In May 2025, the Court of King’s Bench of Alberta released its judgement on the judicial review of a decision of the Information and Privacy Commissioner of Alberta.
The judgment was significant and signals (i) the legitimization of data scraping and AI model training from publicly available information on the internet and potential protection of these types of automated processes under the Canadian Charter of Rights and Freedoms, (ii) the applicability of Canadian provincial privacy laws to foreign organizations, and (iii) that Canadian privacy law reform is likely on the horizon.
As we note below, this bulletin builds upon our recent case comment on the British Columbia Supreme Court’s decision in Clearview AI Inc v Information and Privacy Commissioner for British Columbia, 2024 BCSC 2311 (the BC Clearview Decision (2024)).
It will also be interesting to see the impact (if any) of these decisions on the Canadian privacy commissioners' ongoing investigation into OpenAI’s ChatGPT. As of the date of this bulletin, the Canadian privacy commissioners’ report of findings on their investigation has not been published.
Background
Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287 (the Decision) is the latest Canadian case arising from Clearview AI Inc.’s (Clearview) facial recognition tool. Clearview provides facial recognition services to third parties, including law enforcement and private sector entities. Its facial recognition tool was developed through the “scraping” of billions of images and information – including personal information from individuals in Canada – from publicly available online sources such as social media platforms.
The facial recognition tool allows customers to search and match faces to billions of facial images contained in Clearview’s biometric database. This has come under tremendous scrutiny over recent years by privacy regulators globally (see technology author and journalist Kashmir Hill’s Your Face Belongs to Us for further reading on the rise of Clearview).
In February 2021, the Information and Privacy Commissioner of Alberta (the Commissioner), the Office of the Privacy Commissioner of Canada, and other privacy commissioners in British Columbia and Québec, concluded a joint investigation into Clearview and published a report that held that Clearview had contravened federal and provincial Canadian privacy laws. The joint investigation and report focused on issues of consent and whether Clearview’s collection, use and disclosure of personal information was for a reasonable purpose.
In December 2021, the Commissioner ordered that Clearview:
(i) cease offering its facial recognition tool to clients in Alberta,
(ii) cease collecting, using and disclosing certain personal information (e.g., images and biometric data) collected from individuals in Alberta, and
(iii) delete certain personal information collected from individuals in Alberta in its possession
(the Order).1
Clearview brought an application to judicially review the Order and to challenge the constitutionality of certain aspects of Alberta’s Personal Information Protection Act (AB PIPA) and its regulations (the Regulation) on the grounds that the Commissioner’s interpretation infringed its freedom of expression under the Canadian Charter of Rights and Freedoms (the Charter).
The Decision comes shortly after the British Columbia Supreme Court concluded its judicial review of a similar order in the BC Clearview Decision (2024), published in late 2024. In that judgement, the Court dismissed Clearview’s application for judicial review and upheld the Office of the Information and Privacy Commissioner of British Columbia’s order. Notably, while the British Columbia Supreme Court considered the issues of what constitutes "publicly available" information and whether Clearview was subject to provincial privacy legislation, it declined to exercise its discretion to permit Clearview to raise its Charter values arguments afresh in that case.2 Please see BLG bulletin "The extraterritorial reach of B.C.’s privacy laws: Court upholds privacy commissioner’s order against foreign AI company" for further information on that decision.
The Court’s decision
Application of AB PIPA to Clearview
The Court considered the jurisdictional question of whether AB PIPA applied to Clearview. Clearview, a U.S.-based company, submitted that it was not subject to AB PIPA. While Clearview had made submissions on the locations of the relevant servers (namely, that they were outside of Alberta), the key question for the Court was whether the organization was subject to the jurisdiction of Alberta, not whether the collection, use and disclosure of personal information occurred within or outside of Alberta.
The Court summarized that: "conducting business in a province by offering a product or service to its residents constitutes a "sufficient connection" to justify regulation of the person or entity offering the product or service."3 The Court used this as the guiding principle to answering the jurisdictional question.
Similar to the British Columbia Supreme Court’s determination in the BC Clearview Decision (2024), the Court determined that Clearview carried on business in Alberta and therefore there was a "sufficient connection" to justify the regulation of Clearview by AB PIPA. In coming to this conclusion, the Court considered the following factors: Clearview had marketed its services to Alberta organizations and Alberta organizations had used its services. It was not relevant to the Court’s conclusion that Clearview had ceased marketing its services to Alberta organizations in July 2020, as in the Court’s view, this was likely due to the joint investigation by the privacy commissioners.
The Court noted that:
"Strict adherence to the traditional territorial conception of jurisdiction would make protecting privacy interests impossible when information may be located everywhere and nowhere at once […] The importance of the interest being protected by PIPA, together with the challenges to regulation posed by the interjurisdictional nature of the internet weighs in favour of an approach to jurisdiction that facilitates, not frustrates, regulation in the public interest."4
Consent exception for "publicly available" personal information
The Court then considered the question of whether the Commissioner’s interpretation of the phrase "publicly available" in AB PIPA and the Regulation was reasonable.
Under AB PIPA, an organization may collect personal information about an individual without that individual’s consent if the information is "publicly available".5 "Publicly available" is defined in the Regulation to mean:
"the personal information is contained in a publication, including, but not limited to, a magazine, book or newspaper, whether in printed or electronic form, but only if
(i) the publication is available to the public, and
(ii) it is reasonable to assume that the individual that the information is about provided that information".6
The Commissioner had determined that certain personal information (e.g., images, other information) on websites and on social media platforms were not "publicly available" for the purposes of the consent exception in AB PIPA. Clearview argued that personal information from these types of sources should be considered “publicly available” information, such that consent would not be required for its collection.
The Court found that the Commissioner’s interpretation of "publicly available" – which was largely based on interpreting rights under AB PIPA as broad, and restrictions on those rights as narrow – was reasonable. Like in the BC Clearview Decision (2024), the Court recognized the quasi-constitutional interest in protecting privacy and accepted the Commissioner’s reasoning that any exceptions to this important right ought to be narrowly interpreted.
Freedom of expression
Based on the Commissioner’s interpretation of AB PIPA (which the Court found to be a reasonable interpretation), the Court surmised that any organization that intended to collect, use or disclose personal information that is publicly available on the internet, for reasonable purposes, could not do so, without first obtaining consent. The Court explained that where consent is impractical, the outcome is constitutionally problematic.
Clearview AI argued that the Commissioner’s interpretation of AB PIPA infringed their freedom of expression, as the provision of their services, which was based on their facial recognition tool, was expressive.
The Court highlighted that the consent exception in AB PIPA is "source-based" not "purpose-based". Despite the non-exhaustive language used in the "publicly available" exception to consent, the Court held that personal information publicly available on the internet is dissimilar enough from the publications listed in the Regulation (i.e., magazines, books and newspapers) such that the consent exception does not extend to it.
Based on this interpretation of AB PIPA, the Court agreed with Clearview that AB PIPA and the Regulation limited Clearview’s freedom of expression. Further, there was no justification for imposing a blanket consent requirement to the collection, use and disclosure of personal information publicly available on the internet without privacy settings. An example that the Court gave of a reasonable purpose for the collection, use and disclosure of this type of publicly available information was by search engines for the purpose of indexing and providing search results.
The Court highlighted that the "publicly available" exception to consent had not been amended since its adoption in 2003 and that the exception was "notable for how it fails to grapple with the challenges to privacy posed by the internet with any sensitivity to how the internet works".7
Although the Court acknowledged that Alberta likely has a legitimate interest in protecting personal information from being used in a facial recognition database like Clearview’s (due to the potential harms to individuals’ privacy), the Court concluded that AB PIPA and the Regulation are overbroad, because they restrict other expression for which there is no such justification (e.g., regular search engines).
The Court’s remedy was to amend the definition of "publication" in the Regulation so that it is not limited to magazines, books, newspapers and similar media. The Court explained that this change would result in the "publicly available" exception taking on the ordinary meaning of the word "publication" as something "intentionally made public."8 The Court ordered that the words "including, but not limited to, a magazine, book or newspaper" under section 7(e) of the Regulation be struck.
What’s next?
A court’s finding that a legislative provision should be struck on the basis of unconstitutionality renders that provision invalid and of no force or effect. The legislature may respond in a variety of ways, including by taking steps to amend the legislation or referring the question of the provision’s constitutionality to an appellate court.
For example, in Alberta (Information and Privacy Commissioner) v United Food and Commercial Workers, Local 401, 2013 SCC 62 (Local 401), the Supreme Court of Canada held that AB PIPA unjustifiably infringed a union’s freedom of expression as there was no consent exception for labour relations purposes. The Court struck down AB PIPA in its entirety but suspended its declaration of invalidity for a 12-month period to allow the Alberta Legislature time to decide how to amend AB PIPA (ultimately, the Legislature amended the consent exceptions of AB PIPA to allow a trade union to collect, use and disclose personal information without consent for certain purposes in connection with labour relations disputes9).
As of the date of this bulletin, it is unconfirmed whether the Legislature appealed the Court's constitutional finding in this case. The Legislature may alternatively amend the Regulation as part of Legislature’s current efforts to reform AB PIPA. In February 2025, a special committee of the Alberta Legislative Assembly published its Final Report – Review of the Personal Information Protection Act, which outlined a number of recommendations to modernize the province’s private sector privacy legislation, AB PIPA. In December 2024, the Alberta Legislature passed significant changes to access and privacy legislation applicable to public bodies. Please see BLG bulletin "Alberta overhauls its public sector access and privacy regime" for further information on those changes.
Key takeaways
1. AB PIPA applies to out-of-province organizations that have a "real and substantial" connection to Alberta
- In determining whether an organization is subject to the jurisdiction of AB PIPA, one ought to look at whether the organization conducts business in Alberta, for example, by offering products or services to Alberta residents.
- It is less relevant whether the collection, use or disclosure of personal information actually occurred within Alberta. As the Court noted, "Clearview’s focus on where personal information is collected from [was] misplaced."10
2. Automated processes may be protected by freedom of expression
- While the Decision suggests that automated processes (including those involving bots) might be protected by freedom of expression if they are part of processes that lead to conveying meaning, businesses should not view the Decision as providing free reign to scrape publicly posted information.
- Because the Decision breaks with the approach taken by the British Columbia Supreme Court and other privacy regulatory guidance, any pan-Canadian online data scraping or collection strategy must still adhere to the limitations set out under other Canadian jurisdictions. Further, many uses of publicly available information will still be restricted as a result of the requirement that any collection, use or disclosure of personal information must be for a purpose that a reasonable person would consider appropriate in the circumstances.
- Canadian privacy regulators and courts will likely continue to scrutinize any activities involving indiscriminate scraping of information over the internet, particularly when it comes to images collected for mass surveillance purposes.
3. Consent exception for "publicly available" personal information in AB PIPA is unconstitutionally narrow
- Based on AB PIPA as it currently stands, the collection, use and disclosure of personal information that is publicly available online is subject to a mandatory consent requirement. This includes the handling of personal information by search engines via indexing and providing search results, even though these types of activities are expected by a reasonable person who posts information and images to websites and social media platforms without using privacy settings. The Court held that this is unconstitutional.
- Accordingly, there may be a broadening of the source-based exception to consent under AB PIPA and it may be permissible to collect, use and disclose personal information publicly available on the internet without the use of privacy settings without consent. In particular, the Decision suggests that courts may be less concerned with collection, use and disclosure of this type of personal information by search engines for the purposes of indexing and providing search results.
- However, organizations should keep in mind that some of the reasoning in the Decision stands somewhat in contrast to recent judicial interpretations of the "purpose" clause contained under Canadian privacy statutes, such as the Federal Court of Appeal’s decision in Canada (Privacy Commissioner) v Facebook, Inc, 2024 FCA 140 (leave on appeal to the Supreme Court of Canada granted). In that case, the Federal Court of Appeal reframed the often-cited interpretation of the "purpose" clause, stating that the appropriate balancing of the legislation ought to be between an individual’s right to privacy and an organization’s need for information, rather than balancing two competing interests between individuals and organizations. On the other hand, the Court in the Decision seemingly puts these interests on almost equal footing, and notes that there is no justification for imposing a consent requirement on regular search engines that handle unprotected personal information on the internet as part of their normal function of providing a valuable service.11
- It is possible that courts may take a similar approach for model training by AI companies and other data scraping activities. It will be interesting to see how the Decision impacts the Canadian privacy commissioners’ ongoing investigation into OpenAI’s ChatGPT, which will consider whether OpenAI obtained valid and meaningful consent to the collection, use and disclosure of personal information of individuals in Canada via ChatGPT.12
- Nevertheless, organizations must still ensure that their collection, use and disclosure of personal information is only for purposes that are reasonable. Notably, despite finding that AB PIPA was unconstitutional, the Court upheld the conclusions in the joint report that Clearview’s purposes for collecting, using and disclosing personal information were not reasonable.
The authors would like to thank Lauren Ziemer for her contributions to this bulletin.
