Canada needs biometric surveillance regulation with enforcement powers – Privacy Commissioners

Canadian privacy commissioners at the federal and provincial level condemned Clearview AI’s biometric solution as unlawful mass surveillance, and called on lawmakers to grant them enhanced enforcement powers, along with a wider scope for protective action.

The Commissioners found in their report that the Royal Canadian Mounted Police (RCMP), the federal police force, was a Clearview customer, and a total of 48 accounts were created by law enforcement agencies and other organizations across the country. A significant number of those 48 were created by individual officers of their own accord. The Commissioners also noted in the press conference that commercial organizations did use Clearview’s app, but sparingly, and only prior to the launch of the investigation.

Only one contract was signed by Clearview between the federal level and in Canada’s second, third, and fourth most populous provinces (total population roughly 18 million), so the commercial prospects of the biometric solution in Canada, even if it had been declared lawful, remain unclear.

In a press conference announcing the release of their report on the biometrics company’s practices and their legality on Canada and the provinces of British Columbia, Alberta and Quebec, the four Privacy Commissioners were united in calling for more and tougher regulation of facial recognition, but also in their particular concern with Clearview’s model.

“It is an affront to people’s privacy rights, and inflicts broad-based harm on all members of society,” said Privacy Commissioner of Canada Daniel Therrien, invoking the idea of a perpetual police line-up.

Clearview argued that its ties to Canada are insufficient to give its privacy laws any jurisdiction over the company or data it holds, that consent was not required to collect and process the data it holds because it was publicly available, and that the company’s rights outweigh the privacy concerns of those whose images were scraped from public sites. Further, Clearview contends that significant harm from its technology is unlikely, while the benefit to law enforcement is substantial, and that it cannot be held responsible for errors made by its customers, according to the Commissioners.

The Commissioners not only disagreed, but expressed concern that Clearview did not acknowledge any privacy violations, and argued its business interest outweighs privacy rights. They are demanding that Clearview delete the data it holds on Canadians, though no agreement has been reached at this time, despite some discussion between the Commissioners and the company on how to do so.

Information and Privacy Commissioner for British Columbia Michael McEvoy urged the passage of stronger privacy laws in B.C. and across all jurisdictions in Canada, and said the “lack of enforcement power combined with Clearview’s blatant disregard of privacy laws leaves Canadians vulnerable.” He suggested it must be clear to companies that it is less expensive to comply with the law than to break it.

Quebec is the only jurisdiction in Canada with regulation specific to biometrics, but a Canada’s Parliamentary Privacy Committee began looking into facial recognition a year ago.

The Commissioners are working on guidelines for permissible use of facial recognition for law enforcement in Canada, which are expected in the spring, and other related initiatives.

Therrien also called the redress mechanism in Illinois in which people can submit a photo to Clearview to be removed from its database “a calculated risk” which involved “irony.”

Bill C11, which is intended to strengthen data privacy protections, currently sits before the country’s legislature. Even under that bill, as currently constituted, the Commissioners would lack any authority to levy financial penalties against Clearview or another company found to have violated Canadian law.

One implication of the findings is that as sensitive information, biometrics should not be collected without explicit user consent.

CCLA calls for facial recognition moratorium

The Canadian Civil Liberties Association (CCLA) says the country should enact a moratorium on facial recognition until it passes strong and effective legislation that ensures it will not be misused.

“We are seeing an explosion of Facial Recognition Technology,” said Brenda McPhail, Director of Privacy for the CCLA. “But we are seeing no corresponding rise in oversight. In Canada there have been clear abuses of this technology and as this evolves further – and more private sector and governmental organizations deploy it, we need Canadians to understand the risks to their privacy and the pitfalls of the technology.”

McPhail also said the technology affects minorities differently. The organization directed people to a pair of reports, one by the Public Good Initiative at the Munk School of Global Affairs and Public Policy at the University of Toronto and one by the International Network of Civil Liberties (INCLO), on facial recognition.

In a webinar hosted by Ryerson University, McPhail discussed facial recognition from a privacy and rights perspective, along with Tamis Israel, staff lawyer for the Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic and Jacob Schroeder, legal counsel for the Office of the Privacy Commissioner of Canada. The conversation was moderated by former CBC Radio executive producer Bernie Lucht.

In most cases, the technology was discussed in terms of surveillance and use in public spaces, though the use of face biometrics for user authentication and verification was also talked about, though the distinction was not clearly made. Similarly, comments about the accuracy and racially disparate performance were made based on generalizations, without mention that the technology used by Toronto Police is known to be NEC’s.

Schroeder notes that Canada has laws specific to DNA biometrics, but that for the most part, biometrics use in the country is governed by a patchwork of laws that predate the development of facial recognition as a viable commercial technology.

Article Topics

biometric identification  |  biometrics  |  Canada  |  CCLA  |  Clearview AI  |  data protection  |  facial recognition  |  legislation  |  privacy  |  RCMP  |  regulation  |  surveillance