Alberta Court Weighs In On Clearview AI: Wins, Losses And Key Takeaways

On May 8, 2025, the Alberta Court of King's Bench released its much-anticipated decision in Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287. The ruling has significant implications both for domestic enforcement and global data governance as it pertains to the collection, use and disclosure of personal information scraped from the publicly accessible internet. The ruling also addresses the extraterritorial reach of Alberta's Personal Information Protection Act, SA 2003, c P-6.5 ("Alberta PIPA"), and Personal Information Protection Act Regulation, Alta Reg 366/2003, enacted thereunder (the "PIPA Regulation"), in the context of evolving technologies and transnational data practices.

The decision arises from Clearview AI Inc.'s ("Clearview") challenge to an enforcement order issued by Alberta's Information and Privacy Commissioner (the "Commissioner"). Clearview, a U.S.-based developer of facial recognition technology, sought judicial review of the Commissioner's findings and contended that Alberta's privacy framework was both inapplicable to its operations and unconstitutional insofar as it restricted its collection, use and disclosure of internet-sourced publicly accessible personal information without consent.

In a detailed judgment, Justice Feasby upheld the Commissioner's jurisdiction and interpretation of the "publicly available" exception to consent under Alberta PIPA but struck down part of the PIPA Regulation as an unjustified infringement of freedom of expression under section 2(b) of the Charter. The decision clarifies the extraterritorial reach of Alberta's privacy statute and the constitutional limits of its regulatory framework to govern personal information in the digital age.

This bulletin provides an overview of the Court's findings with a focus on (1) jurisdictional reach, (2) statutory interpretation of the "publicly available" exception, and (3) the constitutional invalidity of part of the PIPA Regulation.

Background

Clearview offers facial recognition services built on a database comprising billions of images scraped from publicly accessible websites, including social media platforms. Its technology converts these images into biometric templates, which are then made searchable by law enforcement clients.

In early 2020, the privacy commissioners of Alberta, British Columbia, Quebec, and Canada jointly launched an investigation into Clearview's practices, finding that Clearview's collection and use of images without consent violated privacy legislation in each participating jurisdiction.

In Alberta, the Commissioner relied on the joint findings to issue a formal order that required Clearview to:

• Cease offering its facial recognition services to clients in Alberta;
• Cease collecting, using, or disclosing images or biometric data of Albertans; and
• Delete all such personal information already in its possession.

Clearview did not comply. Instead, it brought an application for judicial review challenging both the Commissioner's jurisdiction and the validity of the statutory scheme under which the order was issued. It argued, among other things, that Alberta PIPA had no extraterritorial application, that the Commissioner's interpretation of the "publicly available" exception was unreasonably narrow, and that the impugned provisions unjustifiably infringed its freedom of expression under the Charter.

I. Extraterritorial Reach of Alberta's Privacy Regime

The first issue considered by the Court was whether Alberta's Commissioner had jurisdiction over Clearview, a U.S.-based company that had no physical presence in Alberta and had ceased its Canadian operations by July 2020 at the onset of the joint investigation.

The Court found that a real and substantial connection existed to support the application of Alberta PIPA to Clearview. The decision emphasized that Clearview had marketed its services to Canadian law enforcement agencies and that Alberta-based entities, including the Calgary and Edmonton Police Services, had accessed the technology.

Crucially, the Court rejected the argument that Clearview's withdrawal from the Canadian market insulated it from regulatory oversight. The Commissioner's jurisdiction was grounded in Clearview's historical business activities in Alberta and its ongoing activities respecting personal information of Albertans.

The Court also rejected Clearview's argument that Alberta PIPA could not apply where the data was scraped from servers located outside Alberta. The Court held that the relevant connection was not the server location but the subject of the personal information (i.e., Alberta residents). In any event, the Court inferred from Clearview's indiscriminate scraping of data across the internet that at least some data was scraped from servers located within Alberta.

II. Reasonableness of the Commissioner's Interpretation of the "Publicly Available" Exception

Clearview next challenged the Commissioner's interpretation of the "publicly available" exception found in ss. 14(e), 17(e), and 20(j) of Alberta PIPA, as defined in s. 7(e) of the PIPA Regulation. These sections allow organizations to collect, use and disclose personal information without consent if the information is publicly available within the meaning of the following definition:

The Commissioner interpreted the term "publication" in s. 7(e) narrowly, such that it is limited to traditional sources of media such as books, newspapers, or magazines, but not social media. Although the PIPA Regulation uses the phrase "including, but not limited to," the Commissioner applied a restrictive reading, invoking privacy's quasi-constitutional status and relying on the interpretive principle ejusdem generis (meaning 'of the same kind').

The Court upheld the Commissioner's interpretation as reasonable under administrative law principles. However, as noted below, the Court found that this interpretation, in turn, rendered the provision unconstitutional.

III. Constitutional Challenge – Freedom of Expression and the PIPA Regulation

Clearview further argued that, if the Commissioner's interpretation of the exception was accepted, the combined effect of the consent requirement under Alberta PIPA and the narrow extent of the exception created a sweeping prohibition on expressive conduct based upon information sourced from the publicly accessible internet. The Court agreed.

A. Scraping is Expressive

As a starting point, the Court accepted that Clearview's scraping and indexing of publicly available images from the internet was expressive conduct, and that the provision of its facial recognition tool conveyed meaning in a way that engaged freedom of expression Charter rights. Applying the Supreme Court's test in Canadian Broadcasting Corp v. Canada (AG), 2011 SCC 2, the Court found that: (1) Clearview's activities involve the possession and use of expressive material; (2) its activities facilitate communication with its customers; and (3) the narrow applicability of the "publicly available" exception imposed a practical prohibition on such expression by requiring consent in all cases.

B. Unjustifiable Limit on Freedom of Expression

Next, the Court held that the challenged provisions imposed an unreasonable limit on Clearview's freedom of expression. The Court accepted that Alberta PIPA has a pressing and substantial justification for protecting individuals' control over their personal information, and that the limitation is rationally connected to the objective. However, it did not find that the limitation was sufficiently minimally impairing in the circumstances or that its benefits outweighed its negative effects. In this regard, the Court found that the regulatory scheme required consent even for reasonable uses of information posted publicly online, and excluded internet sources from the "publicly available" exception, which created a de facto ban on certain types of expression that are desirable.

For example, the consent requirement for personal information publicly available on the internet applies equally to Clearview's search technology used to create a facial recognition database and regular search engines, such as Google or Bing, that individuals use to access information on the internet. The Court recognized that people consider Google's indexing of images and information to be beneficial, but according to the Commissioner's interpretation of Alberta PIPA and the PIPA Regulation, Google and similar search engines cannot scrape the internet in Alberta for the purpose of building and maintaining an index of images of people without consent from every individual whose personal information is collected. As such, the Court found that Alberta PIPA and the PIPA Regulation are overbroad because they limit valuable expressive activity like the operation of regular search engines.

The Court suggested that a purpose-based restriction that prohibits the use of publicly available personal information for certain purposes would offer a more tailored and constitutionally valid means of prohibiting Clearview AI's conduct, without interfering with the beneficial operation of search engines.

C. Remedy

The Court found that the appropriate remedy is to strike the words "including, but not limited to, magazines, books, and newspapers" from s. 7(e) of the PIPA Regulation. By doing so, the Court left the word "publication" to take its ordinary meaning, which includes "something that has been intentionally made public." Personal information and images posted to the internet without being subject to privacy settings are publications and use of such personal information and images is, accordingly, not subject to a consent requirement under Alberta PIPA. In the Court's view, this remedy preserves the consent framework but eliminates the overly narrow definition of "publication," allowing for a broader interpretation of "publicly available" in light of contemporary information-sharing practices.

IV. Key Takeaways and Practical Implications

The Clearview decision provides long-awaited judicial guidance on the boundaries of privacy regulation in the digital age. Key takeaways include:

1. Extraterritorial Application of Alberta PIPA. Foreign organizations are not exempt from Alberta PIPA where there is a real and substantial connection to Alberta, including through present or former marketing, provision of services, or data collection involving Alberta residents – particularly if scraped from Alberta-based servers.
2. Limits on Regulatory Overreach. Legislative restrictions for online expression must be carefully tailored. The narrow definition of "publication" in the Regulation unjustifiably limits the expression protected by the Charter.
3. Regulatory Reform Anticipated. The striking of the words "including, but not limited to, magazines, books, and newspapers" from s. 7(e) may prompt legislative revision to better balance privacy interests with freedom of expression in online contexts.

The Clearview decision is a pivotal decision for Canadian privacy and constitutional law. It affirms the regulatory reach of provincial privacy statutes while clarifying the limits of those laws when they encroach upon fundamental freedoms. Organizations operating in data-intensive sectors should review their consent practices and re-evaluate reliance on "public" data, particularly in AI and security contexts.

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2025