Time to talk specifics of new facial recognition legislation, Canadian privacy authorities say

Lawmakers in Canada are being urged by privacy authorities to pass new laws to protect people from the risks associated with facial recognition, while also allowing it to be used by police in certain situations.

Canadian Privacy Commissioner Daniel Therrien addressed the House of Commons Standing Committee on Access to Information, Privacy and Ethics (ETHI) as part of its ongoing study of facial recognition. Therrien was joined by the privacy authorities of Quebec and Ontario, Diane Poitras and Patricia Kosseim, respectively. Their appearance coincides with the release of a new edition of policy guidance on the subject from the country’s leading privacy officials.

The hearing is the eighteenth in a series bringing in stakeholders to answer lawmakers’ questions on facial recognition technology, deployments, and related legal and social issues.

Researchers addressing the committee in a previous hearing argued for a broad consideration of the technology, and focused more on predictive and facial analysis systems, and the implications of commercial uses of face biometrics.

“The scope of your study is vast,” Therrien warns. He confined his comments to law enforcement uses of facial recognition, reviewing the Clearview AI decision and a lack of oversight for new technologies by the RCMP federal police force.

The final version of privacy guidance from the Privacy Commissioner’s Offices has also been launched, following a draft version released in June, 2021, and a recommended legal framework.

The new guidance and framework were co-signed by authorities representing each of Canada’s Provinces and Territories, as well as the Federal Commissioner.

Referring to the guidance, Kosseim says four key elements are needed in any new legislation on facial recognition to mitigate the high risks that go along with its use.

Specificity of purpose, necessity and proportionality requirements, strong independent oversight, including powers to audit and make orders, and stronger privacy protections are recommended.

Kosseim emphasized the need for the guidelines to be adopted, as the recommended strong legislative framework is put in place. The lawfulness of police uses of facial recognition should not be assumed, she warns.

Police must ensure that their technology is effective and accurate, and that any third party involved respects all relevant laws and restrictions. Personal information should not be held for longer than necessary, meaning that reference images should be deleted when no longer required, and probe images deleted immediately when they do not return a biometric match.

Communications must not only be carried out, but also two-way, including the views of historically over-policed groups, Kosseim argues.

Poitras spoke about facial analysis based on biometric characteristics, and the commercial and law enforcement surveillance possibilities of the technology, which can be used without the subject’s knowledge.

Quebec laws require biometric databases to be registered with the government, and from September of 2023, further requirements will go into place for any biometric identification process.

Organizations are not taking privacy impact assessments and compliance obligations seriously enough, in many cases, according to Poitras, who attributes a too-casual attitude to the technology to its rapid growth in popularity.

Therrien notes a broad consensus that new legislation is needed, but a lack of consensus about what the content of new laws should be.

Stakeholders asked for further guidance on different use cases, Therrien noted, going beyond the generalities contained in the guidance so far.

Some stakeholders are seeking a moratorium on the use of facial recognition, but Therrien noted that the law as currently constituted allows for facial recognition to be used in certain situations, and data protection authorities do not have the power to put moratoriums in place in their jurisdictions.

Therrien suggests that the RCMP could be asked to comply with the facial recognition usage principles outlined by a representative of the police force in a previous hearing, which included necessity, proportionality, and human oversight. Therrien also said that he could not support a complete ban on the use of facial recognition.

Poitras also outlined the appeal Clearview has filed in Quebec, arguing that her office does not have jurisdiction over it, as a U.S.-based company.

Therrien noted that while the RCMP disagreed with the Commissioners’ conclusion on the legality of using Clearview’s facial recognition technology, the body has agreed to implement changes based on the recommendations. The RCMP will not meet the 12-month deadline for implementing changes in line with those recommendations, but Therrien notes good progress, and says the organization is working towards making the changes.

The use of Clearview by the RCMP was discussed at some length, and the essential disagreement between the Commissioners and the police force, which hinges around whether Canada’s Privacy Act implies a requirement for federal government bodies to ensure their contractors comply with all Canadian laws.

When asked about how to make legislation general enough to not require amendment with each new emerging technology, Therrien said that he believes a few specific rules for facial recognition should buttress a general principles-based approach.

Rather than case-by-case recommendations, categories could be set out in legislation, and based on them specific use cases could be approved or disapproved by regulators, Therrien suggests.

The Commissioners recommended Canadian lawmakers draw on EU proposals for inspiration when crafting new laws for their country.

Therrien’s tenure as Commissioner ends in June, and an attorney at law firm Fasken recently told a privacy and cybersecurity webinar audience that new legislation is unlikely before his replacement assumes the role, Canadian Lawyer writes.

Article Topics

biometric identification  |  biometrics  |  Canada  |  ethics  |  face biometrics  |  facial analysis  |  facial recognition  |  law enforcement  |  legislation  |  privacy  |  RCMP  |  regulation