Citation: Doan v. Canada (Attorney General), 2023 FC 236

Facts:

Clearview AI is an American-based company that provides facial recognition software to public and private entities around the globe. In 2020, reports emerged and an investigation confirmed that the RCMP were using Clearview’s products in violation of Canadian public sector privacy law. In response, the Office of the Privacy Commissioner (OPC), launched a second investigation into Clearview’s activities in Canada, in partnership with its provincial counterparts. The investigation reviewed Clearview’s business model, where the company created and maintained a database of more than 3 billion facial images scraped from public websites, such as Facebook and YouTube. In its report, the Commissioners found that Clearview had breached Canadian privacy laws by collecting, using, and disclosing individuals’ personal information without their knowledge or consent for inappropriate purposes.

This case concerns a Canadian photographer from Montréal, Québec, Ms. Ha Vi Doan, who takes and posts photographs of her friends, family, and clients on various public internet and social media sites. Her images were likely taken from the web and incorporated into Clearview’s FRT database.

In 2021, Ms. Doan filed a complaint with the OPC asserting that Clearview collected, used, retained, and disclosed her personal information without her consent, thereby violating her privacy rights. The OPC declined to pursue her complaint because it had already been the subject of the broader investigation into Clearview’s activities in Canada. Ms. Doan then applied to the Federal Court to seek judicial relief under the Personal Information Protection and Electronic Documents Act (PIPEDA).

Issues:

The applicant brought a motion to certify a class action on behalf of two different subclasses: residents and citizens of Canada whose faces were collected by Clearview and individuals and entities holding moral rights to the images used by Clearview. She asserted that Clearview’s activities in Canada breached numerous federal and provincial statutes, including the Charter of Rights and Freedoms and PIPEDA.

On the other side, Clearview argued that Ms. Doan did not have grounds to bring the class action under sections 14 and 15 of PIPEDA because only a complainant or the Privacy Commissioner could seek relief for a breach of the Act. Clearview claimed that Ms. Doan was not a complainant, so her motion should fail.

Outcome:

The Federal Court refused Ms. Doan’s application for certification of a class action because it held that the court did not have jurisdiction over the case. To certify a class action, the moving party must demonstrate a reasonable cause of action and identify a group of claimants or “class members.” While the court found that Ms. Doan had successfully established a reasonable cause of action – Clearview’s possible infringement of individual’s privacy and moral rights – she failed to demonstrate that there was a group of claimants that could bring such a claim before the Federal Court under section 14 of PIPEDA.

Section 14 permits individuals to apply to the Federal Court for relief: (1) if they have received a report from the OPC alleging an infringement of their privacy rights or (2) if the OPC refuses to investigate a complaint. Ms. Doan unsuccessfully argued that section 14 could serve as an umbrella clause – that she could bring a class proceeding on behalf of the other individuals identified in the OPC’s report because she had made a complaint with the OPC, essentially claiming that her complaint could serve as a basis for all proposed class members. Instead, the court held that judicial recourse under PIPEDA is limited to individuals who have actually filed complaints with the OPC and, therefore, Ms. Doan was the only proposed class member.

Significance:

This case highlights the limited means of judicial recourse available to complainants when an entity is found to be in breach of PIPEDA following an investigation by the OPC. Despite the OPC’s report finding that Clearview had engaged in the “mass and indiscriminate scraping of images from millions of individuals across Canada, including children,” the Federal Court held that to be certified as class members, members must have made an initial complaint to the OPC. However, formal privacy complaints are limited to individuals and businesses, meaning that each prospective class member would have had to make an individual complaint. The court’s holding means that under current law, section 14 of PIPEDA cannot be applied to allow a class action following an investigation from the OPC.

Second, the court accepted Clearview’s arguments that it could not unequivocally identify if the individuals who appeared in images that its software scrapes from the web are Canadian citizens or residents. This is a worrying conclusion that appears to underestimate the capabilities of Clearview’s software as Clearview purports to assist in the identification of individuals using billions of images scraped from the web. These images are connected to other personal identifiers, such as location and nationality, and have been proven to reveal personal information related to individuals’ identity.