The Province of Alberta’s privacy law is once again under scrutiny after the province’s Court of King’s Bench found certain provisions of the Personal Information Protection Act (PIPA) to be unconstitutional. The court determined that aspects of the legislation fail to adequately account for modern digital realities, particularly in the context of publicly available online data and biometric information.
Clearview AI Case Highlights Gaps in Privacy Law
The ruling stems from a legal challenge brought by Clearview AI, a facial recognition company that scraped billions of images from the internet to build a biometric identification system. Alberta’s privacy regulator previously ordered the company to cease operations in the province, arguing that the collection and use of facial images without consent violated PIPA. Clearview challenged the order in court, contending that the images it used were publicly accessible and not subject to privacy restrictions.
In its decision, the Court of King’s Bench acknowledged that PIPA lacks clear guidance on what constitutes “publicly available” information in the digital age. It also questioned the law’s ability to address the collection of biometric data, which presents heightened privacy risks due to its permanence and sensitivity. While the court did not strike down the entire law, it found that specific provisions were overly broad and inconsistent with rights protected under the Canadian Charter of Rights and Freedoms.
The Alberta government has been given a window to revise the statute. If changes are not implemented within that timeframe, the unconstitutional sections may be rendered inoperative. This echoes the outcome of an earlier case: in 2013, the Supreme Court of Canada declared PIPA unconstitutional as applied to union activity during a labor dispute, citing its failure to balance privacy protections with freedom of expression. That earlier case also resulted in a legislative amendment timeline.
Biometric Data and Legislative Reform
The recent ruling underscores growing legal concern around biometric technologies such as facial recognition, fingerprint scanning, and iris identification. In Alberta, biometric data is explicitly defined as personal information under privacy law, requiring informed consent and subject to strict use and disclosure rules. Regulators also mandate privacy impact assessments for systems that collect or process biometric identifiers.
However, privacy experts argue that the current legal framework has not kept pace with emerging technologies. The treatment of biometric data by companies like Clearview AI illustrates how existing legislation may be insufficient to address issues of consent, proportionality, and control over sensitive personal identifiers in online environments.
Legislative reform is already underway in Alberta. The government has introduced a new Protection of Privacy Act that is expected to come into force in Spring 2025. This updated framework aims to address many of the concerns raised in recent court decisions, including stricter requirements for consent, expanded definitions of personal data, and more robust enforcement tools.
The implications may extend beyond Alberta. As Canadian jurisdictions continue to grapple with regulating biometric surveillance, the court’s findings could influence national conversations about privacy law modernization across the country.
Sources: St. Albert Gazette, CBC News
—
May 15, 2025 – by Cass Kennedy
