Organizations operating in Alberta have been sent a clear message by the Alberta Court of King’s Bench regarding the handling of personal information in the province, irrespective of whether they are based in Alberta or outside. The recent decision by the Court of Kings Bench of Alberta (the “Court”) in Clearview AI Inc v Alberta (Information and Privacy Commissioner) marks a pivotal moment in privacy law enforcement in this regard.[1]
On May 8, 2025, the Court upheld Order P2021-12, by the Alberta Information and Privacy Commissioner (the “Commissioner”) directing Clearview AI Inc. (the “Company”) to cease all operations in Alberta and to delete all collected Albertan personal information in its possession. On its review, the Court also found portions of Alberta’s Personal Information Protection Act (“PIPA”) to be outdated and unconstitutional, signaling urgent reforms ahead.
This ruling sends a clear message to businesses operating in Alberta: privacy laws are evolving rapidly, and compliance will require immediate and sustained attention. In this article, we unpack the Court’s key findings and examine their practical impact on how businesses must handle personal information moving forward.
Background
The Company uses AI to gather photos of individuals posted on social media or the Internet and compiles them into a facial-recognition database, which is sold to law enforcement agencies. In recent years, the Company has faced mounting criticisms regarding its invasion of individuals’ privacy in several jurisdictions.
In 2021, the Federal, Alberta, and British Columbia Privacy Commissioners and the Commission in Quebec jointly determined that the Company had breached Canadian privacy statutes in each jurisdiction and ordered it to cease its activities in each jurisdiction and delete the collected Canadian personal information in its possession. On judicial review of this order before the Alberta Court, the Company argued:
- Its activities fall outside of the Commissioner’s jurisdiction;
- The Commissioner’s order breached the Company’s freedom of expression under the Canadian Charter of Rights and Freedoms (the “Charter”); and
- The Commissioner’s finding that it did not have a reasonable purpose for collecting, using, and disclosing personal information was unreasonable.
Does PIPA apply to foreign corporations?
Canadian jurisprudence has long held that whether provincial legislation applies to an out-of-province party turns on the question of whether there is a “real and substantial connection” between the province and the party.[2] Here, the Court confirmed that – despite the Company being headquartered in the United States – it was still subject to PIPA as the Company was both doing business in Alberta and collecting, using, and disclosing personal information of Albertans, which satisfied the “real and substantial connection” test.[3]
The unconstitutionality of the “publicly available” exception
PIPA allows organizations to collect the personal information of an individual without their consent if the information is “publicly available” as prescribed in the Personal Information Protection Act Regulation (the “Regulation”).[4] This exception, upon which the Company sought to rely, provides that consent is not required where information is publicly available by virtue of being “contained in a publication, including, but not limited to, a magazine, book or newspaper, whether in printed or electronic form.” The Court upheld the Commissioner’s finding that, as there is no reference to web pages or social media platforms, information from these sources would not be considered “publicly available” under PIPA.[5]
The Company went on to invoke section 2(b) of the Charter, claiming that this exception limited its freedom of expression and was unconstitutional.[6]
Assessing the Company’s claim to Charter protection, the Court determined that Charter protections extend to automated processes like the Company’s use of bots to scrape images and information from the Internet, as this activity was part of a process that leads to a “conveyance of meaning.”[7] In addition, the Court agreed with the Company and found that the restriction to section 2(b) was not justified, as the restriction is overbroad; as drafted, search engines would also be subject to the consent provisions under PIPA, causing an unmanageable burden.[8]
As a result, the Court made the decision to strike the words “including, but not limited to, magazines, books, and newspapers” from the Regulation and allow “publication” to carry its ordinary meaning which it characterized as “something that has been intentionally made public”.[9] This marks a pivotal development in Canadian privacy law, as it significantly broadens the scope of what may be considered “publicly available” information under PIPA, encompassing online materials such as websites and social media posts which are unrestricted by privacy settings. The Court recognized that the Regulation, drafted in 2003, failed to reflect the reality of today’s Internet, which is a dominant medium for the dissemination of personal information.[10]
By interpreting “publication” more expansively, the Court signaled a judicial willingness to modernize legislative language in line with contemporary technological use and communication norms. However, this approach also sets the stage for potential divergence across jurisdictions, as other provinces—such as British Columbia—have interpreted similar provisions more narrowly. This inconsistency could lead to uncertainty for organizations operating across multiple provinces, who may now face different standards for what qualifies as “publicly available” personal information depending on the province. Businesses must therefore stay attuned to evolving judicial interpretations and anticipate reforms or clarifications from legislatures aiming to harmonize privacy standards across Canada.
Reasonable purposes
Despite finding portions of PIPA to be unconstitutional, the Court upheld the Commissioner’s order. This was because the Court found the Company did not have a reasonable purpose for collecting, using and disclosing Albertan’s personal information as required under PIPA. The Company’s purposes were held to be unreasonable since:[11]
- Its purposes were unrelated to the purposes for which the images were originally posted;
- The use was to the detriment of the individual who posted the photos; and
- There was a significant risk of harm to individuals whose images were captured by the Company, such as misidentification or exposures to a data breach.
Treatment of the company in other jurisdictions
The Company brought the same appeal in British Columbia where the British Columbia court found the Company was subject to British Columbia’s legislation due to its real and substantial connection with British Columbia, and biometric data scraped from social media requires user consent.[12] However, the British Columbia Supreme Court differed from the Alberta Court on the constitutionality finding, and held the definition of “publicly available” should be interpreted narrowly.
The Company has faced similar restrictions in other jurisdictions such as Europe (where it was fined €35.5 million in the Netherlands, €20 million in Italy, Greece, and France, and deemed illegal in Germany and Austria). In Britain, the Company was fined $9 million, but successfully appealed this fine on the basis that the court lacked jurisdiction over how foreign law enforcement agencies use British personal information. Britain’s information commissioner has obtained permission to appeal this decision.[13]
Key takeaways
In almost every jurisdiction, the Company has faced push back on its use of individuals’ personal information. While the Alberta Court found that certain aspects of PIPA should be amended to better reflect changing technologies and uses, the Court upheld the Commissioner’s finding that the Company was unjustified in its use of individuals’ personal information.
Based on this decision, organizations should:
- Assess Purpose: Carefully consider the purposes for which they are collecting personal information and ensure that such purposes are reasonable and related to the purposes for which the individuals had provided their personal information;
- Review Consent for AI Use: Analyze the use of AI in their workflows, and ensure proper consents are obtained prior to collection, use, and disclosure of personal information. Just because an individual has posted their personal information on the Internet does not mean organizations are entitled to freely collect, use, or disclose this information; and
- Consider what Jurisdiction’s Laws Apply: Organizations may be subject to local privacy laws where there exists a real and substantial connection between the jurisdiction and the business activity.
If you have any questions or would like guidance on how this decision impacts your organization, please contact a member of the Miller Thomson LLP Technology, IP and Privacy Group.
[1] Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287 (the “Decision”).
[2] Ibid at para 44; Unifund Assurance Co v Insurance Corp. of British Columbia, 2003 SCC 40.
[3] Ibid at para 61.
[4] PIPA, ss 14, 17, and 20; Regulation, s 7.
[5] Decision, supra note 1, at paras 64, 72, 120.
[6] Ibid at para 98.
[7] Ibid at para 104.
[8] Ibid at paras 132-135.
[9] Ibid at para 149.
[10] Ibid at para 134.
[11] Ibid at para 154, 164.
[12] Clearview AI Inc. v Information and Privacy Commissioner for British Columbia, 2024 BCSC 2311.
[13] https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2023/11/information-commissioner-seeks-permission-to-appeal-clearview-ai-inc-ruling/.
