Court of King’s Bench of Alberta Strikes Provisions of PIPA for Unconstitutionality

In a May 8, 2025 decision[1], Justice Colin C. J. Feasby of the Court of King’s Bench of Alberta considered whether Alberta’s privacy regulatory regime could limit Clearview AI Inc (“Clearview”), a US company, from collecting images of Albertans for use in facial recognition software marketed to law enforcement agencies. While the Court ultimately determined that in some circumstances such limitations are proper, it also held that certain provisions of the privacy regulatory regime unconstitutionally limit the freedom of expression guaranteed by section 2(b) of the Charter. This decision clarifies the rights of organizations, including search engine providers, to collect, use and disclose personal information gathered from the internet for reasonable purposes.

Background

Clearview AI Inc.

Clearview offers facial recognition software to its clients, including law enforcement agencies.[2] Clearview’s facial recognition tool “scrapes” personal information, including photos of faces, from social media and other publicly available online sources to create a database. Clearview’s clients can upload an image which is matched to images in the database. The client then receives a list of results and can click through to the original source of any matched images.[3]

The Joint Report

In February 2020, the privacy commissioners of Alberta (the “Alberta Commissioner”), British Columbia[4], Quebec, and Canada commenced a joint investigation of Clearview which found that “Clearview’s activities were conducted without the consent of the subjects of the images”.[5] In their joint report, the privacy commissioners also found that the images caused two types of harms: (i) “false or misapplied searches [which] could result in reputational damage”; and (ii) “harm inflicted on all members of society, who find themselves under continual mass surveillance by Clearview based on its indiscriminate scraping and processing of their facial images.”[6]

On the basis of the joint report, the Alberta Commissioner ordered Clearview to:[7]

1. cease offering its facial recognition tool to clients in Alberta;
2. cease the collection, use and disclosure of images and biometric facial arrays collected from individuals in Alberta; and
3. delete images and biometric facial arrays collected from individuals in Alberta in its possession.

(the “Order”)

Alberta’s Privacy Regime

As described by the Court, Alberta’s privacy regime takes a “belt and suspenders” approach to the protection of personal information through a two-pronged regulatory scheme.[8]

First, section 7 of the Personal Information Protection Act[9] requires an individual to consent to the collection, use and disclosure of their personal information, unless an exception applies.[10] Clearview relied on the exception in sections 14(e), 17(e), and 20(j) of PIPA which together allow for collection, use and disclosure of personal information “if the information is publicly available as prescribed or otherwise determined by the regulations”. Section 7 of the Personal Information Protection Act Regulation,[11] the key legislative provision in the decision, states in part that:

For the purposes of sections 14(e), 17(e) and 20(j) of the Act, personal information does not come within the meaning of “the information is publicly available” except in the following circumstances: […] (e) the personal information is contained in a publication, including, but not limited to, a magazine, book or newspaper, whether in printed or electronic form, but only if i. the publication is available to the public, and ii. it is reasonable to assume that the individual that the information is about provided that information […]

Second, sections 11, 16, and 19 of PIPA require that the collection, use and disclosure of personal information be for “purposes that are reasonable”. Section 2 of PIPA applies a standard of “what a reasonable person would consider appropriate in the circumstances” to determine whether a purpose is reasonable.[12]

The Decision

PIPA applies to Clearview.

Notwithstanding Clearview had ceased carrying on business in Alberta around July 2020 (in the midst of the joint investigation), the Court held that the Alberta Commissioner “has jurisdiction over Clearview because Clearview chose to do business in Alberta and collects, uses, and discloses personal information of Albertans, some of which is hosted on websites with servers in Alberta.”[13] The Court also noted that “[t]he rule of law would not mean much if a party subject to an investigation could escape the consequences of that investigation by leaving the jurisdiction.”[14]

The Alberta Commissioner’s interpretation of “publicly available” was reasonable

The Alberta Commissioner interpreted the “publicly available” exception in section 7(e) of the PIPA Regulation narrowly so as to not include social media. The Court held that such a narrow exception was reasonable because:[15]

the right to privacy is a quasi-constitutional right and the purpose of the PIPA regime is, as the Alberta Commissioner argued, “to balance the right of individuals to privacy of their personal information against the needs of the businesses and other organizations to use personal information” [emphasis in original]; and

the words “including, but not limited to, a magazine, book or newspaper” can be interpreted using the ejusdem generis[16] principle to limit publicly available “publications” to only those in the same class as magazines, books or newspapers (i.e., publications that are generally subject to editorial control and sold to the public).

The Alberta Commissioner’s interpretation of PIPA unreasonably infringes the freedom of expression

The Court found that Clearview’s activity of scraping images and information from the internet using a bot did not constitute “expressive activity” entitled to protection under section 2(b) on its own, as that activity does not express anything. However, when that activity, and the information gathered by it, is paired with the development of facial recognition services marketed by Clearview and used by its clients, such collective activity becomes expression protected by section 2(b).[17]

As the Alberta Commissioner’s interpretation of PIPA and the PIPA Regulation was found to be reasonable and prevented Clearview from engaging in developing its facial recognition tool, the Court held that PIPA limits Clearview’s section 2(b) rights.[18]

Under the Oakes test for determining whether the limitation is reasonable and saved under section 1 of the Charter, Clearview conceded that PIPA is rationally connected to a pressing a substantial objective: providing individuals some control over their personal information.[19]

However, the Court determined that PIPA’s restrictions would apply beyond Clearview and also apply to search engines, such as Google, which collect, use and disclose publicly available personal information from the internet to provide a beneficial service to the general public.[20] Such an application of PIPA to search engines, and the potential impact of it on the important service search engines provide, led the Court to hold that the restrictions were overbroad, not minimally impairing and their deleterious effects outweighed their salutary effects. Therefore, PIPA and the PIPA Regulation’s limitation on Clearview’s activities, as interpreted by the Alberta Commission, were not saved under section 1.

The remedy for the unconstitutionality was to strike a portion of section 7(e) of the PIPA Regulation

Notably, the Court stated that: “The root cause of the conflict between the PIPA consent requirement and the operation of internet search engines is that the list of sources exempt from the consent requirement in PIPA Regulation s 7 has not been amended since it was adopted in 2003.”[21]

Because the PIPA Regulation was adopted in 2003, it could not have contemplated the “publicly available” nature of the internet and social media that exists today. The Court determined that the appropriate remedy was to strike the words “including, but not limited to, a magazine, book or newspapers,” from section 7(e) – thereby broadening the publicly available exception to include the ordinary meaning of “publication,” which also includes social media.[22]

The Alberta Commissioner reasonably found that Clearview’s purpose was not reasonable

Despite Clearview’s collection of personal information fitting within the newly broadened publicly available exception, PIPA still requires Clearview’s activities to be for a reasonable purpose. Clearview argued that its purpose was “to provide a service to law enforcement agencies who, by the terms of service, were only allowed to use Clearview’s service for ‘legitimate law enforcement and investigative purposes’”.[23] The Alberta Commissioner, relying on the findings in the joint report, framed Clearview’s purpose as the “identification and surveillance of individuals by a private entity in the course of commercial activity.”[24]

The Court accepted the purpose as framed by the Alberta Commissioner and found it not to be reasonable because Clearview’s activities: [25]

involved the mass and indiscriminate scraping of images of millions of individuals including children;

were unrelated to the purposes for which the images were originally posted (i.e., social media or professional networking); and

created a risk of significant harm to individuals including reputational harm from misidentification or potential data breaches.

The Order is enforceable

Clearview also argued that the Order should not be enforceable because it is incapable of execution.[26] Clearview submitted that because its technology was not capable of identifying which of its scraped images related to individuals in Alberta, it could not fulfill the terms of the Order and therefore the Order could not be executed. The Court roundly rejected this argument: “The fact that Clearview runs its business in such a way that it cannot comply with the Order is not an excuse for non-compliance.”[27]

Key Takeaways

This decision clarifies the right of organizations and search engine providers to collect, use and disclose personal information that individuals have made publicly available about themselves on the internet.

However, anyone seeking to collect, use and disclose personal information collected from publicly available internet content should consider the following important caveats:

• Any collection, use and disclosure of personal information must still be for a reasonable purpose (i.e., providing general information services may be a reasonable purpose but undertaking mass surveillance of the public is not).
• Be aware of the terms of use of various websites and social media platforms as those terms may impose restrictions on what methods are appropriate for collecting personal information.
• Keep your data organized in a way that allows you to identify where personal information comes from and how it was collected.

Lastly, we anticipate that this decision may spur the Government of Alberta to revise or amend PIPA and the PIPA Regulation, especially with respect to its application to social media. As the Court noted, the relevant PIPA and PIPA Regulation provisions had not been amended since they were adopted in 2003 – long before Facebook, Instagram, Twitter/X, and YouTube were created. Developments in this area should be closely monitored, including as any proposed legislative amendments may invite opportunity for industry engagement and comment.

McCarthy Tétrault brings multidisciplinary expertise to privacy matters. Our Cyber/Data Group brings a cross-practice and national presence to the complexity of data and technology law, and our White Collar Defense and Investigations Group assists companies and individuals in responding to regulatory and criminal risks associated with technology, privacy and other matters. Additionally, our National Appellate Litigation Group regularly represents appellants and respondents in appellate courts across the country, including in privacy matters.

If you have questions about any of these practice areas, please contact the authors of this blog.

[1] Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287 (“Clearview”).

[2] Clearview at paras 1-2.

[3] Clearview at para 14.

[4] The privacy commissioner of British Columbia’s order was challenged in a separate decision Clearview AI Inc v Information and Privacy Commissioner for British Columbia, 2024 BCSC 2311. The Court relied on portions of the British Columbia decision as persuasive reasons on issues common to both cases.

[5] Clearview at para 16.

[6] Clearview at para 16.

[7] Clearview at para 16.

[8] Clearview at para 7.

[9] Personal Information Protection Act, SA 2003 c P-6.5 (“PIPA”).

[10] Clearview at paras 9-11.

[11] Personal Information Protection Act Regulation, Alta Reg 366/2003 (the “PIPA Regulation”).

[12] Clearview at para 12.

[13] Clearview at para 61.

[14] Clearview at para 55.

[15] Clearview at paras 80 and 82.

[16] Ejusdem generis, or the limited class rule, is a maxim of statutory interpretation whereby “when one finds a clause that sets out a list of specific words followed by a general term, it will normally be appropriate to limit the general term to the genus of the narrow enumeration that precedes it.” (National Bank of Greece (Canada) v Katsikonouris, 1990 CanLII 92 (SCC) at 203). In this case, the specific words or the narrow enumeration is “a magazine, book or newspaper” and the general term is the phrase “including, but not limited to”. By the limited class rule and per the Court, anything “contained in a publication” that belonged to the same class as magazines, books or newspapers would satisfy the section 7(e) “publicly available” exception to the consent requirement.

[17] Clearview at paras 103-104.

[18] Clearview at para 108.

[19] Clearview at para 123.

[20] Clearview at para 132.

[21] Clearview at para 147.

[22] Clearview at para 149.

[23] Clearview at para 151.

[24] Clearview at para 152.

[25] Clearview at para 154.

[26] Clearview at para 174.

[27] Clearview at para 177.