The BC Supreme Court has upheld the provincial Information and Privacy Commissioner's ruling requiring US-based artificial intelligence company Clearview AI to cease collecting images of individuals in British Columbia without their consent.
Clearview AI operates a facial recognition service by scraping facial images and associated metadata from publicly available online sources, including social media platforms. Clearview stores these images indefinitely on its servers and analyzes them to create biometric identifiers, which it uses to build a database of over three billion entries.
In its petition, Clearview argued that the commissioner's decision was unreasonable, claiming it misapplied privacy laws, ignored the nature of publicly available data, and failed to properly consider whether the company's activities aligned with the Canadian Charter of Rights and Freedoms. Clearview also asserted that the commissioner's order was unenforceable.
While Clearview suspended its services in Canada in 2020, it declined to implement all of the commissioner's recommendations. The company argued that its practices were lawful, contending that images collected from public websites should not require consent under Canadian law. It also claimed identifying which individuals in its database were from BC or Canada was unfeasible.
In its petition, Clearview raised several challenges to the commissioner's ruling. It argued that the Personal Information and Privacy Act (PIPA) should not apply to the company's activities as a foreign entity. It claimed that images taken from public websites were exempt from PIPA's consent requirements. Clearview also asserted that its purpose for collecting data was reasonable and consistent with Charter values. Finally, the company alleged that the order was unnecessary and could not be enforced.
Commissioner's jurisdiction
Clearview challenged the application of PIPA, arguing it lacked sufficient connection to the province. However, the court rejected this claim and affirmed the commissioner's jurisdiction over the company's activities in BC. The court concluded that Clearview's actions—collecting, using, and disclosing personal information of British Columbia residents, including through partnerships with local law enforcement agencies—established a sufficient connection to the province.
The Supreme Court also noted that Clearview's voluntary suspension of its Canadian operations did not absolve it from regulatory oversight. The court reasoned that allowing companies to evade jurisdiction through temporary suspensions would undermine regulatory schemes.
'Publicly available' information
Clearview argued that the commissioner misinterpreted key provisions of PIPA, including "publicly available" information and "reasonable purpose," but the court found the commissioner's interpretations reasonable and legally justified.
Clearview claimed it should not need consent to collect, use, and disclose personal information sourced from social media and other online platforms, arguing this data was "publicly available." The court, however, agreed with the commissioner that such sources do not qualify as "publicly available" under PIPA and its regulations. The commissioner emphasized that social media content is dynamic and that users maintain control over their information, aligning with PIPA's privacy protection goals. The court found the commissioner's interpretation consistent with the statute's text, purpose, and context.
Regarding the "reasonable purpose" requirement, Clearview argued its activities served legitimate needs, particularly aiding law enforcement. The court upheld the commissioner's finding that Clearview's practices—such as indiscriminately scraping billions of images, including those of children, to create a commercial facial recognition database—did not constitute a reasonable purpose. The commissioner also determined that Clearview's practices posed risks of significant harm, including misidentification and breaches of sensitive biometric data. The court found these conclusions reasonable and supported by evidence.
Enforceability
Clearview also challenged the enforceability and breadth of the commissioner's order, which required the company to stop collecting, using, or disclosing personal information from individuals in BC without consent and to delete such data. The court rejected Clearview's claims, noting the order's "best efforts" standard was enforceable and based on Clearview's demonstrated ability to implement similar geographic restrictions in the United States. The court also rejected the argument that the order was overbroad, finding it adequately regulated Clearview's activities concerning individuals in BC, not just residents.
Ultimately, the court dismissed Clearview's petition, affirming the commissioner's authority to regulate the company's operations under PIPA and reinforcing privacy protections for individuals in BC.