Alberta privacy law provisions limiting scope of “publicly available” information declared unconstitutional

Takeaways:

• The Alberta privacy regulation which provides that “personal information contained in a publication” is “publicly available” – and can therefore be used without consent – can be interpreted to include information posted by individuals to the internet without using privacy settings, on social media platforms or otherwise.
• This has implications for the federal privacy law and the BC privacy law, which contain similar (but not identical) provisions.
• Nonetheless, the purpose for which such information is used must still be “reasonable” and organizations seeking to scrape images or other information from websites may still be caught by this portion of the analysis.
• Subject to copyright, terms of use, and the reasonableness of the purpose, organizations may now have greater access to personal information freely made public by individuals on the internet – at least, in Alberta.
• In addition, the scraping of the internet with a bot to gather images and information may be protected by the Charter’s s. 2(b) right to freedom of expression when such scraping is part of a process that leads to the conveyance of meaning.

1. Overview

In Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287 (the “Decision”), the Alberta Court of King’s Bench heard an application for judicial review by Clearview AI (“Clearview”) in respect of an order (the “Order”) of the Office of the Information and Privacy Commissioner of Alberta (the “OIPC”).

The Decision addresses, for the first time, the constitutionality of provisions in Alberta’s privacy sector privacy law, the Personal Information and Protection Act (“PIPA”), and the regulation thereunder (the “PIPA Reg”) that provides an exception to the general requirement that organizations obtain consent to collect, use and disclose personal information where that information comes from certain, prescribed publicly available sources.

Significantly, the Court concluded that these provisions were unconstitutional under the Charter’s freedom of expression provision in s. 2(b). While ultimately upholding the OIPC’s Order on the basis that Clearview’s purpose for using the information was unreasonable, the constitutional determination has significant implications for any organizations involved in the automated or bot-driven processing of personal information available online, or organizations that contract with such organizations to obtain such information or services or products developed using such information.

2. Background

The Decision arises from the report Joint investigation of Clearview AI, Inc. by the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the Information and Privacy Commissioner for British Columbia, and the Information Privacy Commissioner of Alberta, (the “Commissioners”) issued on February 2, 2021 (the “Joint Report”). The Joint Report resulted from a joint investigation by the Commissioners into whether Clearview’s scraping of images and associated data from publicly accessible online sources, conversion of such images into biometric identifiers, and use of biometric identifiers in the provision of facial recognition services to law enforcement, contravened various private sector privacy laws, including PIPA.

When told by the Commissioners that it required consent to perform these activities, Clearview maintained that it did not, and relied on the statutory exception from having to obtain consent for information which is publicly available as prescribed in s. 7(e) of the PIPA Reg which provides:

7 … personal information does not come within the meaning of … “the information is publicly available” except in the following circumstances:

[…]

(e) the personal information is contained in a publication, including, but not limited to, a magazine, book or newspaper, whether in printed or electronic form, but only if

(i) the publication is available to the public, and

(ii) it is reasonable to assume that the individual that the information is about provided that information.

The Commissioners found the exception for publicly available information did not extend to Clearview’s scraping of data from online sources, and correspondingly concluded that Clearview was obligated to obtain consent for the collection, and subsequent use, of such data; had failed to do so; and had thus contravened the private sector statutes.

On December 7, 2021, on the basis of the Joint Report, the AB OIPC issued the Order, in which it ordered Clearview to:

i. cease offering all of the facial recognition services that have been the subject of this investigation to clients in Alberta;

ii. cease the collection, use and disclosure of images and biometric facial arrays collected from individuals in Alberta; and

iii. delete images and biometric facial arrays that have been collected from individuals in Alberta and that are in its possession.

In response, Clearview applied for judicial review of the Order on the basis that, among other things, the OIPC had adopted an unreasonable interpretation of the words “publicly available” in PIPA and the PIPA Reg and that its interpretation of PIPA and the PIPA Reg was unconstitutional contrary to Charter s. 2(b) provision which guarantees freedom of expression.

3. The Decision

A. OIPC’s narrow interpretation of “publicly available” information is reasonable

On judicial review, Clearview argued that the Commissioners’ interpretation of PIPA Reg s. 7(e) as not applying to online publication was unreasonable on several grounds. First, Clearview argued that the use of the phrase, “including, but not limited to” in PIPA Reg s. 7(e) before the listed types of publications (as opposed to merely “including”) supported an interpretation that included sources other than those expressly listed (i.e. magazines, books or newspapers). Second, Clearview argued that by not offering its own interpretation of PIPA Reg s. 7(e) in the Order and instead, implicitly, adopting the reasoning in the Joint Report (which the Court found appeared to have been limited to the interpretation of the Regulations under the federal privacy law, PIPEDA), that the OIPC’s reasoning was wanting.

The Court was unpersuaded by Clearview’s arguments on judicial review and held that the reasoning in the Joint Report, adopted by the OIPC in the Order, demonstrated the internally coherent and rational chain of analysis demanded by Vavilov. As a result, the court concluded that the OIPC had been reasonable in its interpretation.

B. The PIPA provisions unreasonably limit freedom of expression

The challenge here turned on whether the activities performed by Clearview, chiefly the automated scraping of information from the interned using bots to enable Clearview’s business processes, constituted “expressive activity”, the type of activity freedom of expression provisions protect.

Clearview sought a declaration that s. 12, 17 and 20 of PIPA, along with PIPA Reg s. 7, were unconstitutional, on the basis that the images and information that it scraped from the internet were the raw material from which its technology is based, that those images and information permitted it to provide its service to customers, and that the provision of those services was expressive; and accordingly, that the requirements under the impugned provisions limited its freedom of expression.

Applying the test set out in Canadian Broadcasting Corp v Canada (Attorney General), 2011 SCC 2 the Court found that Clearview’s practices constituted expressive activity limited by PIPA on the basis that:

• Clearview’s scraping activity was expressive because it involves the possession of expressive material (in the form of the scraped images and information), that facilitates the conveyance of meaning to Clearview’s customers (in the form of the facial recognition services);
• Clearview had engaged in expressive activities in Canada, and could do so again, such that its expressive activity is not excluded from protection because of the location of its activities; and
• The operation of sections 12, 17, 20 of PIPA essentially amount to a complete prohibition on the collection, use and disclosure of personal information (i.e. the expressive activity) due to the impracticality of obtaining consent from the individuals concerned.

The Court then turned to the consideration of whether, despite Clearview’s freedom of expression being limited in this way, such limitation was justified.

The Court first considered the Crown’s argument that Clearview’s expression was commercial in nature, such that it was easier to justify than other forms infringements of s. 2(b). The Court dismissed this argument and noted that the more crucial question is whether regulation was consistent with the character of the expression. In that regard, the Court noted that the proportionate regulation of commercial expression is consistent with the character of commercial expression.

The Court then applied the Oakes test, noting that:

• Alberta has a pressing and substantial objective in providing individuals with some control over their personal information and the choice to require consent for the collection, use and disclosure of that personal information is rationally connected to that objective;
• The requirement for consent to collect, use and disclose personal information should extend no farther than required to accomplish the objective of providing individuals with that control;
• By providing numerous exceptions to individuals’ rights to control their personal information, PIPA and the PIPA Reg themselves demonstrate that Alberta does not have a pressing and substantial interest in providing individuals control over their personal information in all circumstances, including where that information is publicly available;
• Other services (such as Google) scrape the internet for the purposes of building and maintaining indexes of information (including images) and would thus be subject to the general consent requirement, but do not, in fact, obtain the consent of every individual concerned; and
• The Crown and OIPC had failed to adduce evidence justifying a blanket prohibition on the collection, use and disclosure of personal information publicly available on the internet and had failed to offer a reasoned explanation of why a blanket prohibition is required (and indeed, the OIPC’s decision to take action against Clearview and not others engaged in similar practices suggests that some collection, use and disclosure of personal information publicly available on the internet is not problematic).

On the basis of the foregoing, the Court held that:

• The Court concluded that the appropriate remedy was thus to strike the words “including, but not limited to, magazines, books, and newspapers” from PIPA Reg s. 7 and leave the word “publication” to take its ordinary meaning as “something that has been intentionally made public”, such that personal information and images posted to the internet without being subject to privacy settings are publications and use of such personal information and images is not subject to a consent requirement.
• Alberta’s pressing and substantial interest in protecting personal information does not extend to users who post images and information online without controlling that information via privacy settings and who would reasonably expect that such images and information would be indexed and retrieved by search engines;
• Because the public availability exception is based on the source of information, and not the purpose for which it is collected, used or disclosed, the exclusion of internet-based sources of personal information under s. 7 of the PIPA Reg is overbroad by subjecting internet search providers to a mandatory consent requirement in respect of those users and that information;
• There is no pressing and substantial justification for imposing such a consent requirement on regular search engines, such that the restrictions occasioned by the consent requirement are overbroad;
• The restrictions imposed by PIPA and the PIPA Reg capture both expression for which there is a justification for regulation and expression for which there is no justification, with any limitation of the application of regulations ultimately turning on who the OIPC selects for enforcement

The Court therefore concluded that PIPA the PIPA Reg were overbroad because they limited valuable expressive activity like the operation of regular search engines without justification.

Finally, the Court held that the salutary effects of applying the consent requirement in PIPA and the PIPA Reg to all bot-driven collection, use and disclosure of personal information (i.e. providing individuals with control over their personal information) was outweighed by its deleterious effects (i.e. the impairment of the operation of search engines that Albertans use for expression).

C. The purpose for which Clearview used the information was not reasonable

PIPA sections 11, 16, and 19 provide that organizations may only collect, use, and disclose personal information for “purposes that are reasonable.”  PIPA s. 2 defines the standard of reasonableness as “what a reasonable person would consider appropriate in the circumstances.”

Clearview submitted in the joint investigation that its purpose in collecting, using, and disclosing personal information was to provide a service to law enforcement agencies which, by the terms of service, were only allowed to use Clearview’s service for “legitimate law enforcement and investigative purposes”. Clearview maintained that any harms associated with the use of its service were “hypothetical”.

The Commissioners’ view of Clearview’s purpose was instead “the mass identification and surveillance of individuals by a private entity in the course of commercial activity” which, in light of evidence on personal and societal harms, was an unreasonable purpose.

Clearview faced an evidentiary problem on this issue, with the Court finding that the OIPC’s conclusions in the Joint Report were reasonable. Notably, the Court rejected Clearview’s argument that Google and similar search engines would be captured by the Commissioner’s interpretation of “purposes that are reasonable”. The Court stated: “…there is an important difference that justifies making different conclusions on the two issues.  The important difference that dictates the different result on the question of “purposes that are reasonable” is that while Google collects, uses, and discloses personal information from the same source as Clearview, it does it for a different purpose than Clearview.  The “purposes that are reasonable” analysis is individualized such that a finding that Clearview’s use of personal information is not for reasonable purposes does not apply to other organizations and does not threaten the operation of the internet.”

As a result, nothwithstanding the declaration of the unconstitutionality of the “publicly available” provisions, the Court held that Commissioner’s conclusion that Clearview’s purpose for using personal information was not reasonable stands on its own and Clearview’s application to quash the Order was dismissed.

4. Takeaways

While the case is significant for broadening what is considered publicly available information that is able to be used without consent, companies (include those developing AI models which may rely on scraped data) should not take this to mean all Canadian information on the internet is fair game.

The purpose of the collection, use, and disclosure will still be germane, and Clearview ultimately failed on this point. Importantly, the Order itself was upheld on this basis, meaning Clearview was still ordered to destroy the information it had collected – a significant negative outcome given its business model. Other companies should be aware of this risk in respect of their purposes for information they gather.

The context of the Decision also important. This is a decision of a lower court in the Province of Alberta. It is not binding on courts in the rest of Canada, although they will certainly consider it. Furthermore, it is likely the Decision will be appealed and so it is unlikely to be the final word on the matter.

There will also likely be a legislative response to this decision (pending any further consideration by appellate courts). The Alberta statute was just recently the subject of a report by a government committee which made recommendations regarding the modernization of PIPA (see our blog post here). Drafters of any amendments will certainly keep the Court’s interpretation of the provisions in mind should they government opt to attempt to re-define the “publicly available” exception.

The language in the BC private sector statute and the federal private sector statute (PIPEDA) is slightly different from the language struck down in Alberta’s statute and so it is an open question if a similar challenge to those statutes would have the same outcome. Regardless, PIPEDA was slated to be rewritten pursuant to the now-defunct Bill C-27, a Bill which will likely be re-introduced by the new government and the drafters of any new bill will likely take the opportunity to address PIPEDA’s similar provisions (or simply update PIPEDA’s regulation in advance of any new bill). BC privacy law has already been reviewed and a draft report of recommendations was published in 2020 (see our blog post here) but to date, no draft modernization legislation has been introduced.

---

For more information on this topic, please contact Kirsten Thompson, Luca Lucarini or other members of the Dentons Privacy and Cybersecurity group.