In a much-anticipated decision that may have ripple effects in other jurisdictions, the British Columbia Supreme Court has provided clear guidance on the application of the Personal Information Protection Act, SBC 2003, c 63 ("BC PIPA") to foreign organizations.
In Clearview AI Inc. v. Information and Privacy Commissioner for British Columbia, the Court upheld the Office of the Information and Privacy Commissioner for British Columbia's ("OIPC") order against Clearview AI Inc. ("Clearview"), a U.S.-based facial recognition company, in connection with Clearview's violations of BC PIPA.1
The Court's ruling establishes that BC PIPA applies to organizations outside of British Columbia ("BC") that have a "real and substantial connection" to BC. Although this finding appears to support a contextual analysis similar to the test applied when considering the application of the federal Personal Information Protection and Electronic Documents Act, SC 2000, c 5 ("PIPEDA") to organizations outside Canada, the BC Court expressed the view that a sufficient connection can be established for the purposes of BC PIPA merely by collecting data from individuals in BC through the Internet.2
Background
Clearview operates a facial recognition system that scrapes publicly accessible images from social media and other online platforms, which it then converts into biometric identifiers. Clearview's business involves selling software to law enforcement agencies and private sector entities, which allows them to match faces to the images in Clearview's searchable biometric database. At the time that Clearview's activities came to the attention of Canadian privacy regulators, the company had amassed over three billion facial images, including those of persons in BC, without their consent. Clearview's own website currently claims that its database contains over 50 billion facial images collected from the Internet (an average of six per person on the planet).3
In 2020, the Office of the Privacy Commissioner of Canada ("OPC"), along with the OIPC and the privacy commissioners in Alberta and Quebec, investigated Clearview for violations of Canada's privacy laws, culminating in a joint investigation report (the "Joint Investigation Report"). The Joint Investigation Report found that Clearview contravened Canadian private-sector privacy legislation and included specific compliance recommendations for Clearview.4
That same year, Clearview voluntarily suspended its services to Canadian users. However, the company suggested that the suspension was intended to be temporary, and Clearview continued to collect and store images of Canadians.5
The OIPC's Order
In 2021, the OIPC issued an order requiring Clearview to comply with the recommendations of the Joint Investigation Report. The Alberta and Quebec privacy regulators made similar orders within their own jurisdictions. Specifically, the OIPC's order required Clearview...
