Alberta Court Expands Scope of the “Publicly Available” Exception to Consent Requirement Under Province’s PIPA

In Clearview AI Inc v. Alberta (Information and Privacy Commissioner) (Clearview), the Court of King’s Bench of Alberta expanded the scope of the “publicly available” exception to the consent requirement for the collection, use or disclosure of personal information under Alberta’s Personal Information Protection Act (PIPA) to include personal information published by an individual on the internet, including on social media sites, where the information is published without the use of privacy settings. However, this expansion does not permit organizations to collect, use or disclose personal information on social media sites indiscriminately, as the collection, use and disclosure of personal information must still be for purposes that are reasonable, and the personal information must be published by the person to whom it relates.

The Publicly Available Exception Under PIPA 

Subject to limited exceptions, PIPA prohibits an organization from collecting, using or disclosing personal information unless the individual consents to such collection, use or disclosure. One exception is where the personal information is “publicly available,” as prescribed by the regulations under PIPA. The regulations provide that personal information is not considered publicly available except under specified circumstances, one of which being where “personal information is contained in a publication, including, but not limited to, a magazine, book or newspaper, whether in printed or electronic form, but only if:

i) The publication is available to the public, and

ii) It is reasonable to assume that the individual that the information is about provided that information.”

Prior to Clearview, this exception was narrowly interpreted based on the principle that PIPA (and other privacy statutes) is a human rights statute, and protections to rights afforded by such statutes must be interpreted broadly, with exceptions to the protections being narrowly construed. A narrow interpretation of this exception would not include personal information published by the individual on social media sites.

The Clearview Decision 

In Clearview, the Court held that a narrow interpretation of the publicly available exemption and the resulting requirement to obtain an individual’s consent is an unjustifiable infringement of an organization’s freedom of expression right. The Court found that Clearview’s data-scraping bot that gathers images and information from the internet and social media sites to create a facial recognition database that is provided to customers is an “expressive activity” protected by the Charter.

The Court found such expressive activity was restricted as the combination of the consent requirement and a narrow “publicly available” exception imposed a prohibition on the collection, use and disclosure of online information, since obtaining consent is practically impossible. Finally, the Court found that the restriction was unjustified on the basis that the exception is overbroad because it limits “publication” to magazines, books and newspapers, and limits valuable expressive activity, such as the operation of search engines. The Court did not find a justification for the limitation and found the salutary effects of the exception are outweighed by the deleterious effects.

The Court remedied the infringement by striking the words “including, but not limited to, a magazine, book or newspaper” from the publicly available exception. The Court indicated this change leaves the word “publication” to take its ordinary meaning, which is “something that has been intentionally made public,” and that “personal information and images posted to the internet without being subject to privacy settings are publications and use of such personal information and images is not subject to a consent requirement.”

Takeaways for Businesses 

In light of this decision, we have highlighted key takeaways for businesses:

• In Alberta, personal information published on the internet, including on social media sites, by the individual and not subject to privacy settings can be collected, used and disclosed by organizations without obtaining consent from the individual for purposes that would be considered reasonable in the circumstances. Importantly, the decision does not address whether training artificial intelligence (AI) models would be considered reasonable. Further, the requirement that it be “reasonable to assume that the individual that the information is about provided that information” likely impedes an organization’s ability to rely on this exception to scrape data from social media sites for AI training purposes.
• Organizations should be cautious in applying the same broad interpretation to similar “publicly available” exception provisions in other Canadian jurisdictions, as the language of the publicly available personal information exception varies by statute. Further, there is guidance from privacy commissioners indicating that personal information posted on social media is not considered publicly available.

PIPA must be reviewed every 6 years, and the report of its most recent review was published in February of this year. While this report was published prior to the Clearview decision, it made several recommendations for amendments to PIPA, including to align PIPA with privacy legislation both provincially and internationally, and to ensure PIPA requires comparable or better requirements for organizations to protect personal information. At this moment, there is no indication that the Clearview decision is being appealed, but given that it results in weakened protections to personal information in comparison to other Canadian jurisdictions, it is possible the publicly available exception will be further revised in anticipated amendments to PIPA and its regulations.

For more information, please contact the authors or any other member of our Privacy & Data Protection group.