In a ruling with wide-ranging implications for privacy law in Canada, the Alberta Court of King’s Bench has declared parts of Alberta’s private-sector privacy legislation unconstitutional in Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287. While the Court ultimately upheld the enforcement action taken against Clearview AI, its constitutional findings mark a significant shift in how online personal information is regulated.
What happened in Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287?
Clearview AI is a U.S.-based company whose technology scrapes billions of publicly accessible images from across the internet, including social media platforms, and uses them to build a facial recognition database. This database was marketed to law enforcement agencies, including several in Canada.
In 2021, Alberta’s Information and Privacy Commissioner (OIPC), along with counterparts in BC, Quebec, and at the federal level, issued a joint report concluding that Clearview’s collection, use, and disclosure of biometric data violated various privacy laws. Alberta’s OIPC then ordered Clearview to cease operations in the province and delete data collected from Albertans.
Clearview sought judicial review of the order, arguing that it was unconstitutional and that the OIPC had adopted an unreasonable interpretation of the Personal Information Protection Act (PIPA) and its regulations.
The Decision
The Court found a “real and substantial connection” between Clearview and Alberta (at paras 44 & 63). Since Clearview had marketed its services to Alberta police and scraped data from Albertans, Alberta’s privacy laws could validly apply, even to a U.S.-based company (at para 54).
The OIPC’s interpretation of the term “publicly available” under PIPA was held to be reasonable. The Court accepted that social media content, despite being viewable online, does not automatically qualify for the consent exemption unless it fits the prescribed regulatory criteria. While the term “publication” in section 7(e) of the PIPA Regulation might on its face appear to include online posts, the Court accepted the Commissioner’s view that the Regulation was intended to apply only to formal, curated publications such as newspapers and magazines, not to user-generated social media content (at paras 72 & 83)
However, the Court agreed with Clearview that this interpretation raised constitutional concerns. The requirement to obtain consent, even for publicly accessible online information, was found to infringe Clearview’s freedom of expression under section 2(b) of the Charter (at para 104). The Court noted that the consent requirement, when applied to vast amounts of internet-based data, created a blanket restriction on expression that could not be practically complied with (at paras 132-135). This amounted to a complete prohibition on certain expressive activity, particularly for organizations that rely on publicly available data to develop search tools, AI models, or similar technologies.
As a remedy, the Court struck down the words “including, but not limited to, magazines, books, and newspapers” from section 7(e) of the Regulation, allowing the term “publication” to take on its ordinary meaning, i.e., any material intentionally made public (para 148).
However, Clearview ultimately failed in its application to quash the Commissioner’s order. The Court upheld the Commissioner’s finding that Clearview’s purpose for collecting and using the data, namely mass surveillance for commercial gain, was not “reasonable” under sections 11, 16, and 19 of PIPA (at paras 150, 154, & 163-164). The Court emphasized that purpose matters. Even though search engines like Google also collect similar information, their purposes differ significantly. The Court declined to extend its Charter finding to shield Clearview’s specific business model (paras 132–146).
Takeaways
- Even with the unconstitutionality of the “publicly available” exception, organizations must still ensure that their purpose for collecting data is reasonable.
- The Court acknowledged that bot-driven internet activities, like those used by search engines, can be expressive and should not be unduly burdened by impractical consent requirements.
- Alberta’s government will likely revisit PIPA and its regulations in light of the Court’s findings. The decision may also influence future amendments to federal and BC privacy laws.
- While the Court struck down the law’s overbreadth, it reaffirmed that organizations can still be prohibited from using personal information for purposes deemed unreasonable, particularly where serious privacy harms are at stake.
Looking Ahead
This decision marks a turning point in Canadian privacy law in the new age of AI technology. It acknowledges the realities of modern digital communication while reasserting the fundamental importance of individual privacy. The ruling will likely prompt legislative reform in Alberta and may inspire constitutional challenges elsewhere.
But Clearview’s loss is a cautionary tale. Courts are increasingly willing to protect freedom of expression in the digital realm, but they are equally willing to scrutinize how that freedom is exercised. Businesses building AI-driven tools or relying on web scraping would be wise to re-examine both the sources of their data and the reasons they use it.
Note: This article provides general commentary and is in no way intended to replace the need to consult with a legal professional concerning the specific circumstances of your situation. This article should not be construed or relied upon as legal advice.
