Executive Summary: Key Legal and Evidentiary Issues

• Alberta’s privacy law (PIPA) applies to Clearview AI despite it being a U.S.-based company, due to its past marketing to Alberta police and collection of Albertans’ personal data.

• The Commissioner’s interpretation that social media posts are not “publicly available” under PIPA Regulation s.7(e) was found reasonable.

• Clearview’s purpose—mass biometric data scraping for commercial facial recognition—was deemed unreasonable under PIPA sections 11, 16, and 19.

• The Court held that the regulatory definition of “publicly available” unjustifiably infringes s.2(b) of the Charter by restricting expression involving publicly accessible online content.

• As a remedy, the Court struck down the phrase “including, but not limited to, a magazine, book or newspaper” from PIPA Regulation s.7(e).

• Despite the constitutional finding, Clearview’s challenge to the Commissioner’s Order was dismissed; the Order remains valid based on the finding of unreasonable use.

Facts of the case

Clearview AI Inc, a U.S. corporation, provides facial recognition services and software to law enforcement agencies. Its database is built using billions of images scraped from publicly accessible websites, including those in Alberta and social media accounts of Albertans. In February 2020, the Privacy Commissioners of Alberta, BC, Quebec, and Canada initiated a joint investigation into Clearview’s practices. On February 2, 2021, a Joint Report concluded that Clearview’s operations contravened privacy laws in all participating jurisdictions.

Clearview had offered trial accounts to Canadian clients, including the Calgary Police Service, Edmonton Police Service, and the RCMP. The Alberta Information and Privacy Commissioner issued an Order on December 7, 2021 requiring Clearview to:

1. Cease offering its facial recognition services to clients in Alberta;

2. Cease collecting, using, and disclosing images and biometric facial arrays from individuals in Alberta; and

3. Delete all such data in its possession.

Clearview applied for judicial review, challenging the constitutionality of Alberta’s privacy regime and arguing that it is not subject to Alberta’s jurisdiction.

Policy terms and statutory clauses

The Court analyzed Alberta’s Personal Information Protection Act, SA 2003, c P-6.5 (PIPA) and its Regulation, Alta Reg 366/2003. PIPA prohibits organizations from collecting, using, or disclosing personal information without consent, unless the information is “publicly available” as defined in Regulation s.7. Section 7(e) specifies that personal information is only “publicly available” if it is contained in a publication (e.g., “magazine, book or newspaper”) and was reasonably provided by the individual.

The Commissioner determined that social media content is not a “publication” under s.7(e), and thus consent was required for its use. The Court upheld this interpretation as reasonable.

Outcome of the case

Justice Feasby found that Clearview was subject to Alberta jurisdiction due to a “real and substantial connection,” including past business activities in Alberta and the scraping of data from Alberta-hosted websites. The Court also held that Clearview’s purpose—mass surveillance and facial recognition via biometric data scraping—was not one a “reasonable person would consider appropriate in the circumstances” under PIPA s.11, 16, and 19.

Clearview also brought a constitutional challenge under s.2(b) of the Charter, claiming that the regulatory definition of “publicly available” unjustifiably restricted freedom of expression. The Court agreed, holding that:

• The existing definition excludes nearly all internet content, including material posted without privacy settings;

• This restriction applies not only to Clearview but to other expressive technologies such as search engines;

• The regulation is overbroad, limiting both harmful and benign uses of data without justification.

Remedy and final ruling

The Court struck down the words “including, but not limited to, a magazine, book or newspaper” from PIPA Regulation s.7(e), expanding the definition of “publication” to encompass unprotected online content. However, Clearview’s application to quash the Commissioner’s Order was dismissed. The Court upheld the Commissioner’s findings that:

• Clearview’s mass collection and use of biometric data lacked reasonable purpose;

• Its activities constituted mass surveillance, posed risks of misidentification, and inflicted privacy harms even on individuals not suspected of any crime;

• Clearview’s inability to isolate Albertans’ data from its global database was a problem of its own making.

Clearview was ordered to report back within 50 days on its compliance, including steps similar to those outlined in a prior Illinois settlement. The Court found the terms of the Order to be clear and enforceable.

Conclusion

The Court validated Alberta’s right to enforce privacy protections against foreign entities collecting data on its residents. At the same time, it narrowed the reach of PIPA by removing overly restrictive language from its Regulation. The decision clarifies that while privacy laws can regulate commercial surveillance practices, they must not unjustifiably limit the broader public’s right to expression and access to information.

Neither party achieved a full win, but both succeeded on key issues. The Commissioner’s enforcement order remains in effect; Clearview achieved a significant legal change to the regulation.