Parts of Alberta's personal information protection law ruled unconstitutional

CBC

15-05-2025

Social Sharing
Parts of Alberta's personal information protection legislation have been ruled unconstitutional.
But the ruling from Court of King's Bench Justice Colin Feasby also upheld an order to stop an American facial recognition company from collecting images of Albertans.
Clearview AI scrapes the internet and social media for images of people and adds them to a database, which it markets to law enforcement agencies as a facial recognition tool.
Canada's privacy commissioner, along with commissioners from Alberta, B.C. and Quebec, issued an order in 2021 for Clearview AI to stop operating in the country and delete images of Canadians collected without their consent.
Police used the company's services on a trial basis before commissioners launched an investigation.
Clearview AI, which has not operated in Alberta since 2020, applied for a judicial review of the order as well as a ruling on the constitutionality of Alberta's personal information protection legislation.
Feasby, in a decision released last week, says the order stands, but parts of Alberta's legislation are unconstitutional.
Clearview AI did not respond to a request for comment.
Clearview AI violated Canadian privacy law with facial recognition: report
4 years ago
Duration 1:55
The judge's decision says regulations under Alberta's Personal Information Protection Act don't properly address privacy considerations posed by the internet and its restrictions for requiring consent are too broad.
It says the company argued that Alberta's privacy commissioner misinterpreted what "publicly available" means under that act, as the legislation permits entities to collect personal information without consent from publicly available sources.
"The public availability exception to the consent requirement is really a source-based exception," Feasby writes, adding that the internet, let alone social media, isn't specifically listed as a publicly available source of information.
Instead, Alberta's rules say publicly available personal information includes that which is "contained in a publication, including, but not limited to, a magazine, book or newspaper, whether in printed or electronic form."
Since social media isn't listed, Clearview argued that Alberta's commissioner didn't take the phrase "but not limited to" far enough by not including social media, the decision says.
The company cited case law "where it is established that an individual 'can have no reasonable expectation of privacy in what he or she knowingly exposes to the public'."
However, the act has an exception on the collection of publicly available information without consent, based on "reasonable use."
The commissioners previously decided Clearview's web scraping for a facial recognition database wasn't a reasonable use of publicly available information.
Feasby agreed, saying Alberta has a "substantial interest in protecting personal information from being used in a facial recognition database," since people likely don't expect their social media posts to wind up in a "potentially harmful" database.
But the judge also ruled in the company's favour. He says the publicly available exception was too broad, as it allows the privacy commissioner to choose who it enforces the rules against, noting Alberta hasn't penalized other web scraping companies like Google.
"The commissioner's decision to take enforcement action against Clearview and not others who collect, use and disclose personal information publicly available on the internet suggests that some collection, use and disclosure of personal information publicly available on the internet is not problematic," the judge writes.
To remedy the issue, the judge says the "including, but not limited to, a magazine, book or newspaper" clause of the exception should be struck and simply replaced with "publication."
Act out of date, minister says
"This leaves the word 'publication' to take its ordinary meaning, which I characterize as 'something that has been intentionally made public,"' he says.
Technology Minister Nate Glubish, the minister responsible for the legislation, said Wednesday he wasn't surprised by the ruling, adding the act is "badly out of date."
He said a committee was struck last year to review the legislation and submitted recommendations for updates.
"We're reviewing those recommendations, and we're looking forward to working over the coming summer to ensure that we're ready to bring forward some modernizations to PIPA in the very near future," said Glubish.
"Our goal is to make sure that Alberta has the strongest privacy protections in the country, and we're confident we're going to be able to deliver on that."
Since the order is upheld, Clearview is still required to cease collecting images of Albertans and delete those already collected.
The company argued its software prevented it from deleting images, because it's not clear which images were collected from and taken in Alberta. But the judge found that wasn't a valid reason.
Feasby ordered the company to report within 50 days on steps it has taken to comply.