What happened
OpenAI has filed a petition in the Supreme Court of British Columbia seeking judicial review of an investigation by the province's Office of the Information and Privacy Commissioner (OIPC). CBC reported that the OIPC opened the investigation in June, after the February 10 shooting in Tumbler Ridge, British Columbia. Jesse Van Rootselaar allegedly used ChatGPT to help plan the attack; he later died of a self-inflicted gunshot wound after killing six children and two adults. More than two dozen people were injured.
The company argues that the inquiry goes beyond the OIPC's statutory and constitutional authority. Its court filing says the commissioner has not identified reasonable grounds to believe OpenAI breached British Columbia's Personal Information Protection Act in connection with the tragedy. OpenAI also says the province's inquiry duplicates a three-year joint investigation by Canadian privacy regulators that concluded in May. That earlier investigation found that OpenAI lacked accountability, did not follow Canadian law, and launched ChatGPT without fully addressing known privacy issues. OpenAI says commitments it made after that finding should bring it into compliance with the provincial statute.
The immediate procedural conflict is a production order that OpenAI calls sweeping, overbroad, and unnecessary. According to the account, the OIPC is seeking Van Rootselaar's chat logs, records about OpenAI's decision not to refer his account to law enforcement, and answers to questions by November 13. OpenAI says the chat records have already been supplied to law enforcement and the province. The company had previously said the user's first account was flagged internally for violent content and shut down, but that it failed to identify a second account he created.
The OIPC describes a broader question than the actions of one user or one account. It says it is examining whether the use of personal information in providing ChatGPT responses is something a reasonable person would consider appropriate in the circumstances. Its statement specifically includes information contained in or derived from prompts, uploaded content, usage data, and interactions with other users, as well as the possibility that responses can influence behaviour. OpenAI is separately facing a British Columbia government lawsuit in California over its alleged failure to alert police, along with civil suits on behalf of victims, survivors, and witnesses. The public account is available from CBC.
What the archive adds
This is a new fact in a known OpenAI-regulation thread. Our note on FTC demands sent to OpenAI and Anthropic framed consumer-protection scrutiny as evidence gathering about company conduct. The British Columbia dispute makes that dynamic more specific: the contested evidence includes a user's conversations and the provider's internal decisions about a safety escalation.
Trend signal
No supplied site pattern cleanly covers a court dispute over a privacy regulator's authority to obtain chatbot records.
Why now
The timing follows several linked events in the source record: the OIPC opened its investigation in June, issued its production order in September, and OpenAI filed its court petition shortly before the commissioner's public statement. The requested November 13 responses give the fight an immediate procedural deadline, while OpenAI is also contesting liability in separate litigation.
Connections to other events
The source connects the petition to Canada's May joint privacy investigation, which concluded that OpenAI had not met Canadian privacy-law requirements. It also connects it to the British Columbia government's California lawsuit over the alleged failure to notify police of threats made through ChatGPT. The archive's FTC note is related at the level of regulatory method: both matters center on what company records can establish about how an AI service was operated.
Why it matters
AI teams often treat prompts, usage telemetry, moderation events, account histories, and escalation decisions as separate operational systems. This case shows why they can become one evidentiary record when a serious incident occurs. A regulator's theory can reach beyond a model response to ask how personal information was used in delivering the service, how harmful activity was detected, what staff or systems decided, and whether an account was referred onward.
That does not establish that the OIPC will prevail, or that the same authority applies elsewhere. But it makes retention, access controls, audit trails, and incident escalation design more than internal reliability work. Product and safety teams need to know what records exist, who can retrieve them, what their limits are, and whether their documented process matches their actual response to a flagged account.
What happens next
- The court will determine whether the OIPC investigation or production order can proceed in its present form. (3 months, 70%). Watch for: a judicial-review ruling or a narrowed order.
- The scope of requested chat and safety-escalation records will remain central to the dispute. (3 months, 80%). Watch for: filings defining what records must be produced.
Limits and uncertainty
The report describes claims by OpenAI and the OIPC's stated investigative focus; it does not provide a court ruling, the full petition, the full production order, or the underlying chat records. It therefore does not establish whether OpenAI violated British Columbia privacy law, whether ChatGPT responses influenced the attack, or whether the OIPC has authority to compel every category of requested material. It also does not say how the court will balance privacy, evidentiary needs, and the fact that some records were reportedly already provided to law enforcement.
Skill to build now
Run a tabletop review of one serious-safety incident. Map the path from a user interaction through automated flags, human review, account action, and any decision to contact authorities. For each stage, identify the retained artifacts, their owners, their access controls, and the written policy that explains the decision. The goal is not to collect everything indefinitely; it is to ensure the records necessary to explain a consequential response are governed, retrievable, and consistent with actual operations.
Reader takeaway
This is not a model-capability story. It is a test of whether a chatbot provider's prompts, account history, and internal safety decisions can be compelled as one regulatory evidence package. Builders should regard safety operations and data governance as connected product systems, especially where serious user harm is foreseeable.
Open question
If the court permits the inquiry, how narrowly will it define the records a privacy regulator can demand from an AI service provider after a safety incident?