Canadian privacy & access decisions

The complainant alleged that the Canada Revenue Agency (CRA) improperly withheld information under subsection 24(1) of the Access to Information Act. The request sought income-related information regarding business ownership for a specific individual. The CRA claimed that the information was exempt from disclosure because section 241 of the Income Tax Act (ITA) restricts its release. The Office of the Information Commissioner (OIC) found that the requested information constituted "taxpayer information" as defined in subsection 241(10) of the ITA, meaning it related to an identifiable taxpayer (not the complainant) and was obtained by the CRA for administering the ITA. Consequently, the OIC concluded that the information met the requirements for exemption under subsection 24(1) of the ATIA. The complaint was therefore deemed not well founded.

• Whether the requested information falls under the definition of "taxpayer information" in subsection 241(10) of the Income Tax Act
• Whether section 241 of the Income Tax Act restricts the disclosure of the requested information
• Whether subsection 24(1) of the Access to Information Act applies to exempt the information from disclosure

A joint investigation by Canadian privacy commissioners examined Clearview AI's facial recognition tool, which scraped billions of images from public websites to create a database for law enforcement and other users. Clearview argued that Canadian privacy laws did not apply due to a lack of jurisdiction and that the information was "publicly available," thus exempt from consent requirements. The Offices asserted jurisdiction, finding a real and substantial connection to Canada through Clearview's marketing and use by Canadian entities. They determined Clearview failed to obtain requisite consent, as the "publicly available" exception did not apply to sensitive biometric data scraped from social media for unrelated purposes. Furthermore, Clearview's mass collection and use of sensitive facial biometric information for commercial purposes were deemed inappropriate. In Quebec, Clearview also failed to report its biometric database and obtain express consent as required by law. The matter was found to be well-founded, with recommendations for Clearview to cease operations in Canada and delete Canadian data, which Clearview did not commit to implementing.

• Whether the Canadian privacy commissioners had jurisdiction over Clearview AI's activities.
• Whether Clearview AI obtained requisite consent for its collection, use, and disclosure of personal information under PIPEDA, PIPA AB, PIPA BC, and Quebec's Private Sector Act.
• Whether the "publicly available" information exception applied to Clearview AI's collection of images from public websites.
• Whether Clearview AI's collection, use, and disclosure of personal information was for an appropriate purpose under PIPEDA, PIPA AB, PIPA BC, and Quebec's Private Sector Act.
• Whether Clearview AI satisfied its biometric obligations in Quebec, specifically regarding reporting the creation of a biometric database and obtaining express consent under the LCCJTI.
• Whether Clearview AI's activities were protected by freedom of expression under the Canadian Charter of Rights and Freedoms.