Publication

Alberta Privacy Law Unconstitutional: Key Implications

Published:

June 23, 2025

Author(s):

• David Fraser

Share

Print

On May 8, 2025, the Alberta Court of King’s Bench declared a key portion of Alberta’s Personal Information Protection Act (aka PIPA) unconstitutional. While the decision in Clearview AI Inc. v. Alberta (Information and Privacy Commissioner) addresses only Alberta’s privacy legislation, it’s of note across Canada:

PIPEDA & AI. Though it’s not binding on the Federal Privacy Commissioner (and we think the Alberta Privacy and Information Commissioner will likely appeal it), it’s a pretty strong support for the proposition that the federal Personal Information Protection and Electronic Documents Act (PIPEDA) “publicly available” information exception is also unconstitutional. And this, in turn, has implications for “the right to be forgotten” and for collecting data for training AI models – both of which are currently before the Federal Privacy Commissioner.

Charter Concerns. The Court clearly wanted to address the Canadian Charter of Rights and Freedoms issues the case raised. It didn’t really need to do so. The Alberta Information and Privacy Commissioner, whose decision the Court was reviewing, found that Clearview’s purposes were not reasonable – a necessary hurdle for a company to even collect, use or disclose personal information. The Court agreed and could have just said “not reasonable”; follow the Commissioner’s order. But the Court delved into the Charter question as well. In fact, this is the second time a court has declared PIPA violates the Charter based on finding the definition of “publicly available information” in PIPA and the PIPA Regulations as being too narrow: the Supreme Court of Canada did so in its 2013 decision in Alberta (Information and Privacy Commissioner) v. United Food and Commercial Workers, Local 401 when PIPA was applied to video recording by a union at a picket line.

Multi-Jurisdictional Litigation Clearview AI also sought judicial review of the Order of British Columbia’s Information and Privacy Commissioner that arose from the Joint Investigation by the B.C., Alberta, Quebec and Federal Commissioners, and which also led to the Alberta litigation. In its December 2024 decision in Clearview AI Inc. v. Information and Privacy Commissioner for British Columbia, the Supreme Court of British Columbia upheld the B.C. Commissioner’s order. It’s not yet clear whether Clearview will appeal this decision. In it, Clearview did not pursue the Charter arguments and the Court found the Commissioner’s Order to be reasonable. Clearview AI Inc. has also appealed the Quebec Commissioner’s order and the matter is pending before the courts of that province.

At the end of the day, the decision stands for the proposition that Alberta’s privacy law (and likely that of British Columbia and the federal statute) unconstitutionally infringes the Canadian Charter of Rights and Freedoms’ section 2(b) right to freedom of expression by requiring consent for collecting information off the public internet for legitimate purposes that serve the public interest. It’s clear the Court found web search to be such a purpose. The reasoning will likely be used in future cases to argue for a similar ability to collect data from the open internet for training artificial intelligence systems.

Here’s a look at the Court’s decision in Clearview AI Inc. v. Alberta (Information and Privacy Commissioner) and why it found PIPA violates section 2(b) of the Charter.

The Case

Clearview AI Inc.is a U.S.-based facial recognition company that has been the subject of many privacy investigations around the world. It collects facial images from publicly accessible websites, including social media, and use them to create a biometric facial recognition database that it markets primarily to law enforcement. In 2020, privacy commissioners from Alberta, B.C., Quebec, and Canada investigated Clearview’s operations and concluded in a joint report that its practices violated their respective privacy laws. On this basis, in December 2021, Alberta’s Information and Privacy Commissioner issued an order requiring Clearview to cease offering services in Alberta, stop collecting, using, and disclosing images and biometric data of Albertans, and delete the relevant data already in its possession. The Commissioner essentially said that Clearview must do for Alberta what it agreed to do in setting a lawsuit in Illinois (which is notorious for its biometric laws). Clearview sought judicial review of the order on several grounds, including that:

• Clearview’s not subject to Alberta’s jurisdiction and PIPA doesn’t apply to Clearview.
• The Alberta Commissioner adopted an unreasonable interpretation of the words “publicly available” in PIPA and the PIPA Regulation and the Commissioner’s finding that Clearview did not have a reasonable purpose for collecting, using, and disclosing personal information is unreasonable.
• The Commissioner’s interpretation of PIPA and the PIPA Regulation related to publicly available information is contrary to section 2(b) of the Canadian Charter of Rights & Freedoms’ guarantee of freedom of expression and is therefore unconstitutional.

The Court sided with the Commissioner on the jurisdictional and reasonable purposes arguments – but with Clearview on the Charter issue.

Jurisdiction

The Court upheld the Commissioner’s jurisdiction, finding a “real and substantial connection” between Clearview’s activities and Alberta. Clearview had marketed its services in Alberta and its database included images of Albertans. The bar for jurisdiction in Canada is pretty low.

Reasonable Purposes 

The Court accepted as reasonable the Commissioner’s interpretation that images scraped from the internet, including social media, are not “publicly available” within the meaning of the PIPA Regulation. The Commissioner employed a purposive approach, interpreting the relevant provisions narrowly in light of the quasi-constitutional status of privacy rights. PIPA, like other privacy regulatory regimes in Canada, provides that consent must be obtained to collect and use “personal information” unless certain exceptions apply. One of PIPA’s exceptions is that the information is “publicly available.” The definition for “publicly available” is in section 7(e) of the PIPA Regulation:

… personal information does not come within the meaning of … “the information is publicly available” except in the following circumstances: … (e) the personal information is contained in a publication, including, but not limited to, a magazine, book or newspaper, whether in printed or electronic form, but only if (i) the publication is available to the public, and (ii) it is reasonable to assume that the individual that the information is about provided that information.

The private sector privacy laws of Alberta, British Columbia and federally have similar, but not identical, definitions of “publicly available” information for which collection and use does not require consent. There are other categories, but this decision turned on information in a publication. Here are the three definitions:

Alberta. Alberta’s definition states, “the personal information is contained in a publication, including … but not limited to … a magazine, book or newspaper, whether in printed or electronic form, but only if (i) the publication is available to the public, and (ii) it is reasonable to assume that the individual that the information is about provided that information.”

B.C. The B.C. definition does not use “including but not limited to”; it states, “personal information that appears in a printed or electronic publication that is available to the public, including a magazine, book or newspaper in printed or electronic form.”

Federal. Under PIPEDA’s regulation, the analogous provision reads, “personal information that appears in a publication, including a magazine, book or newspaper, in printed or electronic form, that is available to the public, where the individual has provided the information.”

Canadian privacy regulators have interpreted “publication” to exclude social media sites like Facebook and LinkedIn, where Clearview harvests much of its information. The Court found the Commissioner’s analysis and characterization of Clearview’s purposes reflected “a coherent and rational chain of analysis”. And the Court could have ended matters there – but decided to address Clearview’s Charter argument.

Charter Breach

Clearview argued the Commissioner’s narrow definition of “publicly available information” was unconstitutional. The Court agreed and found sections 12, 17 and 20 of PIPA and section 7 of its Regulation infringed the Charter’s section 2(b) right to freedom of expression and could not be saved as a reasonable limitation under section 1 of the Charter, to the extent that they prohibited the use of publicly available internet data for reasonable purposes.

Infringed Freedom of Expression. The Alberta Commissioner (rather surprisingly) argued that even if Clearview’s activities were “expressive”, the Charter wasn’t even engaged because “the method – mass surveillance – conflicts with the underlying s 2(b) values … including the pursuit of truth, participation in the community, self-fulfillment, and human flourishing.” Noting there was no authority to support the “proposition expressive activity could be excluded from protection based on a conflict with underlying constitutional values. Short of violence, all expressive activity is protected by Charter s 2(b)”, the Court disagreed. The Court concluded Clearview’s activities (compiling and using data to deliver a service) were expressive. PIPA’s consent requirement effectively operated as a prohibition on expression where obtaining consent was impractical, and this amounted to a prima facie infringement of section 2(b).

Not Saved By Section 1. Once a party proves a prima facie Charter infringement, the burden shifts to the government to justify that infringement is a reasonable limitation, prescribed by law that can be justified in a free and democratic society. The applicable legal test is the Oakes test. The test involves a two-stage analysis:

• Pressing & Substantial Objective. The objective of the law must be pressing and substantial. The Court found that there was such an objective: protecting personal privacy is valid and important.
• Proportionality. Second, the means used to achieve that objective must be proportionate, which requires a rational connection between the law and its objective, minimal impairment of the right or freedom, and a proportionality between the law’s benefits and its negative effects on rights. The Court found that the requirement of consent is logically connected to privacy protection, and thus rationally connected. But PIPA failed on the “minimal impairment” part of the analysis. The dual requirement of consent and a reasonable purpose, without an exception for publicly available internet data, was overly broad. In a nutshell, the Court must consider what expressive activities are captured – how broadly the net is cast – and whether everything that is caught in that net is necessary or rationally connected to the pressing and substantial objective. The Court noted that the way the net is being cast by PIPA and its Regulations not only captures Clearview’s web-scraping but also captures legitimate indexing by beneficial search engines. The Commissioner’s interpretation would exclude search engines, meaning they would have to get consent for all collection, use and disclosure of personal information obtained from websites. The Court concluded that the “publicly available” exception was too narrow because it would specifically capture general search engines, which don’t engage the “pressing and substantial limitation”. The court essentially found it was OK to limit what Clearview is doing but it is not OK to limit what search engines are doing. PIPA, as written, doesn’t distinguish between the “bad” and the “good”, and as a result, it didn’t “minimally impair” this important Charter right. On the final balancing, the Court concluded the harm to freedom of expression was not outweighed by the benefit to privacy.

Please contact your McInnes Cooper lawyer or any member of our Privacy, Data Protection & Cyber Security Team @ McInnes Cooper to discuss the legal implications of collecting and using data collected from the public internet.

Share

Print