Canadian court upholds Clearview biometric data ban

The Supreme Court of British Columbia dismissed a petition by Clearview AI to overturn an order of the Information and Privacy Commissioner, barring the company from collecting face biometrics of individuals in the province without gaining their consent.

Specifically, the order “prohibits Clearview from offering its facial recognition services to clients in British Columbia using images and biometric facial arrays (‘personal information’) collected from individuals in British Columbia without their consent.”

It orders Clearview to “make best efforts to cease the collection, use, and disclosure of personal information collected from individuals in British Columbia without their consent.”

Finally, it requires Clearview to “make best efforts to delete personal information collected from individuals in British Columbia without their consent.”

Clearview’s petition challenged the results of a joint investigation by the Privacy Commissioner of B.C., the Office of the Privacy Commissioner of Canada (OPC), the Commission d’accès à l’information du Québec (CAI), and the Information and Privacy Commissioner of Alberta (OPC AB), which found that the company “did not obtain the requisite consent to collect, use and disclose the personal information of Canadians.”

Clearview says compliance is tricky as regulators point to BIPA

The B.C. ruling defines Clearview’s product as “a facial recognition software which utilizes an automated tool called an ‘image crawler’. The image crawler scans the internet for images of human faces that people have posted online.” This includes social media accounts. Clearview stores the images in its databases indefinitely.

To date, per the ruling, it has “collected more than three billion images, including images of people in British Columbia and minors,” adding to a database that totals over 50 billion facial images for biometric comparison.

“Clearview marketed and sold its product to law enforcement agencies,” the court says. But “the ‘vast majority’ of individuals whose personal information Clearview collected have never been and will never be implicated in a crime.”

The company exited the Canadian market voluntarily in 2020, but the ruling notes that the U.S. company “has not committed to remaining out of the Canadian market beyond the end of the suspension period.”

In defending its practices, the company has argued that it can’t know if the images it collects are of Canadians, and furthermore, that since the images are publicly available, it doesn’t break Canadian law or violate the Personal Information Protection Act (PIPA) to collect and store them.

It also has also said bringing its activities into compliance with recommendations would be unfeasible, and that the commissioners’ asks are “unreasonable.”

In response, B.C.’s privacy commissioner dropped, so to speak, a BIPA bomb, referencing Illinois’ much litigated law on the collection of personal biometrics. Why, the commissioner asked, could Clearview not comply with its requirements, as it had promised to do under BIPA?

Clearview replied by saying that even “measures it submitted it could take in court proceedings in Illinois” would not “ensure compliance with the terms of the recommendations of the Privacy Commissioners.

Court affirms ‘reasonable risk’ of ‘significant harm’

The back and forth has finally hit a wall with the Supreme Court decision, which affirms that the sources from which Clearview “scrapes” its images – notably social media profiles – don’t qualify as “publicly available” under PIPA and its regulations.

The court says “it was reasonable for the Commissioner to rely on Clearview’s assertions in Illinois to scope the Order, and to reject Clearview’s bald assertion that it simply could not do the same in British Columbia.”

It fails to find “reasonable purpose” for Clearview’s biometrics collection, and deems it “reasonable for the Commissioner to conclude that Clearview’s activities ‘create the risk of significant harm to individuals whose images are captured’.”

The North American market is central to Clearview’s operations, and while Canadian law enforcement does not offer the same breadth of opportunity for facial recognition firms as the U.S., Clearview is unlikely to accept the B.C. court decision without further counter-efforts.

Article Topics

biometric data  |  biometric identifiers  |  biometrics  |  Canada  |  Clearview AI  |  data collection  |  face biometrics  |  regulation