Alberta’s Private Sector Privacy Law Found Unconstitutional

On May 8, 2025, the Court of King’s Bench of Alberta (the Court) issued its decision in Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287, finding that certain sections of Alberta’s Personal Information Protection Act (PIPA) were unconstitutional when used to restrict the collection of publicly available personal information from the internet where an individual has not given consent. This decision may mark a significant milestone for organizations looking to collect publicly available personal information on the internet through data scraping.

Clearview AI Inc (Clearview) is a US-based company that provides its facial recognition software and database to customers, which features billions of images from the internet including websites in Alberta and the social media accounts of Albertans. In 2021, Canadian privacy commissioners investigated Clearview’s practice of “scraping” images and found its activities breached privacy statutes (as previously reported by the E-TIPS® Newsletter here), which prompted Alberta’s Information and Privacy Commissioner (the Commissioner) to order Clearview to cease certain activities in Alberta (the Order).

Clearview sought judicial review of the Order, arguing, among other things, that: (i) PIPA does not apply to it; (ii) the Commissioner erred in finding that Clearview violated PIPA by not having a reasonable purpose for collecting, using, and disclosing personal information; and (iii) the Commissioner’s interpretation of PIPA is unconstitutional as it infringed Clearview’s freedom of expression, contrary to Section 2(b) of the Charter.

In reviewing Clearview’s arguments, the Court found that: (i) PIPA applied to Clearview because a real and substantial connection existed between Clearview and Alberta, as it had carried on business in Alberta and handled Albertans’ personal information; and (ii) the Commissioner did not err when it concluded that Clearview lacked a reasonable purpose for collecting, using, and disclosing personal information.

In turning to Clearview’s argument (iii), the Court stated that the framework in PIPA and the Personal Information Protection Act Regulation (PIPA Regulation) requires organizations to obtain individuals’ consent for the collection, use, and disclosure of personal information that is publicly available on the internet. The Court found that Clearview’s scraping activities were expressive because it facilitated the provision of its facial recognition services to customers, and that the impugned activities fell under the protection of the Charter as such activities occurred within Canada. This led the Court to determine that Sections 12, 17, and 20 of PIPA and Section 7(e) of PIPA Regulation were unconstitutional, finding that “[p]ersonal information and images posted to the internet without being subject to privacy settings are publications and use of such personal information and images is not subject to a consent requirement.”

The Court clarified that its finding on constitutionality did not invalidate the Commissioner’s conclusion for argument (ii) that Clearview lacked a reasonable purpose for using personal information, which stands apart from the constitutionality argument and was upheld by the Court. Therefore, Clearview’s application to quash the Order was dismissed.

Summary By: Imtiaz Karamat