Introduction
A recent decision of the Court of King’s Bench of Alberta has found that certain provisions of Alberta’s Personal Information Protection Act, SA 2003, c P-6.5 (“PIPA”)[1] and the corresponding Personal Information Protection Act Regulation, Alta Reg 366/2003 (the “PIPA Regulation”)[2] are unconstitutional on the basis that they infringe the right to freedom of expression as protected by section 2(b) of the Canadian Charter of Rights and Freedoms (the “Charter”).[3] This ruling may have a substantial impact on web-scraping practices generally, and signals a need to modernize Alberta’s private sector privacy legislation.
Background
In Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287, (the “2025 Clearview PIPA Decision”),[4] Clearview AI Inc. (“Clearview”):
(1) applied for judicial review of an order from the Information and Privacy Commissioner of Alberta (the “Commissioner”); and
(2) challenged the constitutionality of PIPA and the PIPA Regulation.
The 2025 Clearview PIPA Decision arose from a 2021 joint report from the privacy commissioners of Alberta, British Columbia, Quebec, and Canada, which investigated Clearview’s practice of scraping images from the internet. Following that report, the Commissioner ordered Clearview to: (i) stop offering its facial recognition services that were the subject of the investigation to clients in Alberta; (ii) stop the collection, use and disclosure of images and biometric facial arrays collected from individuals in Alberta; and (iii) delete any such images and arrays already in its possession.
A central focus of the Court in the 2025 Clearview PIPA Decision was the interpretation of “publicly available information”, as contemplated by section 7(e) of the PIPA Regulation (which is excerpted below):
For the purposes of sections 14(e), 17(e) and 20(j) of the Act, personal information does not come within the meaning of “the information is publicly available” except in the following circumstances:
…
(e) the personal information is contained in a publication, including, but not limited to, a magazine, book or newspaper, whether in printed or electronic form, but only if
(i) the publication is available to the public, and
(ii) it is reasonable to assume that the individual that the information is about provided that information.
Key Determinations
As a primer to the Court’s reasoning in the 2025 Clearview PIPA Decision, the Court determined that:
(1) the images and information that Clearview scraped from the internet are captured under the definition of “personal information” found in PIPA;[5]
(2) the internet is not expressly identified in section 7 of the PIPA Regulation as a source of personal information that is publicly available;[6]
(3) regardless of the source of the information, PIPA requires that personal information may only be collected used, and disclosed for purposes that are reasonable;[7]
(4) even though Clearview is not based in Alberta and had not carried on business since July 2020, PIPA applies to Clearview based on the “real and substantial connection” test – relying on the fact that Clearview collects images of Albertans from servers located in Alberta and elsewhere in Canada;[8] and
(5) in view of the narrow construction of exceptions to quasi-constitutional rights and the contract interpretation principle of ejusdem generis (i.e., whereby items enlisted in a non-exhaustive statutory or contractual provision are interpreted to be of the same type as those explicitly identified), it was reasonable for the Commissioner to interpret that the exceptions under PIPA and the PIPA Regulation (specifically section 7(e) of the PIPA Regulation) did not extend to social media.[9]
Does PIPA Infringe the Freedom of Expression?
Clearview sought a declaration that certain sections of PIPA and the PIPA Regulation were unconstitutional on the basis that the consent requirement for gathering personal information limited Clearview’s freedom of expression, since images and information gathered by Clearview permitted it to provide its service to customers.[10]
Applying the test from Canadian Broadcasting Corp v Canada (Attorney General),[11] the Court found that Clearview’s activities engaged Charter-protected expression under section 2(b) of the Charter. Applying established Charter jurisprudence, the Court held that Clearview’s activities engaged section 2(b) of the Charter because the possession of expressive material is integrally related to the development of thought, belief, opinion, and expression. The Court also agreed with Clearview’s submission that scraping the internet to gather images and information can be protected expression (under section 2(b) of the Charter), if it forms part of a process leading to the conveyance of meaning.[12]
Is the Restriction of the Freedom of Expression Justified?
The Court next considered whether the restriction on the freedom of expression was justified. In doing so, the Court applied the test established in R v Oakes, [1986] 1 SCR 103.[13] Clearview conceded that PIPA and the PIPA Regulation served a pressing and substantial objective but argued that it impaired the freedom of expression more than necessary and asserted that the deleterious impacts of PIPA and the PIPA Regulation outweighed the beneficial effects.[14]
The Court agreed with Clearview and found that PIPA and the PIPA Regulation were unconstitutionally overbroad, as they imposed a consent requirement on all personal information publicly accessible online, even in circumstances where individuals might not have a reasonable expectation of privacy. In particular, the Court found that the source-based definition of “publicly available information” under the PIPA Regulation excluded the internet entirely, thereby subjecting both Clearview and ordinary search engines to identical obligations regarding consent. The Court accepted Clearview’s argument that this regime unnecessarily curtailed expression and captured important activities that allow individuals to access information on the internet, such as indexing web content.[15] While the Court acknowledged that certain uses of publicly available personal information, such as Clearview’s bot-driven web scraping practices, may justify restriction, the Court nevertheless found that PIPA and the PIPA Regulation also captured a range of expressive activity that lacked any compelling basis for regulation, which rendered it constitutionally overbroad.[16]
The Court also addressed the salutary and deleterious effects of the consent requirement under PIPA. The Court recognized that PIPA protects individuals’ autonomy and dignity by providing them with control over their personal information, including the ability to share it publicly. However, the Court found that the consent requirement had significant deleterious effects, as it applied universally to all automated collection of data from the internet, which would significantly undermine the functionality of widely used search engines, which serve as essential instruments for accessing information and promoting the freedom of expression.[17] The Court also noted that PIPA continues to confine the collection, use, and disclosure of personal information to purposes that are reasonable, which addresses the principal concerns of the Province of Alberta and the Commissioner. Ultimately, the Court concluded that the harms from section 7(e) of the PIPA Regulation outweighed its benefits, and that these harms were not justified under section 1 of the Charter.[18]
Remedy
The Court concluded that it would be appropriate to strike the words “including, but not limited to, magazines, books, and newspapers” from section 7(e) of the PIPA Regulation, leaving the word “publication” to take its ordinary meaning. Therefore, section 7(e) of the PIPA Regulation reads as follows:
For the purposes of sections 14(e), 17(e) and 20(j) of the Act, personal information does not come within the meaning of “the information is publicly available” except in the following circumstances:
…
(e) the personal information is contained in a publication, including, but not limited to, a magazine, book or newspaper, whether in printed or electronic form, but only if
(i) the publication is available to the public, and
(ii) it is reasonable to assume that the individual that the information is about provided that information.
Under the revised text, personal information contained in a “publication” is no longer confined to the types of sources previously enumerated. The Court found that personal information and images posted to the internet without privacy settings were publications, and that the use of such personal information and images is not subject to a consent requirement.[19]
The Court also dismissed Clearview’s application for judicial review, finding that the Commissioner’s decisions were reasonable and met the required standards of justification, transparency, and intelligibility. The Court also rejected Clearview’s arguments of delay and procedural unfairness, holding that there was no breach of procedural fairness in how the Commissioner handled the matter.[20]
Key Takeaways
(1) The 2025 Clearview PIPA Decision underscores the need to modernize PIPA so that it reflects current internet practice. In response to the 2025 Clearview PIPA Decision, Alberta’s Minister of Technology and Innovation has acknowledged this need, and organizations operating in Alberta should anticipate legislative updates.
(2) In Alberta, organizations should be aware that scraping publicly available, non-password-protected personal information may not require consent, so long as there is a reasonable purpose for conduct the scraping.
(3) Organizations that scrape online content containing personal information should carefully consider both the origin of the data and the intended purpose of its use – to determine whether such use constitutes a “reasonable purpose”.
(4) The private sector privacy regimes federally and in British Columbia both adopt an approach with respect to publicly available personal information similar to the approach under PIPA. It remains to be seen whether these regimes will face similar constitutional scrutiny.
The information and comments herein are for the general information of the reader and are not intended as advice or opinion to be relied upon in relation to any particular circumstances. For particular application of the law to specific situations, the reader should seek professional advice.
[1] Personal Information Protection Act, SA 2003, c P-6.5.
[2] Personal Information Protection Act Regulation, Alta Reg 366/2003.
[3] Canadian Charter of Rights and Freedoms, Part I of the Constitution Act, 1982.
[4] Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287 [2025 Clearview PIPA Decision].
[5] Ibid at para 8.
[6] Ibid at para 11.
[7] Ibid at para 12.
[8] Ibid at paras 44, 60.
[9] Ibid at para 83.
[10] Ibid at para 98.
[11] Canadian Broadcasting Corp v Canada (Attorney General), 2011 SCC 2.
[12] 2025 Clearview PIPA Decision, supra note 4 at para 104.
[13] The Oakes test asks whether a law that limits a Charter right is justified under section 1 by requiring that the objective of the law in question be pressing and substantial, and that the means chosen are proportional, involving: (i) a rational connection to the objective, (ii) minimal impairment of the right, and (iii) proportionality between the law’s effects and its objective.
[14] 2025 Clearview PIPA Decision, supra note 4 at para 123.
[15] Ibid at para 144.
[16] Ibid at paras 132, 136.
[17] Ibid at para 144.
[18] Ibid at para 146.
[19] Ibid at para 149.
[20] Ibid at paras 96–97.
