B.C.’s Supreme Court has upheld a privacy commissioner’s ruling that U.S. artificial intelligence company Clearview AI must refrain from gathering images of British Columbians.
In a Dec. 18 decision, Justice Palbinder Shergill said Clearview has amassed a database of more than three billion images of faces and corresponding biometric identifiers.
“As found by the privacy commissioners, this ‘practice of indiscriminate scraping has undoubtedly resulted in the collection of the personal information of individuals within … British Columbia,’ including children.
“Clearview does not deny that its database includes personal information belonging to people in British Columbia,” the judge wrote.
The ruling noted the company provides its facial recognition services to third-party customers, including law enforcement agencies. The judge said clients in B.C. included municipal police departments in Victoria, New Westminster and Port Moody as well the RCMP which polices multiple B.C. communities.
B.C.’s privacy commissioner
It was in 2021 that the province's privacy watchdog ordered a U.S.-based facial recognition company to stop collecting, using and disclosing images of British Columbians without consent.
“Clearview also acknowledges that it did not seek consent from the individuals whose information it collected, used or disclosed," Shergill said. "Nor is there any suggestion that Clearview gave the affected individuals notice of its activities."
Clearview argued the information was publicly available and consent was not required.
The order to Clearview AI — made by B.C.'s Information and Privacy Commissioner Michael McEvoy on Dec. 14, 2021 — was initially a set of February recommendations that the company has refused to comply with, McEvoy’s office said.
The recommendations followed a joint investigation report by the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the Information and Privacy Commissioner for B.C. and the Information and Privacy Commissioner of Alberta.
The commissioners found the New York-based company violated federal and provincial privacy laws.
The commissioners ordered Clearview to stop offering facial recognition services that were the subject of the investigation to clients in Canada; cease the collection, use and disclosure of personal information collected from individuals in Canada; and delete such information in its possession.
“What Clearview does is mass surveillance and it is illegal,” privacy commissioner of Canada Daniel Therrien said at the time. “It is completely unacceptable for millions of people who will never be implicated in any crime to find themselves continually in a police lineup.”
However, Clearview petitioned the court for a judicial review of the commissioner’s decision. It sought a court declaration that the decision was unreasonable and an order quashing it and setting it aside.
It earlier told the commissioners if it did return to business in Canada after a period, it would need to have its clients’ policies on use of facial recognition.
On the second and third of the B.C. commissioner's orders, Clearview said they were “impossible to execute” and were not legally warranted.
Clearview alleged the B.C. commissioner erred in finding that:
• B.C.’s Personal Information and Privacy Act (PIPA) applied to the company;
• determining that the personal information collected by Clearview from publicly available websites published electronically, was not information that was “available to the public” under PIPA and its related regulations; and,
• finding Clearview’s purpose for collecting, using, and disclosing the personal information was not a purpose that “a reasonable person” would consider appropriate in the circumstances.
The company called the B.C. commissioner’s decision unnecessary and unenforceable.
What were the issues?
Shergill said the case revolved around three questions:
• Does PIPA apply to Clearview?;
• Did the tribunal err in its interpretation of “publicly available” or "reasonable purpose?"; and,
• Is the order unnecessary, unenforceable, or overbroad?
How does Clearview work?
Shergill said Clearview’s facial recognition tool functions in four key sequential steps:
• first, it “scrapes” images of faces and associated metadata (such as title, source link and description) from online sources, including social media. That information is downloaded and stored indefinitely on Clearview’s servers;
• second, Clearview uses an algorithm to analyze digital images of faces and create biometric identifiers. These numerical representations are called vectors. Every image in the database has a vector associated with it in order to allow identification and matching;
• third, Clearview provides its clients with an app which allows users to search the Clearview database to identify a specific target. An app user who wishes to identify an individual must upload an image of their target into the app. This image is analyzed by the neural network which produces matches;
• and fourth, Clearview provides a list of search results to the client.
Shergill said that, in January and February 2020, there were multiple reports that Clearview was populating its facial recognition database by collecting digital images of people’s faces from a variety of public websites, including Facebook, YouTube, Instagram, Twitter and Venmo.
“These images were being collected without the consent of the individuals, and in apparent violation of the terms of service of those website,” Shergill said.
Clearview argued people posting information on publicly available websites without password protection “are exercising their right to control their information.”
However, Shergill said, the B.C. commissioner said collecting such information requires explicit consent.
“I see nothing unreasonable in this approach adopted by the commissioner,” the judge said.
Shergill concluded that Clearview had failed to show the commissioner had erred in its decision.
.jpg;w=120;h=80;mode=crop)
