infrastructure. In most cases, the data crosses a border the policyholder never thinks about. Whether that's legal, and on what terms, depends on PIPEDA, Quebec's Law 25, and a patchwork of insurer-specific disclosures that almost nobody reads.

Section 14

Claims data is some of the richest personal information a person hands over to any organization: medical records, financial history, home security details, driving behavior pulled from telematics devices. Insurers have adopted AI tools aggressively for fraud detection, claims triage, and underwriting risk scoring.

Almost none of this happens entirely in-house. Co-operators, Aviva Canada, and Manulife all disclose, in privacy policies published on their own websites, that personal information may be processed by service providers located outside Canada, including in the United States. These disclosures tend to show up many paragraphs into documents most customers never open. The Office of the Privacy Commissioner of Canada has said organizations remain accountable for personal information even after they hand it to a third party for processing. That means the insurer, not the AI vendor, is on the hook if something goes wrong. It's the accountability principle running through PIPEDA, and it's the reason insurers can legally send data offshore at all: the law permits it, as long as comparable protection is contractually guaranteed.

Whether that protection holds up in practice is a separate question. Regulators have started testing it.

The gap between disclosure and enforcement is where most of the actual risk sits. PIPEDA doesn't require an insurer to notify the Office of the Privacy Commissioner before signing a new AI vendor contract, and it doesn't require a public registry of sub-processors the way some proposed EU frameworks do. An insurer can add a claims-analytics vendor, change its data flows, and update a privacy policy months later with no advance notice to anyone. The main leverage policyholders and regulators have after the fact is a complaint. The OPC investigates complaints and can issue findings, but it has limited order-making power compared to Quebec's CAI, which gained the authority to issue monetary penalties directly as part of Law 25's phase-in. That asymmetry means the same vendor practice can carry different practical consequences depending on whether the affected policyholder lives in Quebec or Ontario — not because the underlying law treats the data differently in principle, but because the enforcement mechanism behind it does.

Law 25 Changes the Math in Quebec

For insurers operating in Quebec, the calculus got harder starting in September 2023, when Law 25's provisions on cross-border data transfers took effect. The law requires a privacy impact assessment before any transfer of personal information outside the province, weighing the sensitivity of the data, the protections at the destination, and whether that jurisdiction offers protection equivalent to Quebec's. The Commission d'accès à l'information, the provincial regulator, has issued guidance making clear the assessment must be documented, not just performed informally.

For insurance, that matters because claims data is sensitive almost by definition: health information, financial records, sometimes criminal history depending on the policy type. An insurer sending that data to a US-based claims analytics vendor now has to show its work. Several national insurers have quietly rewritten vendor contracts since 2023 to add data residency clauses or Canadian processing options — not because PIPEDA forced the change, but because Law 25 did.

The assessment itself is not a one-page form. In practice, insurers building these out describe a process that runs through legal, procurement, and sometimes an outside privacy consultant: mapping which data fields the vendor actually touches, confirming whether the vendor's own sub-processors introduce a second or third jurisdiction, checking what law governs government access requests in the destination country, and documenting why the transfer is still necessary despite the exposure. None of that is free. Insurers that have gone through it for an existing US vendor relationship describe it as slower and more expensive than evaluating a new vendor from scratch, because the existing contract usually wasn't written with Law 25's documentation requirements in mind and has to be renegotiated or supplemented with a side letter. That cost is part of why migration away from entrenched US platforms has been slow — not because insurers dispute the law, but because unwinding a five-year-old hyperscaler contract is a budget line nobody wants to own.

A skeptical reader might point out that a privacy impact assessment, once completed, doesn't actually stop the transfer — it just documents the insurer's reasoning for proceeding anyway. That's accurate. Law 25 doesn't give the CAI pre-approval authority over every cross-border transfer; the assessment is a due-diligence record, not a permit. Its value shows up later, if there's a breach or a complaint, when the CAI asks what the insurer knew and weighed before sending the data out.

"Organizations remain accountable for personal information under their control, including information that has been transferred to a third party for processing," the Office of the Privacy Commissioner of Canada has stated in its guidance on accountability.

One sentence, doing a lot of work. It's why procurement teams at insurers have started asking AI vendors pointed questions about sub-processor lists, data residency, and incident notification timelines — questions that rarely made it into a vendor evaluation five years ago.

Canadian AI Enters the Procurement Conversation

A small but growing set of Canadian AI vendors has aimed directly at this gap. A platform that stores and runs inference on Canadian infrastructure, under Canadian jurisdiction, with no US corporate parent anywhere in the ownership chain, sidesteps a chunk of the Law 25 cross-border assessment. There's simply less to assess.

Augure, a Toronto-based AI vendor, is one example. The company stores customer data in Canada and runs inference on Canadian infrastructure, with vetted EU partners under zero-data-retention agreements covering certain model tiers and failover capacity — never US providers for inference. Augure has no US corporate parent and no US investors, according to the company, so customer conversations and documents aren't handled by providers subject to the US CLOUD Act. That distinction is narrower than it sounds. It applies to customer content specifically, not every operational function the business runs — payment processing and email delivery still touch US-based networks, a detail Augure discloses in its own privacy policy rather than burying it.

For an insurer's compliance team, that narrower scope still helps. A Law 25 privacy impact assessment is simpler to complete, and arguably less exposed, when the AI vendor processing claims documents routes inference through Canada and the EU instead of a US cloud region. It doesn't eliminate the assessment requirement. No vendor relationship does. But it changes what the assessment has to weigh.

The broader market hasn't caught up. Most Canadian insurers still run core AI workloads through US hyperscalers, often because those platforms were procured years before Law 25 existed and migrating is expensive. Appetite for Canadian alternatives is rising in sectors with heavy compliance exposure, but insurance — despite handling some of the most sensitive data in the economy — has been slower to switch than banking or legal services. Vendor lock-in and procurement inertia are the usual explanations. Neither fully accounts for the gap.

PIPEDA's Actual Requirements

PIPEDA doesn't prohibit sending personal information to AI or cloud vendors outside Canada. It requires that the organization disclose, in reasonably clear language, that cross-border processing may occur, and that it use contracts or other means to ensure the receiving party offers comparable protection. The federal Personal Information Protection and Electronic Documents Act, administered by the Office of the Privacy Commissioner, has run on this model since it passed in 2001. The accountability principle hasn't changed much despite two decades of technological shift underneath it.

What has changed is the volume and sensitivity of what gets processed. Telematics data, biometric claims verification, AI-driven fraud scoring trained on historical claims — none of this existed as a mainstream category when PIPEDA's principles were drafted. The law has been stretched to cover it through guidance and enforcement rather than new legislation. That's part of why insurers' privacy policies read as dense as they do.

There's an exception worth naming, because the general PIPEDA-permits-transfer rule doesn't hold for every category of insurance data. Some provincial insurance regulators layer additional restrictions on top of federal privacy law for specific product lines — auto insurance in particular, where several provinces restrict how driving and telematics data can be used for rate-setting, separate from where it's stored. An insurer can be fully PIPEDA-compliant on cross-border disclosure and still run into a provincial insurance regulator's objection if an AI vendor's fraud model uses telematics data for a purpose the provincial auto insurance framework doesn't permit. That's a different regulator entirely, assessing a different question, and it means "PIPEDA allows it" is necessary but not sufficient for every line of business an insurer writes.

A reader trying to figure out whether a specific insurer shares data with AI vendors has exactly one reliable path: the insurer's own privacy policy, specifically the sections on service providers, third parties, and international transfers. The Insurance Bureau of Canada doesn't publish a standardized disclosure across the industry, so the format and location of that information varies from one insurer's website to the next.

Checking an Insurer's Vendor Disclosures

The practical answer sits in three places: the privacy policy's service-provider or sub-processor section, any consent form signed at policy issuance, and, for Quebec residents, the insurer's published Law 25 compliance statement, if one exists.

• Service-provider or sub-processor section of the privacy policy
• Consent form signed when the policy was issued
• Law 25 compliance statement, for Quebec residents, where published

None of these are long reads by design, and most insurers don't make them easy to find from the homepage. Augure publishes its own sub-processor list and privacy policy at augureai.ca, for readers who want to see what that kind of disclosure looks like when a vendor is built around Canadian data residency rather than retrofitted for it. It supports an insurer's compliance work. It doesn't do that work for them.