Canada’s DGSI seeks feedback on national biometric authentication standard

A new Canadian standard for biometric authentication is up for public review. The national standard sets requirements for necessity and proportionality in biometrics use, and stipulates that systems should be accurate and collect minimal personal information. It also includes disclosure requirements for biometric data collection, privacy and security risks, and critically, the consent of the subject.

The country’s Digital Governance Standards Institute (DGSI) published “CAN/DGSI 120: Use of Biometrics for Authentication” in 2024, and defines the minimum requirements for biometric applications. It does not set normative standards.

DGSI Technical Committee 15 on Biometrics, which is made up of 20 members from the country’s cybersecurity community. DGSI also published Canada’s digital identity standard last August.

The 13-page authentication standard says organizations using biometrics are responsible for ensuring the data is encrypted and protected. They must carry out vulnerability assessments and establish safeguards against spoofing and other attacks, all disclosed in a privacy policy.

“Individuals shall acknowledge that they have read and understood the Statement of Biometric Use and Collection, as well as the Biometric Privacy Risk Disclosure” and consent to their terms before any collection can take place, CAN/DGSI 120 states. Exceptions are allowed, in specific circumstances, and subjects can withdraw their consent. Periodic audits for compliance are also required, though their frequency is not prescribed.

The document’s bibliography refers to resources from iProov and the Digital ID and Authentication Council of Canada (DIACC).

DIACC’s central role in the country’s trust infrastructure was further cemented with the certifications of Bluink and FCT to the Pan-Canadian Trust Framework last year, and the organization outlined the opportunity in Canada in its recent Annual Impact Report.

Public comments on the biometric authentication standard are invited until March 9, 2026.

Article Topics

biometric authentication  |  biometrics  |  CAN/DGSI 120  |  Canada  |  data privacy  |  Digital Governance Standards Institute (DGSI)  |  digital identity  |  standards