Okay, so can we just deal with a few specifics then, Susie, particularly if there is training?

Yeah, this is where it gets tricky from a privacy compliance perspective.

So when we look at it under IPP 10, for instance, when you collect somebody's personal information, You're collecting it for a specific purpose.

Now, if you're using an AI tool and that provider is going to use that information for training purposes, then that is a secondary purpose of use.

And what's important is that your privacy policy transparently sets that out at the outset.

And in some cases, given the... complexity around that and I guess consumers perspective on how that might be not acceptable from their point of view you may need to call it out even before you get to the privacy policy point of view and we'll talk about that a bit later but the secondary use issue is really important to cover off in your privacy policy and also understanding the vendors accountability so even if it's training their underlying model being really clear in your vendor agreements about how they can use that data is important as well.

So we're straying into vendor agreements here a little bit from privacy policies, but it's important that you look at those vendor contracts and understand their rights to the data in order for you to accurately reflect that in the privacy policy.

If our clients want to make sure their privacy policy is fit for purpose in the age of AI, can you just run through maybe a couple of steps they should take?