Executive Summary: Key Legal and Evidentiary Issues

• Territorial reach was contested, with Clearview arguing that Québec's private-sector privacy statute and the LCCJTI could not apply to a U.S.-based company with no office, employees or clients in the province.
   
• Clearview denied that linking scraped facial images to metadata and biometric identifiers amounted to establishing a "file" on others under section 4 of the Private Sector Act.
   
• Alternatively, it claimed a serious and legitimate interest in compiling such files because they allow its law enforcement clients to obtain information quickly in criminal investigations.
   
• Its attack on the orders of the Commission d'accès à l'information du Québec as unreasonable and unenforceable raised the threshold question of whether that ground involved law or jurisdiction, the only matters appealable to the Court of Québec.
   
• A new constitutional question asked whether the consent requirements in sections 6, 13 and 14 of the Private Sector Act unjustifiably infringe freedom of expression under section 2(b) of the Canadian Charter.
   
• Expert evidence from Sébastien Gambs addressed Clearview's collection of 40 billion images, its disregard of social media terms of use, and the limits of its de-indexing mechanism.
   

Facts of the case

Clearview AI Inc., an American company, provides a facial recognition search engine mainly to government bodies and police services. A web crawler collects facial images from websites and social networks such as Facebook, Instagram, LinkedIn and YouTube, and Clearview's software creates a biometric identifier, or "vector," for each face. The company also keeps each image's available metadata and a link to the page where it was found. Clients upload a photo of a person of interest and receive the facial images in the database that may match it.

In February 2020, the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec (CAI), and the British Columbia and Alberta privacy commissioners announced a joint investigation. Clearview filed representations on November 20, 2020. A joint report published on February 2, 2021 recommended that Clearview stop offering facial recognition services to Canadian clients, stop collecting, using and disclosing facial images and biometric data of individuals in Canada, and delete all images and facial vectors collected from people in Canada. Its only paying Canadian client had been the RCMP, which Clearview stopped serving in July 2020, when it also stopped offering trial accounts to a limited number of Canadian users.

The CAI sent a notice of intended orders on September 28, 2021. Clearview replied on October 28, 2021 that it could not comply. On December 14, 2021, the CAI ordered it to stop compiling files on others in the course of carrying on an enterprise in Québec, to stop collecting images and using them to create identifiers, and to destroy those images, information and identifiers. Clearview appealed to the Court of Québec on five grounds and served a notice of constitutional question on the Attorney General of Québec. Because the Attorney General had not been a party during the CAI's investigation, it filed its own evidence, including an expert report by Sébastien Gambs dated July 25, 2024. On judicial review elsewhere, Alberta's Court of King's Bench had partially ruled in Clearview's favour, while British Columbia's courts dismissed its application at first instance and on appeal. Québec's Superior Court had also authorized a class action on behalf of people whose facial images and personal information Clearview collected, used or disclosed while they were Québec residents, since August 18, 2017.

Policy and legislative provisions at issue

Under section 4 of the Act respecting the protection of personal information in the private sector, as worded when the facts arose, a person carrying on an enterprise could establish a file on another person by reason of a serious and legitimate interest, provided the file's object was recorded. Section 5 limited collection to information necessary for that object, gathered by lawful means. Personal information was defined in section 2 as any information that relates to a natural person and allows that person to be identified.

The constitutional challenge targeted three consent provisions. Section 6 requires personal information to be collected from the person concerned unless that person consents to collection from third parties. Third-party collection without consent is also allowed where the law authorizes it, or where there is a serious and legitimate interest and either the information is collected in the person's interest and cannot be collected from them in due time, or third-party collection is needed to ensure accuracy. Communicating personal information to a third person without consent is barred by section 13 unless the Act provides otherwise, and express consent is required for sensitive information. Under section 14, consent must be manifest, free, enlightened and given for specific purposes, and it lasts only as long as needed to achieve them.

Appeals from the CAI are limited by section 61 to questions of law and jurisdiction. The Act to establish a legal framework for information technology (LCCJTI), at section 45, empowers the CAI to make orders respecting databases of biometric characteristics or measurements.

Reasoning and analysis

The court addressed the non-constitutional grounds first. Whether Clearview created "files" was a mixed question, so only the legal framework was reviewable. Drawing on the ordinary meaning of the word and on section 5, the court defined a file as a set of personal information about the same subject, gathered in a container, folder or directory that allows it to be stored or organized. Applying the test from Segal, it held that the CAI did not err: Clearview had established files on the people in the billions of scraped images by associating each with a unique biometric identifier kept in its database, and those images and identifiers are personal information.

On the serious and legitimate interest question, Clearview proposed, and the CAI did not dispute, a two-step framework assessing the legitimacy of the objective and then the proportionality of the privacy intrusion. The CAI had applied the first step. It found that Clearview built its biometric database in contravention of Québec laws, that its identification service amounted to a form of mass surveillance by a private company that no Québec law authorizes, and that Clearview could not rely on its clients' crime-solving objective. The court found no error of law, observing that Clearview never obtained or sought consent and was effectively asking for the evidence to be reweighed.

Clearview's challenge to the orders as unreasonable and unenforceable failed at the threshold. Its inability to comply stemmed from its business model, which made the issue one of fact and not appealable under section 61. The orders were within the CAI's powers, and any remedy on enforceability lay in another forum.

Territorial application was a readily extricable question of law that the court could review without deference. Clearview relied on the real and substantial connection test from Unifund, which the Attorney General agreed governed and which Clearview noted the Supreme Court had endorsed in Sharp. Drawing on the British Columbia Court of Appeal's analysis of how the internet has strained location-based tests, the court rejected the argument that Clearview's lack of physical presence and clients in Québec placed it beyond the statutes. A sufficient connection exists whenever a person collects, retains, uses or communicates personal information about Québec residents. The CAI had found that Clearview collects information, including directly in Québec, and indexes it, and Clearview acknowledged keeping indexed images indefinitely even after a photo is removed from its source site. The court held that these activities amount to carrying on an enterprise under article 1525 of the Civil Code of Québec. Fairness was satisfied because Twitter, Facebook, Instagram, YouTube, LinkedIn and PayPal had formally demanded that Clearview stop collecting photographs from their sites and destroy them, and Clearview deliberately chose to ignore those terms of use. Order was respected because the CAI's orders were confined to Québec residents and left Alberta and British Columbia free to act.

On the Charter question, raised for the first time on appeal, the court found that Clearview's activities have expressive content, likening its database to old paper telephone directories, and that neither the Web as a location nor a client-accessible database as a method removed protection. Under section 1, Clearview conceded that the provisions pursue a pressing and substantial objective, and the court found the consent requirement rationally connected to it.

On minimal impairment, the Gambs report stated that Clearview's collection is not limited to public websites and also extends largely to social media sites, without regard to their terms of use. According to the report, Clearview could easily identify the sources of its 40 billion images through their URLs and could readily spot Canadian or Québec images by domain suffixes such as ".ca" or ".qc.ca." The report also noted that Google Images does not find all photos of a person from one face sample, and that Clearview's de-indexing tool keeps the images and only removes them from clients' future searches. For residents of certain U.S. states with access laws, Clearview required an email address, a face photo and government-issued identification. Those measures offered some protection, but the legislature only had to choose among reasonable options, not the least restrictive one, as held in RJR-MacDonald. The Act's exclusion for journalistic, historical and genealogical activity, and the reasoning in Aubry v. Éditions Vice-Versa, supported that conclusion.

In weighing benefits against harms, the court rejected Clearview's premise of tacit consent, pointing to people photographed by others at private events and to children too young to consent. Mr. Gambs reported that faces are sensitive biometric data and that Clearview's practices can reveal a person's gender, age and ethnic origin and, in several cases, their place of residence, the places they frequent and their habits. Nothing in the evidence showed how many crimes Clearview's system had helped solve. Clearview did not know what clients did with the information or whether they shared it, and it had no contracts with them limiting its use.

Ruling and overall outcome

The Court of Québec dismissed Clearview's appeal from the CAI's December 14, 2021 decision and declared that both the Private Sector Act and the LCCJTI apply constitutionally to Clearview. It further declared sections 6, 13 and 14 of the Private Sector Act valid because they do not infringe freedom of expression in a manner that is unjustified in a free and democratic society. The CAI, supported by the Attorney General of Québec, was the successful party. No damages or other monetary sum was ordered, and although legal costs were awarded, the judgment does not state their amount.