Co-authored by Marya Talha – Summer Law Student
Think online data is fair game? A new decision from the Alberta Court provided further guidance to 'publicly available' data.
The Alberta Court of King's Bench issued its decision in Clearview AI Inc. v Alberta (Information and Privacy Commissioner), addressing Clearview AI's challenge to an enforcement order issued by the province's Information and Privacy Commissioner (the "Commissioner").
The case examined whether Clearview had violated Alberta's Personal Information Protection Act ("PIPA") and raised constitutional questions under the Canadian Charter of Rights and Freedoms ("Charter"). Read on for our analysis of the decision.
Background
Clearview, a U.S.-based company, scrapes billions of facial images from the internet, including those of Albertans and other Canadians, to build a facial recognition database used primarily by law enforcement agencies. Law enforcement agencies are able to compare the scraped images with surveillance footage to identify individuals in such footage.
In 2020, Canada's federal, Quebec, Alberta, and British Columbia privacy commissioners jointly investigated Clearview AI and found that the company collected, used, and disclosed personal information without consent as required under Canadian privacy law, relying improperly on a "publicly available information" exception. The commissioners held that this exception must be narrowly interpreted and does not necessarily extend to personal information published online. They further concluded that Clearview's practices were not for purposes that a reasonable person would consider appropriate.
While the federal commissioner issued recommendations (as it does not have order making power under the current federal privacy law, PIPEDA), the Quebec, Alberta, and BC commissioners—who do have order-making powers—ordered Clearview to cease services in their respective provinces, stop collecting and using facial biometric data, and delete related biometric information. Clearview rejected the findings and sought judicial review of the provincial orders. The BC Supreme Court upheld the BC commissioner's order and the decision from Quebec has not been issued as of writing.
In Alberta, Clearview argued that it is not subject to Alberta's jurisdiction under PIPA, that the Commissioner's interpretation of the term 'publicly available' in PIPA's Regulations was unreasonable, and that its constitutional right to freedom of expression had been violated. Further, Clearview challenged the Commissioner's finding that it did not have a reasonable purpose for collecting, using and disclosing the personal information.
Application of PIPA to foreign companies
An initial issue to be determined by the Court was whether Alberta's privacy legislation, PIPA, applies to Clearview, a U.S.-based company. The Court concluded that the Commissioner does have jurisdiction under PIPA to regulate Clearview's collection and use of personal information of individuals in Alberta.
In reaching this conclusion, the Court applied the established legal test of whether there was a "real and substantial connection" between Alberta, the subject matter of the legislation, and the out-of-province entity.
Clearview argued PIPA should not apply, as it does not operate servers in Alberta and has suspended business activities there. The Court rejected this, emphasizing that the servers' location is not determinative. Instead, the Court confirmed that Clearview marketed and provided its services to Albertan law enforcement agencies, which constituted doing business in the province, and the personal information at issue belonged to individuals located in Alberta.
Together these factors established the necessary connection to justify the application of PIPA.
Statutory interpretation of the "publicly available" exception
Clearview challenged the Commissioner's order, claiming that scraped content from social media qualified as 'publicly available' under PIPA and its Regulation and therefore benefited from an exemption to the requirement for consent to collect and use such data.
PIPA requires organizations to obtain consent to collect, use, or disclose personal information, unless an exception applies, such as if the information is 'publicly available' as defined in the Regulations. The PIPA Regulation set out that personal information is 'publicly available' if it is contained in a publication, including, but not limited to, a magazine, book or newspaper, whether in printed or electronic form, but only if the publication is available to the public, and if it is reasonable to assume that the individual that the information is about provided the information.
Clearview argued for a broad interpretation of the 'publicly available' exception to include social media, citing the phrase "including, but not limited to." The Commissioner emphasized that privacy legislation is quasi-constitutional in nature and must be interpreted narrowly. Justice Feasby upheld the Commissioner's interpretation that PIPA Regulation narrowly defines 'publicly available' as limited to information in traditional publications (e.g.: books, newspapers), does not include social media content.
The definition of "publicly available" becomes a charter freedom of expression issue
The Alberta Court also addressed a constitutional challenge by Clearview, which argued that if the 'publicly available' exception were limited to sources like books and magazines, it would violate its right to freedom of expression under section 2(b) of the Charter. Clearview claimed that its practice of scraping internet data for commercial purposes was expressive activity under the Charter.
Clearview argued that PIPA's restrictions infringed its freedom of expression by limiting its ability to collect and use publicly available information, such as social media content, which it asserted individuals no longer reasonably expect to remain private. Clearview maintained that its web-scraping activities are a type of expressive activity, as it provides information to its clients.
Notably, the Court found that 'publicly available' exception did indeed limit freedom of expression, but that it was justified under section 1 of the Charter.
Justice Feasbyagreed that Clearview's scraping activities could be protected under section 2(b) of the Charter. However, the Court found that the limitation on Clearview's expressive activity was justified under section 1 of the Charter, as PIPA's consent requirement was rationally connected to the goal of protecting Albertans' control over their personal information.
However, the Court agreed with Clearview that PIPA's exception, which focuses solely on the source of information, could be too broad, potentially capturing acceptable activity, such as search engines indexing publicly available web content.
To address this, the Courtstruck down the phrase"including, but not limited to magazines, books, and newspapers" from section 7(e) of the PIPA Regulation, allowing for abroader interpretation of "publication"as something "intentionally made public."
Reasonable purpose for collecting, using and disclosing personal information
Under PIPA, the protection of personal information is grounded in two key principles:
- A consent requirement for the collection, use and disclosure of
personal information, subject to an exception for information that
is publicly available from specified sources (source-based
regulation).
- A general prohibition on the use of personal information, unless it is for "reasonable purposes" (purpose-based regulation). The Court described this dual framework of source-based and purpose-based regulation as a "belt and suspenders" approach to privacy protection.
The Court found Clearview's activities did not have a purpose that a reasonable person would consider appropriate. Justice Feasby clarified that under PIPA, "organizations may only collect and use personal information for purposes that a reasonable person would consider appropriate in the circumstances."
Clearview claimed that it had a legitimate law enforcement and investigative purpose for providing personal information to Albertan police services. However, the Court agreed with the Commissioner, that Albertans would not find this purpose reasonable, as Clearview is facilitating mass surveillance in the course of commercial activity.
The difference between Clearview and search engines was also highlighted, where the Court noted that search engines indexes content to improve general access to information, whereas Clearview's use supports biometric surveillance.
Key takeaways
The decision is a significant development in Canadian privacy law, particularly in the context of digital technologies and artificial intelligence.
In Alberta, organizations engaging in web scraping, AI model training, or other data-intensive practices must carefully assess both the source of any personal information and the purpose for its collection and use. While the Court broadened the interpretation of what may qualify as 'publicly available' information under PIPA, it emphasized that any collection, use, or disclosure without consent must still meet the standard of being reasonable in the circumstances.
Although Clearview was still required to stop offering its services in Alberta and delete all personal information collected from Albertans, the decision marks an important shift in how consent exceptions under PIPA may be interpreted.
It also signals the potential for constitutional scrutiny of similar consent frameworks in other jurisdictions, including under the federal PIPEDA and British Columbia's Personal Information Protection Act, which adopt comparable approaches to the 'publicly available' exemption.
Read the original article on GowlingWLG.com
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
