M. Imtiaz Karamat is an IP Osgoode Alumnus and Licensed Lawyer in Ontario.
This article was previously posted on E-TIPS™ For Deeth Williams Wall LLP on June 23 2021.
On June 10, 2021, the Office of the Privacy Commissioner of Canada (OPC) issued a statement following its investigation into the RCMP’s use of Clearview AI’s facial recognition technology (FRT), reporting that the RCMP contravened the Privacy Act (the Act) when it collected information from Clearview AI.
Clearview AI scraped more than three billion images from internet websites without users’ consent to create a databank for clients, such as the RCMP, to use for the purpose of identifying individuals by matching photographs to images in the databank. In February 2021, the OPC along with multiple provincial counterparts, found that Clearview AI’s methods constituted mass surveillance and were illegal under federal and provincial private sector privacy laws, as previously reported by the E-TIPS® Newsletter here. Following this finding, the OPC began its investigation into whether the RCMP contravened the Act when it used Clearview AI’s services.
In a Special Report to Parliament, the OPC shared its findings, where it stated that a government institution cannot collect personal information from a third party if the third party’s collection was unlawful. Given that Clearview AI’s personal information collection practices were found to be illegal, the RCMP’s subsequent collection of that information falls outside its legitimate operating programs and activities and contravenes Section 4 of the Act. The OPC further concluded that the RCMP had an onus to ensure that the databank was compiled according to legitimate privacy practices. Although the RCMP argued that it did not contravene the Act and the onus is unreasonable, it ultimately agreed to follow the OPC’s recommendations and implement changes to its policies, systems, and training. This includes conducting complete privacy assessments of third-party data collection policies to confirm compliance with privacy legislation and ensuring new technologies are on-boarded in a manner that respects privacy rights.
With the rise in police use of FRT, the OPC saw this matter as an opportunity to address serious privacy concerns in the space. Accordingly, the OPC and its provincial and territorial counterparts have launched a consultation on draft guidance to clarify the privacy obligations for police agencies’ use of FRT. The draft guidance highlights the need for law enforcement officials to have lawful authority for the proposed use of the technology and the importance of implementing privacy standards that are proportionate to the potential harms involved. Comments on the draft guidance may be submitted until October 15, 2021 and further information on how to contribute can be found here.