AI Facial Recognition Company Violates Privacy Law, Drone Interference, And DIY Silencers

Your face might already live in a searchable database—and BC’s courts just drew a sharp line around what companies can do with it. We break down a major ruling that upholds the privacy commissioner’s order against Clearview AI, unpack why “publicly available” doesn’t mean “free to scrape,” and explain how a province can regulate a US firm with no brick-and-mortar presence. This is a story about jurisdiction in the age of the internet, biometric data rights, and the limits of consent on social media platforms Canadians use every day.

From there, we pivot to a wildfire zone, where a tiny drone met a big legal problem. When a helicopter pilot fighting the Kelowna blaze was irritated and distracted by a nearby drone, the court found that distraction alone interfered with fire control under the Wildfire Act. We walk through the difference between strict and absolute liability, why due diligence matters, and how “no harm done” isn’t a shield when public safety is at stake.

We close with a sign of the times: 3D printed suppressors that triggered prohibited device charges. Beyond the plastic parts and lab delays, the headline is new criminal exposure for simply accessing or possessing digital files intended to produce firearms or key components. We talk through how Canadian firearms law treats suppressors, why courts imposed a conditional sentence rather than jail in this case, and what makers and hobbyists need to know before downloading a file that could cross a legal line.

If privacy, drones, or maker tech lives anywhere near your world, this episode offers clear, practical takeaways: don’t assume public equals fair use, steer drones far from emergency operations, and think twice before clicking on gun-printing files. Subscribe, share with a friend who needs a reality check on tech and law, and leave a review to tell us where you think the line should be drawn next.

Follow this link for a transcript of the show and links to the cases discussed.

Transcript

Clearview AI’s Massive Face Database

Adam Stirling 0:20

What was happening?

Can BC Regulate A US Company

Publicly Available Data Isn’t A Free Pass

Michael Mulligan 0:22

Well, you may not have realized you've been probably scraped. And so this uh arises out of a uh uh investigation by the Information and Privacy Commissioner in British Columbia and uh to a couple of other provinces, and it has to do with a company called ClearView AI Inc., which is a U.S. company. And the business model of ClearView AI Inc. um is to scrape information from websites that are accessible to its uh uh uh scraper engine, uh things like YouTube, Instagram, Facebook, and others, uh, and to then use the images of people along with metadata associated with the original pictures to create a facial data database, which it stores indefinitely. Uh back in 2017, when all of this started, they had some 3 billion individuals uh who had been identified using that system. Uh they had uh then by uh late 2023 they'd uh managed to scrape and examine some 30 billion images to enhance their database. And uh currently, if you look at what that company has on their website, I think they're up to something like 70 billion images. And so what they do is they scrape all of this information and uh try to connect it up with metadata to identify the people in the images that they've captured, uh, and then they sell searches uh to like uh for criminal investigations or U.S. national security. Interestingly, on the website, they will also sell it to public defenders. I'm not sure why you have to be represented by a public defender, but that's at least how they're marketing it. And so that's how they make money. Uh and so the legal issue uh was one with respect to the app, whether this activity, the scraping of this information, collecting up and making this database to identify people. So, like the idea is you could if you had some picture from a security camera, you could upload it, it was searching against their database of scraped facial data and identify the person. Um and so the privacy commissioner and the ones in the other provinces that were looked into this uh were assessing whether this process was contravened the protection of privacy legislation, which is provincial legislation in each of those provinces. Uh and their conclusion was that this was not permitted. Uh and really there were a couple of issues that had to be sorted out there that were then the subject of first a judicial review of their decision and now a just released decision from the British Columbia Court of Appeal. And the first issues that had to be sorted out was the issue about whether the uh province of British Columbia has constitutional authority to uh regulate the activity of Clearview AI Inc. And the issue there is whether Clearview uh has a sufficient connection to British Columbia, right? Because you know the province of British Columbia wouldn't have some authority to go off and order some company based in Louisiana to do something if it had nothing to do with uh, you know, British Columbia. Uh and that has been, over the past few years, as the internet has become so pervasive, uh a more complicated issue than it once was, right? At some point you would have been able to figure out whether a company had a substantial connection to British Columbia or some other province by asking, well, do they have an office here? Do they have any employees here? Do they sell stuff here? But it becomes much more ambiguous when you've got companies that sort of have you know services marketed online on the website. Um and that was actually litigated in in BC in the context of Google a few years ago. Uh Google's argument was, well, no, you know, you can't regulate us. We just, you know, we're just a passive service that might be used in British Columbia. You know, we have no control over that. Uh, you know, who us? Um and that didn't work for Google. And in Google, the courts looked at things like, you know, the company uh Google sells advertising, marketed, you can target people just in British Columbia, for example. And so they looked at how that was used and the modern reality of it, and they concluded, yeah, there is a sufficient connection there. And in the case of ClearView, not only are they scraping data from people that live in British Columbia, but they were also marketing their service to Canadians, including people in British Columbia, at least when the investigation started. Now, perhaps um uh detecting the way the wind was blowing, uh, the company then indicated that it was stopping its marketing of services to Canadians or people in British Columbia. But again, in the internet context, what does that really mean? Because of course it took me all of about five seconds to type in the name of the company and come up with their website, now I requested demo and so on. So yeah, they haven't mailed anything out to me, but clearly there it is. And so the privacy commissioner concluded, yeah, there is authority to do that, and ultimately that was upheld both on the initial judicial review and this most recent review by the Court of Appeal. And another interesting legal thing to know about those kinds of uh uh judicial reviews on issues like jurisdiction is that the test for the court is whether that decision was correct, because there's no special, you know, uh uh knowledge possessed by the plea, you know, the privacy commissioner about the operation of law or constitutional authority and so on. And so the courts do that afresh. And even on an appeal, it's looked at just fresh by the Court of Appeal. They're not uh, you know, they don't presume the uh original judge to have been correct, there's no deference owed to them. But despite all of that, and despite the ambiguity caused by the fact that you know Clearview doesn't have a brick and mortar office in BC, and despite the fact that they said, no, we're going to stop marketing uh to people in Canada or entities in Canada, they concluded the fact that they're actively collecting and scraping this kind of data uh did provide a sufficient connection to allow constitutional authority for BC to regulate them. But then came the other arguments uh from the company, including uh the reasonableness of what was concluded there and whether this the whether there was an exception in that privacy legislation for getting information that's on publicly available websites. Uh now, the way that works is that the privacy legislation in British Columbia uh sets out uh when the a company is permitted to collect and use personal information. Uh and it provides a number of express circumstances where that can be done, and that includes information that appears in, and then it lists a bunch of things, a printed or electronic publication that is available to the public, including, so it's not limited to a magazine, book, or newspaper in printed or electronic form. And so the company's argument there was, well, look, this is an electronic publication, it appears to be uh publicly available. We are bot can just scrape up your information, you put it on Instagram, you open up your settings, we can get it, we're taking it. Uh that didn't work uh uh either initially or on the two levels of appeal, uh concluding that uh this that kind of material, like on social networks, is not the same kind of publication that would occur uh in a newspaper or magazine, even if those things were put online, um, on the theory that much of that material is sort of created by individuals rather than the purveyor of it. So that didn't fly. The other argument made by the company was that it was uh just impossible to comply with the order that was made, and the order was made to use reasonable efforts to stop collecting information about uh people that were uh in British Columbia. Uh and part of the problem the company had there is apparently they were uh involved in litigation in Illinois, and the company had agreed to take steps to stop acquiring facial data from Illinois residents and to block searches of information about facial data from people who resided in Illinois. And so that was not a compelling factual piece of information when the company was saying, well, this is just impossible, we can't do it for people in BC. The company also argued, well, it's just too vague to say you have to take reasonable uh steps to do this or reasonable effort. Um, and that got rejected as well, saying that's sort of a term that's been used by uh courts repeatedly in making orders, you know, and saying, look, uh, you know, you may not run afoul of it if you do your very best, but something sneaks through. Um, you know, somebody indicates they live in, I don't know, uh, Saskatchewan, uh, when in fact they live in British Columbia and you just made a mistake. Uh and so the upshot of all that, which is analyzed on a reasonableness basis rather than correctness, is that both the original chambers judge and now the Court of Appeals have concluded that the commissioner uh was reasonable when they concluded that the legislation did not permit uh the scraping of information off of social media sites to be used in this kind of a database. Uh and so that's the order from the uh the order stands, so says the Court of Appeal. And I guess we'll have to wait and see what happens now with ClearView AI. Uh, but uh this is uh the modern reality uh of what uh is going to happen to your information if some company is capable of uh collecting it up, it is happening. I mean, you'll see this even for your own use now, right? Like if somebody has, if you have like an iPhone or something and you take a bunch of pictures, if you label who's in the picture, you know, dutifully figure out well all the other pictures of that person and organize them, and you can search by name and so on. So it's all happening for you. And not only is that technology happening for you, uh, it's now help now happening with billions of pictures. I mean, reality, 70 billion images they've now collected to do that. The population of the earth is 8.3 billion people. And so that would suggest they've got many pictures, or there maybe that's there's a lot of useless cat videos or something out there, but nonetheless, it's a huge trove of information. Uh and no doubt uh there's law enforcement benefits to that, or maybe even benefits for public defenders. Uh, but all of that has to be weighed up against the privacy considerations of do you do you really want your image in some database that you know people are able to identify and track you and and so on? Uh so at least uh the law is in BC that at least what Clearview is doing is not permitted. So hopefully they get on with doing something along the lines of what they're doing in Illinois and try to fish that data out of their system. Uh and uh maybe we'll all have just a little bit more privacy.

Adam Stirling 10:58

All right. Legally speaking will continue right after this commercial break. Legally speaking continues on T Fact and they joined as always by Michael Mulligan, very translator with Mulligan Temple. Michael Apact is a conviction for flying a drone interfering with a fire control. What happened?

Orders, Reasonableness, And Illinois Example

Michael Mulligan 11:16

So this is a prosecution under the Wildfire Act, the British Columbia It's Good Act. Uh and in particular, it dealt with the Klona Wildfire from back in August of 2023. And the fellow who was charged here was uh operating a he was in a boat, private boat, and he was operating what's described as a miniature drone taking footage of the damage caused by the wildfire. Um and the challenge arose because there was a helicopter uh in the area which was tasked with picking up buckets of water and flying it over and dumping them on the fire. Now, the it's not illegal to operate a drone generally, uh, but the Wildfire Act makes it an offense, provincial offense, for a person to, without lawful excuse, operate equipment, machinery, or a vehicle or a vessel, or act in a manner that interferes with fire control that is being carried out under the Act. So the first thing about this uh that the judge had to analyze at this trial is that there are different levels, there are different categories of offense in terms of regulatory or criminal offenses. So for criminal offenses, uh ordinarily it's going to be a requirement to prove that a person willfully or knowingly did something to commit the act. Like the criminal law is generally concerned with you know willful misconduct, not accidents or unintentional conduct. But this wildfire act is regulatory, it's not criminals. You'll get a criminal record for it. Uh and for those kind of regulatory offenses, there are two different categories. There's either what is called strict liability offenses or absolute liability offenses. And I'll start with the strict or the absolute liability one, that's the most strict one, where the crown only needs to prove that you did the thing. Uh so an example of that would be like speeding, right? Um it's not a defense to speeding if you say I didn't realize I was speeding, or uh I misread the sign that said the speed limit was 80s and I was driving 100 or something. That's not a defense. If they prove you were speeding, well, that's pretty well that then. But there's this middle category of what's referred to as strict liability offenses, where the crown just needs to prove the per the the act was committed, uh, and then you could have a defense if you could establish uh or raise a reasonable doubt if um you took all reasonable steps to prevent it from occurring um or you uh believed in a uh set of facts uh which, if true, uh meant you were committing the offense. There's sort of a uh uh a scope uh for there being a defense beyond simply then proving, yeah, well, your car went over the speed limit, that's that then, right? Um now in that regard, first of all, the judge had to focus on well, what does this thing actually prohibit? And didn't have any problem finding that the drone constituted equipment or machinery, right? So that that wasn't really the issue. But one of the issues was did this interfere with the uh what was going on? And in that regard, interestingly, at the trial, the uh helicopter pilot testified, who's had pilot experience 36 years, and p the helicopter pilot testified about what he does, picks up buckets of water and dumps it on the fire, and he said, Well, it's not uncommon for people to have boats uh out there looking at what's going on. He says that doesn't cause him any problem at all, he just flies to a different part of the lake and scoops up water over there. But he in this case indicated that he observed, he first thought it was a bird, but then noticed the drone, and he he was irritated by the drone. His evidence didn't seem to be that the drone was going to somehow knock his helicopter over the sky, being miniature and all, but it irritated him. And so as a result of his irritation, he decided to pick up two one after another smaller buckets of water and decided to try to knock the drone out of the air himself by like picking up buckets of water and flying over and dumping them trying to hit the drone.

unknown 15:08

Oh no.

Privacy Tradeoffs And The Bottom Line

Michael Mulligan 15:08

Uh and he missed twice. Uh and then he decided to go back to his business and flew, I guess, away from the drone and kept collecting his water and going back over and dumping it on the fire. And so one of the issues there, I suppose, would be, you know, does that really interfere with it? Is that the irritation of the helicopter pilot? Uh and the judge uh accepted that that uh, you know, the potential risk caused by the irritation and removing the focus of the helicopter pilot was sufficient to make out uh this that it was being interfered with because of the irritation and distraction the drone was causing, even though it didn't appear to be on the evidence any kind of an actual danger to anything that was going on. And it was interesting, of course, given the pilot's uh evidence about boats being around, and that CD didn't care about that, he would just fly somewhere else and carry on. Um uh but that he found to be enough, and here found that uh the uh fellow had not uh made out uh the uh defense that he had taken all reasonable steps or that didn't know that uh you know the fire was going on or something. Uh and so uh as a result of that, even though it's uh you know strict, not absolute, uh, and even though there was no evidence that the drone actually caused some danger to the helicopter, the fact that it was irritating and distracting was enough uh to found a conviction. And so the man was found guilty of the regulatory offense. And so I guess the takeaway there is bear that in mind if you're flying a drone around a uh forest fire that's being fought, even if your drone is tiny and isn't actually doing anything, you might wind up irritating the helicopter pilot, uh, and you could find yourself running afoul of the uh wildfire act uh and like this man end up with a conviction and probably some kind of a fine. Not sure whether he's ever going to see the drone again, but uh that's the latest on uh the Wildfire Act and uh why you shouldn't fly drones around.

Adam Stirling 17:01

All right, just under four minutes left for out of 59. Another high-tech case, a sentencing for 3D printing of two gun silencers. What happened?

Drone Near Wildfire Leads To Conviction

Michael Mulligan 17:11

Well, this is a sign of the time. So you had this fellow in this case who the police came in for some unknown reason to arrest him for unrelated reasons. Uh, and while doing so, they noticed some 3D printed things. They noticed a 3D printed spring-loaded knife and a 3D printed bullet, whatever that means, um, and some other items. And eventually they went and got a warrant and came back and conducted a search and seized a whole bunch of stuff uh that this man had printed out on a 3D printer. Uh they sent all of these things, including like uh things that like were shaped like guns but weren't, uh, off to a lab to test what they all were to determine whether any of them uh constituted prohibited weapons. Now, for reasons unknown, the laboratory took just months to do that. Uh the guy wound up waiting on bail for some twenty-three months, most of which was spent by the laboratory testing these items out. And ultimately the laboratory, oh yeah, he's been on bail for twenty-six months, uh came back and concluded that two of the items were prohibited, not any of the printed off plastic guns, but two things which amounted to silencers. Uh and in Canada, we have made it uh prohibited devices include a device intended to muffle or stop the sound or report of a firearm. Like I think you could screw on the end of a gun to make it quieter. Now, interestingly, in that regard, other countries take a very different view of that. Like the UK, for example, they encourage people to use silent sous aren't guns to be polite and not disturb people. But in Canada, we've decided to make that prohibited because we want the guns to be very loud. So very British, very polite. Yeah. Very British, very polite, you know. So here they are prohibited. And these things, even though they're plastic printed objects, met that definition in the view of the expert. Now, another thing to mention here, and this is important, since this case, we've actually have a new provision in the criminal code. It's in here under section 102.1, and it actually makes it a crime to possess or access computer data uh that could be used to do things like 3D print items like a gun. And so now uh just going to a website and accessing that kind of information, even if you didn't print it at all, just having it. If you have it, access it, or distribute it, you've committed the crime. Uh and so uh be aware of that, because there are again other places like the United States where that's not a crime at all. And in fact, it may be constitutionally uh permitted to allow people to in some places make their own gun. It could probably vary state by state, but very different regimes. It's one big internet, just like in clear that Clearview case, and so be careful because you can very easily commit a crime uh by accessing those things. And they it's taken seriously in Canada. This fellow, he pled guilty after being on bail for twenty-six months, and ordinarily in the cases involving uh like craving firearms, that jail sentences imposed. And here the judge concluded, well, that's necessary, but the guy's not of any risk. He's been on bail for twenty-six months, hasn't done anything, no reason to think he's ever going to do anything, and he didn't print them for some illegal purpose. He was just interested in making them for his own amusement, I guess. He wasn't doing anything with them. And so uh the uh judge imposed a conditional sentence order, which is like house arrest for a period of 120 days. So a fairly significant uh impact for the man. Uh, but that's the latest on 3D printing, how that can quickly turn into an offense if the item you print off happens to meet the Canadian definition of what is a prohibited device, and that includes a silencer. So uh that's the latest on three D printed silencers and what not to do.

Adam Stirling 20:57

Michael Mulligan with Legally Speaking during the second half of our second hour every Thursday here on T Fact and Seminary. Thank you so much. Pleasure as always. Thanks so much. Always great to be here.