Canadian Privacy Decisions

A joint investigation by Canadian privacy authorities found that Clearview AI, Inc. contravened PIPEDA and provincial privacy laws by collecting, using, and disclosing personal information without consent and for inappropriate purposes. Clearview's facial recognition tool scraped billions of images from the internet to create biometric facial arrays, which were then provided to law enforcement and other clients. The authorities concluded that Clearview's mass collection and use of sensitive biometric data was not for an appropriate purpose, nor was it obtained with the requisite consent.

• Whether Clearview obtained requisite consent for the collection, use, and disclosure of personal information.
• Whether Clearview collected, used, and disclosed personal information for an appropriate purpose.
• Whether Clearview satisfied its biometric obligations in Quebec.
• Whether Canadian privacy authorities had jurisdiction over Clearview's activities.

The complainant alleged that Health Canada did not conduct a reasonable search for records concerning producers and users of medical cannabis. Responsive records were drawn from one database, but Health Canada argued retrieving additional records from a second database would be unreasonable due to the manual labour involved. The Information Commissioner agreed that the search was reasonable given the effort required.

• Reasonableness of search

The complainant alleged that Transport Canada improperly relied on section 26 of the Access to Information Act to refuse access to annual statistics regarding the processing of access to information and privacy requests. The Office of the Information Commissioner found that Transport Canada met the criteria for applying section 26 and had properly considered all relevant factors in its decision.

• Applicability of section 26 of the ATIA (Refusal of access if information to be published)
• Proper exercise of discretion by the institution