Introduction

In a landmark decision for digital privacy rights in Canada, the Court of Appeal for British Columbia has dismissed an appeal by Clearview AI Inc., confirming that the province's privacy legislation applies to foreign technology companies that collect the data of British Columbians. The decision in Clearview AI Inc. v. British Columbia (Information and Privacy Commissioner), 2026 BCCA 67, reinforces the authority of the Information and Privacy Commissioner (the Commissioner) to regulate how personal information is harvested from the internet, even when the company has no physical presence in the province.

This ruling addresses fundamental questions regarding the reach of provincial law in the digital age, specifically concerning the Protection of Personal Information Act (PIPA).

Case Background and Facts

Clearview AI Inc. is a US-based technology company that operates a search engine for facial recognition. As detailed in the judgment, Clearview's software scrapes human faces and associated metadata from publicly accessible websites like YouTube, Facebook, and Instagram. By 2017, the company had amassed a database of three billion facial images, which grew to 30 billion by 2023.

Clearview marketed its services primarily to law enforcement agencies, allowing them to upload a photo of a person of interest and receive matching images from the web. Following a joint investigation by Canadian privacy commissioners, the BC Commissioner ordered Clearview to cease offering its services in BC, stop collecting images of BC residents, and delete existing data.

Clearview sought judicial review, arguing that PIPA did not apply to its operations as a US entity and that, even if it did, the information was publicly available and exempt from consent requirements. The Supreme Court of British Columbia dismissed the application, leading to this appeal.

The Jurisdictional Challenge

The central issue on appeal was whether PIPA is constitutionally applicable to Clearview. The company argued that it lacked a sufficient connection to British Columbia, as its operations were conducted entirely outside Canada and it was indifferent to the location of the individuals whose data it scraped.

The Court of Appeal rejected this argument, applying the real and substantial connection test established in Unifund Assurance Co. v. Insurance Corp. of British Columbia. Writing for the Court, Justice Iyer determined that a virtual connection is sufficient to ground jurisdiction. The Court noted that Clearview's business model relies on a global dataset that inevitably includes British Columbians. By actively harvesting data from BC residents to build its commercial database, Clearview established a sufficient connection to the province. The Court emphasized that the internet does not create a law-free zone where foreign entities can ignore local privacy protections.

The "Publicly Available" Argument

A critical aspect of Clearview's defense was the claim that the images were scraped from public websites and therefore fell under the "publicly available" exception in PIPA. Section 12(1)(e) of PIPA allows for collection without consent if the information is available from a prescribed source.

The Court upheld the Commissioner's strict interpretation of the PIPA Regulations. The regulations list specific sources such as magazines, books, and newspapers. The Court reasoned that social media platforms are distinct from these traditional publications. While a newspaper is created by authors, social media content is generated by users who retain a measure of control and privacy interest in their images. Consequently, the Court found that mass-scraping biometric data from social media does not qualify for the publicly available exemption.

Reasonable Purpose Analysis

Under PIPA, organizations may only collect, use, or disclose personal information for purposes that a reasonable person would consider appropriate. Clearview argued that its purpose—assisting law enforcement—was reasonable.

The Court disagreed, supporting the Commissioner's finding that the mass identification and surveillance of individuals by a private entity constitutes an unreasonable invasion of privacy. The decision highlighted that the potential benefits to law enforcement did not outweigh the significant harm to individual privacy and autonomy. The indiscriminate nature of the collection, occurring without the knowledge or consent of the subjects, rendered the purpose unreasonable under the statute.

Implications for BC and Canadian Law

This decision has profound implications for international data privacy. It confirms that foreign companies cannot evade Canadian privacy laws simply by locating their servers and offices offshore. If an organization's digital activities significantly impact the privacy rights of British Columbians, local courts and regulators will assert jurisdiction.

Furthermore, the ruling clarifies the limits of the "publicly available" data exception. Businesses cannot assume that because information is accessible online, it is free for commercial exploitation. The distinction drawn between traditional publications and user-generated social media content sets a precedent that protects the digital footprint of individuals from unauthorized harvesting.

Practical Advice for Organizations

For businesses operating in the digital space, this case serves as a vital warning regarding data compliance:

This judgment reinforces that in British Columbia, the right to privacy is treated as quasi-constitutional, and courts will interpret legislation broadly to protect that right against evolving technological threats.

  • Jurisdiction is Broad: Do not assume that a lack of physical presence exempts your organization from provincial privacy laws. If you process the data of residents, you likely need to comply with local statutes.
  • Public Does Not Mean Free: Review your data scraping practices. Information found on social media or public websites is not automatically exempt from consent requirements.
  • Reasonableness Test: Conduct privacy impact assessments to ensure that your collection of personal information meets the reasonable person test. Commercial utility does not automatically validate privacy intrusions.
  • Remedial Orders: Be aware that regulators have the power to order the deletion of data and the cessation of business activities, and courts are willing to enforce these orders broadly, including best efforts requirements to remove data.