Alberta court finds sections of privacy law unconstitutional

On May 8, the Court of King’s Bench of Alberta released its decision in Clearview AI Inc. v Alberta (Information and Privacy Commissioner) (the Decision). The Decision found certain provisions of Alberta’s private-sector privacy law that limit the scope of “publicly available” information violate subsection 2(b) of the Charter and are therefore unconstitutional. Of note, this Decision marks the first time a court has considered the constitutionality of certain sections of the Personal Information Protection Act (PIPA).

Background

The Decision arose following a joint investigation by the privacy commissioners of Alberta, British Columbia, Quebec, and Canada into whether Clearview AI’s facial recognition tool breached private-sector privacy laws. The tool scrapes images and data from publicly accessible online sources to produce a facial recognition database. 

Clearview argued that the personal information of Albertans its tool amassed was exempt from the requirement to obtain consent prior to its collection, use or disclosure under PIPA because the information was “publicly available” online. In relevant part, section 7(e) of PIPA’s regulation defines when personal information is “publicly available” as when it is “contained in a publication, including, but not limited to, a magazine, book or newspaper, whether in printed or electronic form.” 

Following the investigation, the privacy commissioners issued a joint report (the Joint Report) that concluded Clearview was in breach of privacy laws in each of its respective jurisdictions. Of note, the Joint Report found the “publicly available” exception to consent did not extend to information available from online sources. Accordingly, Clearview was required, according to the privacy commissioners, to obtain consent from individuals for collecting, using and disclosing their personal information in connection with its facial recognition tool, which it had failed to do. 

Based on the Joint Report, the Information and Privacy Commissioner of Alberta (the Commissioner) ordered Clearview to: 

• cease offering its facial recognition tool in Alberta;
• cease collecting, using and disclosing images and biometric facial arrays collected from individuals in Alberta; and
• delete images and biometric facial arrays in its possession that had been collected from individuals in Alberta.

Clearview applied for judicial review of that order and challenged the constitutionality of the “publicly available” exception to consent found in sections 12, 17 and 20 of PIPA and subsection 7(e) of its regulation.

Commissioner’s decision was reasonable 

On judicial review, Clearview argued it was unreasonable for the Commissioner to have interpreted the “publicly available” exception to consent as not applying to information available from online sources. The court disagreed, finding the Commissioner’s narrow construction of “publicly available” that excluded online sources to be reasonable. 

“Publicly available” exception to consent requirement found unconstitutional 

Given the court’s view the words “publicly available” do not apply to online sources, an organization seeking to collect, use or disclose personal information from the internet must first obtain consent. However, Clearview argued in its constitutional challenge that this requirement limits its freedom of expression, asserting that scraping the internet to gather images and information is an “expressive activity” that is restricted by PIPA’s consent requirements. The court agreed, finding Clearview’s internet scraping is part of a process that leads to the conveyance of meaning in the form of facial recognition. 

The court noted that where obtaining consent is impractical, such as in mass scraping of online content, the consent requirement amounts to a complete prohibition on collecting, using, and disclosing personal information. While the Commissioner was concerned that Clearview’s online scraping was not for reasonable purposes, the prohibition applies even for reasonable purposes. As such, the court concluded that PIPA’s consent requirement restricts freedom of expression. Further, under the canonical Oakes test, the restriction is not justified.

As a result, the court found that sections 12, 17 and 20 of PIPA and subsection 7(e) of its regulation were unconstitutional for violating subsection 2(b) of the Charter. The appropriate remedy was to strike the words “including, but not limited to, a magazine, book or newspaper” from the description of “publicly available” and leave “publication” to take its ordinary meaning as “something that has been intentionally made public.”

Finally, the court noted even where personal information is not subject to a consent requirement, it still cannot be collected or used by an organization except for reasonable purposes. Clearview asserted that its purpose was to provide a service to law enforcement agencies. The court disagreed, accepting the Commissioner’s finding that Clearview’s purpose was “the mass identification and surveillance of individuals by a private entity in the course of commercial activity” and that such a purpose was not reasonable. So, Clearview is not permitted to use its facial recognition tool in this particular case despite the striking down of the description of “publicly available.” 

Key takeaways

The Decision broadens what constitutes “publicly available” information as an exception to PIPA’s consent requirements for collecting, using and disclosing personal information. 

Ultimately, this finding was little consolation to Clearview as it was still required to cease offering its services in Alberta and delete all previously collected personal information of Albertans. However, the Decision is nevertheless significant as it clarifies that individuals’ personal information may be collected without consent when “publicly available” online, assuming the purpose for doing so is reasonable, and places further constraints on PIPA’s consent requirement, which is a fundamental tenet on which PIPA and other Canadian privacy laws is built. 

In a time when the adoption and development of artificial intelligence is continuing at a torrid pace, which in many cases involve scraping of content available online to train underlying models, the privacy interests of Albertans in the collection, use and disclosure of their personal information in association with such activities is more limited today than it was before the Decision was released.

The authors would like to thank Chloe Loblaw, articling student, for her contribution to preparing this legal update.