Albert’s Court Finds Privacy Regulation Unconstitutional

Can the Alberta Privacy and Information Commissioner limit a foreign corporation from collecting images of Albertans for use in facial recognition software? That was the issue that came to the Court of Kings Bench of Alberta on the application by Clearview AI Inc. (“Clearview”) for judicial review of the decision of the Alberta Privacy and Information Commissioner.

Clearview obtains images of Albertans and Canadians by scraping publicly available data from web pages and social media sites on the internet. The privacy commissions of Alberta, British Columbia, Quebec, and Canada investigated Clearview’s practice of scraping images from the internet. A joint report of the privacy commissioners was issued on February 2, 2021 (“Joint Report”) and found that Clearview’s activities breached privacy statutes in each jurisdiction largely for failing to obtain consent to the collection, use and disclosure of the personal information.

On December 7, 2021, the Alberta Information and Privacy Commissioner ordered Clearview (the “Order”) to:

i. cease offering all of the facial recognition services that have been the subject of this investigation to clients in Alberta;

ii. cease the collection, use and disclosure of images and biometric facial arrays collected from individuals in Alberta; and

iii. delete images and biometric facial arrays that have been collected from individuals in Alberta and that are in its possession.

Clearview sought judicial review of the Order. Among other attacks on the Personal Information Protection Act, SA 2003, c P-6.5 (“PIPA”), Clearview asserted that the Personal Information Protection Act Regulation, Alta Reg 366/2003 (the “PIPA Regulation”) is unconstitutional, contrary to Charter s 2(b), which guarantees freedom of expression.

PIPA provides an exception to the consent requirement for the collection, use and disclosure of personal information where the personal information is “publicly available.”

PIPA Regulation provides that personal information is not “publicly available” unless it falls within the “circumstances” provided for in the regulation. The PIPA Regulation is not about “circumstances”, it is better understood as a list of sources of personal information and does not include the internet.

The Court adopted a careful approach to the interpretation of PIPA and the PIPA Regulation and found that the “PIPA and the PIPA Regulation are overbroad because they limit valuable expressive activity like the operation of regular search engines.”^[1]

The Court explained:

The public availability exception to the consent requirement in PIPA and the PIPA Regulation is source-based, not purpose-based. Because it is source-based, it applies to regular internet search engines that scrape images and information from the internet like Clearview even if they use images and information for a different purpose. I find that PIPA and the PIPA Regulation are overbroad because the definition of “publication” in PIPA Regulation s 7(e) is confined to magazines, books, newspapers, and like media. Without a reasonable exception to the consent requirement for personal information made publicly available on the internet without use of privacy settings, internet search service providers are subject to a mandatory consent requirement when they collect, use, and disclose such personal information by indexing and delivering search results. There is no pressing and substantial justification for imposing a consent requirement on regular search engines from collecting, using, and disclosing unprotected personal information on the internet as part of their normal function of providing the valuable service of indexing the internet and providing search results.^[2]

The Court continued:

The problem with PIPA and the PIPA Regulation is not that they impose a consent requirement on Clearview but that they subject all collection, use, and disclosure of personal information that individuals make publicly available on the internet by anyone to a consent requirement. PIPA and the PIPA Regulation capture both expression for which there is a justification for regulation and expression for which there is no justification for regulation. In practice, whether expression for which there is no justification for regulation is limited turns on the Commissioner’s enforcement discretion. The constitutionality of PIPA and the PIPA Regulation cannot turn on who the Commissioner decides to target for enforcement.^[3]

The Court concluded that the negative effects of the regulation were greater than the positive benefits. Havein found that the regulation was in violation of the freedom of expression in the Charter or Rights and Freedoms and not saved by Section 1 of the Charter, the Court concluded:

I conclude that the appropriate remedy is to strike the words “including, but not limited to, magazines, books, and newspapers”. This leaves the word “publication” to take its ordinary meaning, which I characterize as “something that has been intentionally made public.” Personal information and images posted to the internet without being subject to privacy settings are publications, and use of such personal information and images is not subject to a consent requirement. This remedy does the least damage to the legislature’s intent. And, of course, because the provision is in a regulation, it is easy to amend if this decision necessitates other changes or if what remains of PIPA Regulation s 7(e) is not consistent with the government’s preference^[4]s.

The Court went back to its belt and suspenders analysis of PIPA, stating that:

PIPA deploys a belt and suspenders approach because it imposes: (1) a consent requirement on collection, use, and disclosure of personal information with source-based exceptions; and (2) a prohibition on collection, use, and disclosure of personal information except for purposes that are reasonable.^[5]

The Court went on to assess whether Clearview’s purposes for dealing with the personal information were reasonable. The Joint Report had found essentially that Clearview’s purpose was “the mass identification and surveillance of individuals by a private entity in the course of commercial activity” and that was not reasonable. So while Clearview had success on the Charter challenge, it was not free to use or disclose the personal information it had scraped from the Internet.

________________

^[1] See Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287 (CanLII) para. 136.

^[2] See Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287 (CanLII) at para 138.

^[3] See Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287 (CanLII) at para 139.

^[4] See Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287 (CanLII) at para 149.

^[5] See Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287 (CanLII) articulated at para 84.