Canadian Privacy Decisions

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld information concerning a specific individual's business ownership under subsection 24(1) of the Access to Information Act. The OIC found that the requested information was about an identifiable taxpayer (not the complainant) and was obtained by the CRA for the purposes of administering the Income Tax Act. As section 241 of the Income Tax Act restricts the disclosure of such information, the OIC concluded the CRA properly withheld the records.

• Whether the information requested was properly withheld under subsection 24(1) of the ATIA (disclosure restricted by another law).
• Whether the information constituted taxpayer information as defined by the Income Tax Act.
• Whether section 241 of the Income Tax Act restricted the disclosure of the requested information.

A joint investigation by Canadian privacy authorities found that Clearview AI, Inc. contravened PIPEDA and provincial privacy laws by collecting, using, and disclosing personal information without consent and for inappropriate purposes. Clearview's facial recognition tool scraped billions of images from the internet to create biometric facial arrays, which were then provided to law enforcement and other clients. The authorities concluded that Clearview's mass collection and use of sensitive biometric data was not for an appropriate purpose, nor was it obtained with the requisite consent.

• Whether Clearview obtained requisite consent for the collection, use, and disclosure of personal information.
• Whether Clearview collected, used, and disclosed personal information for an appropriate purpose.
• Whether Clearview satisfied its biometric obligations in Quebec.
• Whether Canadian privacy authorities had jurisdiction over Clearview's activities.