Application of privacy legislation to foreign corporations Application of privacy legislation to foreign corporations

Table of Contents

• Clearview AI Inc. v. British Columbia (Information and Privacy Commissioner), 2026 BCCA 67

---

Clearview AI Inc. v. British Columbia (Information and Privacy Commissioner), 2026 BCCA 67

Read the case details

Facts

This was an appeal of a judicial review application concerning the application of British Columbia’s Personal Information Protection Act, S.B.C. 2003, c. 63 (PIPA) to Clearview AI Inc. (Clearview), a private U.S.-based technology company that sells facial recognition software, primarily marketing these services to law enforcement and other government agencies. Clearview’s search engine detects and scans human faces and associated metadata from publicly accessible websites and analyzes each face to produce a numerical biometric identifier. All facial images, associated metadata and biometric identifiers are stored indefinitely on Clearview’s servers.

In early 2020, the information and privacy commissioners of British Columbia, Alberta, Québec and Canada commenced a joint investigation into Clearview’s activities. The resulting joint report (the joint report), issued in February 2021, concluded that Clearview had violated protection of privacy laws in all four jurisdictions. In December 2021, the British Columbia Information and Privacy Commissioner (the Commissioner) issued a decision finding Clearview had contravened sections 6–8, 11, 14 and 17, of PIPA. The Commissioner ordered Clearview to: cease offering its facial recognition services to clients in British Columbia; make best efforts to cease the collection, use and disclosure of images and biometric facial arrays collected from individuals in British Columbia without their consent; and make best efforts to delete such data in its possession (the Order).

Clearview applied for judicial review, which was dismissed by the chambers judge in December 2024. Clearview appealed on three grounds: PIPA does not apply to it as a matter of constitutional law; the Commissioner unreasonably interpreted and applied PIPA in concluding that the “publicly available” exception did not apply and that Clearview did not have a reasonable purpose for its activities; and the Order was unnecessary, unenforceable or overbroad. Similar judicial review applications were initiated in Alberta and Québec.

Decision

The Court of Appeal dismissed Clearview’s appeal, holding that PIPA is constitutionally applicable to Clearview. Key findings include:

• PIPA constitutionally applies to Clearview because there is real and substantial connection between its online business activities and British Columbia. Even after Clearview ceased marketing activities in British Columbia, its global image crawler continued to collect facial data from individuals in British Columbia, maintaining a sufficient connection to British Columbia for the purposes of the application of PIPA. Following a detailed review of the related jurisprudence, the Court concluded that technological advances have led to a proliferation of companies whose business model is based on acquiring information from global internet sites, such that the physical location is of significantly diminished importance to the real and substantial connection analysis, whether that of content providers, servers or end users. In this case, Clearview’s business model depends on acquiring facial data globally.
• The Court upheld the Commissioner’s conclusion that images obtained from social media websites are not “publications” under the “publicly available” exemption (in contrast to traditional publications like books or newspapers).
• Clearview’s collection of facial data was not for purposes a reasonable person would consider appropriate in the circumstances. The joint report found that information Clearview collects to be “extremely sensitive,” and the Court agreed that Clearview’s purpose was accurately characterized as providing a commercial service to law enforcement and others, but its purpose is not law enforcement and not what those who posted their images intended.
• The Order was reasonable and enforceable. The prohibition on offering services in British Columbia was justified despite Clearview’s claimed withdrawal from the Canadian market. An entity ceasing operations in a jurisdiction does not deprive a regulator of its authority to issue orders, including prospective ones, based on the entity’s conduct while it operated within that jurisdiction. The Court also upheld the terms requiring Clearview to make “best efforts” to cease collecting and delete facial data, rejecting claims of vagueness. It noted that “best efforts” orders are commonly used to address noncompliance with privacy laws and provide necessary flexibility for enforcement.

Key takeaways

This decision finds that provincial privacy legislation can apply to foreign corporations that acquire personal information of individuals in the province through internet-based activities, even where the corporation has ceased marketing its services in the jurisdiction, provided there is a real and substantial connection between the corporation’s activities and the province. This will likely embolden regulators seeking jurisdiction over online businesses with no physical presence in Canada. The decision arguably narrows the interpretation of the “publicly available” exemption under PIPA, thereby limiting the type of content that would fit within the exemption.