Update to Quebec data privacy law specifies biometrics use notifications

A series of legal amendments made to Quebec’s privacy laws affecting businesses and the private sector touch on biometric technology and data, requiring greater transparency and understanding of obligations for those affected.

In 2021, the Canadian province passed the ‘Act respecting the protection of personal information in the private sector,’ to establish greater privacy protections for people from businesses. The act will be enacted in phases starting from September 22, 2022, with one major change impacting biometrics deployments. A summary by the Commission d’Accès à l’Information (CAI) says that a business must, “Notify the Commission before using any biometric technique to verify or confirm the identity of a person.”

The Commission suggests that biometrics users should be familiar with their obligations for the technology under a guide that the Commission itself wrote back in 2020. Very broadly, it recommends starting with a preliminary analysis with a privacy impact commission, disclosing the business’ database of biometric characteristics and measurements to the Commission, and fulfilling the obligations to Quebecers like acquiring their manifest consent and maintaining confidentiality and security measures.

Quebec is an outlier among Canadian provinces and territories as the first jurisdiction to write and pass laws governing biometrics. The CAI also banned the combination of thermal cameras and facial recognition as the technology was determined to violate the province’s privacy laws.

Canadian privacy authorities have also been encouraging the passage of new laws to regulate facial recognition at the federal level.

Article Topics

biometric identifiers  |  biometrics  |  Canada  |  data privacy  |  data protection  |  legislation  |  privacy  |  Quebec  |  regulation