The Alberta Court of Kings Bench just released a bombshell decision in Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287. In short, it found that sections 12, 17, and 20 of the Personal Information Protection Act, (PIPA), unjustifiably infringed section 2(b) of the Canadian Charter of Rights and Freedoms. In so ruling, it essentially found that PIPA’s blanket restrictions against collecting publicly available information from the Internet without obtaining individuals’ consent were unconstitutional. The reasons for decision leave little doubt that, in the opinion of the court, search engines can harvest and use personal information that individuals make publicly available on the Internet about themselves without restrictions. The reasons also strongly suggest that companies that collect such personal information for training their AI systems could also do so lawfully under PIPA, and arguably as well under PIPEDA and other provincial privacy laws, as long as the collection and use is personal information a for a purpose individuals would view as reasonable.
The Clearview AI case is also significant because the court held that:
- PIPA applied to Clearview, even though its physical location was in the U.S., under the real and substantial connection test.
- Clearview did not have a reasonable purpose for collecting, using, and disclosing personal information and hence its practices violated PIPA.
For readers that do not know, Clearview is a US company that offers facial recognition software and database to customers. It’s database was built and continues to be updated and modified using billions of images taken from the internet including from websites in Alberta and from social media accounts of Albertans.
Clearview’s practice of “scraping” images from the internet was investigated by the privacy commissions of Alberta, British Columbia, Quebec, and Canada. A joint report of the privacy commissions issued on February 2, 2021 found that Clearview’s activities breached privacy statutes in each jurisdiction (the “Joint Report”) and the Alberta privacy commissioner ordered Clearview, among other things, to cease offering facial recognition services in Alberta and to stop collecting images from individuals in Alberta.
For some background and criticisms of the Joint Report, see the blog post by Barry Sookman, Dan Glover, Connor Bildfell, Exceptions from consent in PIPEDA: facial recognition, privacy and Clearview. For some background on Google’s dispute with the Federal Privacy Commissioner over a similar issue, see the blog post, Barry Sookman, Legality of search engines and AI systems under PIPEDA and CPPA: Google v Privacy Commissioner.
Here are some extracts from the decision dealing with the constitutional question.
The Constitutional Question
[85] The Amended Originating Notice requests the Court issue:A declaration that sections 12, 17, and 20 of the Personal Information Protection Act, SA 2003, c P-6.5 unjustifiably infringe section 2(b) of the Canadian Charter of Rights and Freedoms, Part I of the Constitution Act, 1982, being Schedule B to the Canada Act 1982 (UK), 1982, c 11.
Does PIPA Infringe Freedom of Expression?
[98] Clearview seeks a declaration that PIPA ss 12, 17, and 20 and PIPA Regulation s 7 are unconstitutional. Clearview submits that the consent requirement for gathering personal information in PIPA and the PIPA Regulation limits Clearview’s freedom of expression. The images and information that Clearview scrapes from the internet are the raw material upon which its technology is based. The images and information gathered by Clearview permit it to provide its service to customers. Accordingly, Clearview maintains that provision of its service to customers is expressive. [100] Does the constitutional protection for freedom of expression extend to automated processes like Clearview’s bot-driven gathering of images and information from the internet? Freedom of expression is, as Richard Moon puts it, a social right. He explains that “[f]reedom of expression is valuable because human agency and identity emerge in discourse – the joint activity of creating meaning”: Richard Moon, The Life and Death of Freedom of Expression, (Toronto: University of Toronto Press, 2024) at 3. [101] The parties agree that the correct test to apply to determine whether freedom of expression has been limited is found in Canadian Broadcasting Corp v Canada (Attorney General), 2011 SCC 2 at para 38:(1) Does the activity in question have expressive content, thereby bringing it, prima facie, within the scope of s 2(b) protection?
(2) Is the activity excluded from that protection as a result of either the location or method of expression?
(3) If the activity is protected, does an infringement of the protected right result from either the purpose or the effect of the government action?
[104] Clearview submits that its scraping activity is expressive because it facilitates the provision of its facial recognition services (i.e. information) to customers. Chief Justice McLachlin held in R v Sharpe, 2001 SCC 2 at para 25 that the possession of expressive material was protected by Charter s 2(b) because the possession of “expressive material is integrally related to the development of thought, belief, opinion and expression.” Thus, the possession of personal information including images is protected by Charter s 2(b). A logical extension of the principle in Sharpe is that information gathering activity that facilitates expression may be protected by Charter s 2(b). I agree with Clearview that scraping the internet with a bot to gather images and information may be protected by Charter s 2(b) when it is part of a process that leads to the conveyance of meaning. [108] I find that PIPA s 14(e) and PIPA Regulation s 7(e) limit Clearview’s freedom of expression.Is the Restriction of Freedom of Expression Justified?
The Value of Clearview’s Expression
[113] I approach the Charter s 1 analysis not from the starting point that Clearview’s expression is low value because it is commercial expression but from the perspective that proportionate regulation of commercial expression is often consistent with the character of commercial expression.What is the Restriction in Issue?
[120] … A party like Clearview and its counsel should be able to conclude that personal information publicly available on the internet does not fall within the meaning of “publicly available” by looking at PIPA and the PIPA Regulation and, accordingly, know that scraping images and information from social media is not covered by the exception to the requirement for consent.The Oakes Test
[121] The test to be applied to determine whether an infringement of a right is justified pursuant to Charter s 1 was set out in R v Oakes, 1986 CanLII 46 (SCC), [1986] 1 SCR 103 and modified in R v Dagenais, 1994 CanLII 39 (SCC), [1994] 3 SCR 835. The Court must determine whether:(1) the impugned provisions serve a pressing and substantial objective;
(2) they are rationally connected to that objective;
(3) they impair the right to freedom of expression no more than is necessary; and
(4) their beneficial effects outweigh their deleterious impact on the right in question.
[123] Clearview, following UFCW Local 401, concedes that PIPA and the PIPA Regulation address a pressing and substantial objective, providing individuals some control over their personal information, and that the means chosen (requiring consent for the collection, use, and disclosure of an individual’s personal information) are rationally connected to that objective: see UFCW Local 401 at paras 18-24. Clearview disputes that PIPA and the PIPA Regulation impair freedom of expression no more than necessary and assert that the deleterious impacts of PIPA and the PIPA Regulation outweigh the beneficial effects.Minimal Impairment and Overbreadth
[132] A difficulty with the PIPA consent requirement for personal information publicly available on the internet is that it applies equally to Clearview’s search technology used to create a facial recognition database and regular search engines that individuals use to access information on the internet. I find as a matter of fact based on the judicial review record and the Kyler Affidavit that regular search engines like Google collect, use, and disclose personal information that is publicly available on the internet. For the most part, people consider Google’s indexing of images and information to be beneficial. And certainly, Albertans use Google and similar search engines for expressive purposes. But according to my interpretation of PIPA and the PIPA Regulation and the Commissioner’s interpretation of those same instruments, Google and similar search engines cannot scrape the internet in Alberta for the purpose of building and maintaining an index of images of people without consent from every individual whose personal information is collected. [133] The Commissioner points out that website operators may take steps opt-out of Google indexing. This certainly distinguishes Google from Clearview which does not give website operators or others a choice to opt-out of the collection of images for its facial recognition database. But the fact that Google offers an opt-out from indexing does nothing to change my conclusion that Google’s activities (and those of similar search engines) are subject to the consent requirements of PIPA and the PIPA Regulation just like Clearview. [136] PIPA and the PIPA Regulation are overbroad because they limit valuable expressive activity like the operation of regular search engines. There is no justification for limiting use of publicly available personal information by regular search engines just as there was no justification to limit use of publicly available personal information for reasonable purposes by the union in UFCW Local 401. [137] Alberta has a pressing and substantial interest in protecting personal information where individuals post images and information to websites and social media platforms subject to terms of service that preserve a reasonable expectation of limited use. This pressing and substantial interest, however, does not extend to the operation of regular search engines. A reasonable person posting images and information to a website or social media platform subject to terms of service but without using privacy settings expects that such images and information will be indexed and retrieved by internet search engines; indeed, that is sometimes the point of posting images and information to the internet without using privacy settings. [138] The public availability exception to the consent requirement in PIPA and the PIPA Regulation is source-based, not purpose-based. Because it is source-based, it applies to regular internet search engines that scrape images and information from the internet like Clearview even if they use images and information for a different purpose. I find that PIPA and the PIPA Regulation are overbroad because the definition of “publication” in PIPA Regulation s 7(e) is confined to magazines, books, newspapers, and like media. Without a reasonable exception to the consent requirement for personal information made publicly available on the internet without use of privacy settings, internet search service providers are subject to a mandatory consent requirement when they collect, use, and disclose such personal information by indexing and delivering search results. There is no pressing and substantial justification for imposing a consent requirement on regular search engines from collecting, using, and disclosing unprotected personal information on the internet as part of their normal function of providing the valuable service of indexing the internet and providing search results.Salutary and Deleterious Effects
[142] The balancing exercise in the final proportionality analysis is concerned with measuring the public good of the restriction against the social cost of the restriction: R v KRJ, 2016 SCC 31 at para 77. I emphasize that in the context of a legislative scheme like PIPA which deploys both a belt and suspenders this analysis must evaluate the merit of the restriction in issue, not the value of the whole legislative scheme. It is a weighing of the ends of the restriction against the means used: Thomson Newspapers Co v Canada (Attorney General), 1998 CanLII 829 (SCC), [1998] 1 SCR 877. The inquiry is objective and is not concerned with the effect of the restriction on the claimant though the effect of the restriction on the claimant may illustrate the broader impact of the restriction. [143] The consent requirement in PIPA and the PIPA Regulation has salutary effects in that it provides individuals with control over their personal information, which is connected to, among other things, promotion of individual autonomy and dignity…. [144] On the other side of the ledger, the application of the consent requirement broadly to all bot-driven collection, use, and disclosure of personal information publicly available on the internet would have a significant deleterious effect on the operation of regular internet search engines. In turn, constraining the working of regular internet search engines would undermine an essential resource that Albertans use for expression. I take judicial notice of the fact that search engines like Google are an important (and perhaps the most important) way individuals access information on the internet. A law that curtails the ability of a search engine like Google to index images and information on the internet through the imposition of a consent requirement would have a significant deleterious effect on expression. [146] I find that the salutary effects of PIPA Regulation s 7(e) are outweighed by the deleterious effects.Conclusion on Constitutionality of PIPAand the PIPA Regulation
[149] I conclude that the appropriate remedy is to strike the words “including, but not limited to, magazines, books, and newspapers”. This leaves the word “publication” to take its ordinary meaning which I characterize as “something that has been intentionally made public.”[2] Personal information and images posted to the internet without being subject to privacy settings are publications and use of such personal information and images is not subject to a consent requirement. This remedy does the least damage to the legislature’s intent. And, of course, because the provision is in a regulation, it is easy to amend if this decision necessitates other changes or if what remains of PIPA Regulation s 7(e) is not consistent with the government’s preferences.
