Notice of consultation and call for comments – Privacy guidance on facial recognition for police agencies
Canada’s federal, provincial and territorial privacy protection authorities have jointly developed guidance for police agencies to clarify their privacy obligations with respect to their use of facial recognition (FR) technology, with a view to ensuring any use of FR complies with the law, minimizes privacy risks, and respects privacy rights. This guidance is meant for federal, provincial, regional and municipal police agencies. It is not intended for other public organizations outside of the police that are involved in law enforcement activities (for example, border control), nor for private sector organizations that carry out similar activities (for example, private security).
We are seeking written feedback from stakeholders both on the draft guidance as well as on the legal and policy framework for police use of FR more generally.
Stakeholders are not obligated to respond to all questions. Some questions may be more specific to how police agencies would implement the guidance given their operational realities. Additional information on the format and process for submitting feedback is below, under the section entitled “Feedback procedures”.
Feedback on draft guidance
| 1. | Will this guidance have the intended effect of helping to ensure police agencies’ use of FR is lawful and appropriately mitigates privacy risks? If you don’t believe it will, why? |
|---|---|
| 2. | Can this guidance be practically implemented? What best practices and techniques might law enforcement agencies implement for operationalizing this guidance? Where operationalization may be difficult, please explain and provide examples and details when possible. |
| 3. | Are the recommendations in the "accuracy" section sufficient to help ensure police agencies meet their accuracy obligations in FR initiatives? In your response, we invite comments on best practices for setting an appropriate threshold for FR matches and determining acceptable error rates, if any. |
| 4. | Can the recommendations in the guidance concerning the retention and disposal of personal information collected and used during a FR initiative be appropriately operationalized in a law enforcement context? If not, why? |
| 5. | What measures or practices can police agencies implement to help ensure any third parties involved in FR initiatives operate with lawful authority? Third parties could include, for example, vendors of FR software or those in control of faceprint databases accessed by police. |
| 6. | Do you foresee any negative consequences arising from the recommendations outlined in this guidance, and if so, what are they? |
Feedback on the legal and policy framework for police use of FR
Currently, there are comprehensive statutory regimes governing the use of other forms of biometrics by law enforcement, namely, fingerprints and photographs under the Identification of Criminals Act, and DNA profiles under the DNA Identification Act. Given the sensitive nature of these biometrics, and the substantial implications for individuals’ rights and freedoms, their collection and use is limited to specific circumstances and purposes. There are also specific provisions governing their expungement. As faceprints are another form of biometric, we are seeking feedback on the legal and policy framework applicable to police use of FR in Canada.
| 7. | Is police use of FR appropriately regulated in Canada under existing law? If not, what are your concerns about the way police use of FR is currently regulated, and what changes should be made to the current legal framework? Would these changes be better addressed through a standalone regulatory framework specific to FR use, or through reform of privacy laws of general application? |
|---|---|
| 8. | What protections should be granted to individuals whose biometric information is included in a faceprint database? Protections might include, for example:
|
| 9. | Should police use of FR, including the collection of faceprints, be limited to a defined set of purposes (such as serious crimes or humanitarian reasons, e.g. missing persons)? Should they be able to use or retain faceprints beyond those of individuals who have been arrested or convicted? Are there circumstances in which police should never be allowed to use FR, or specific applications of FR that should not be permitted (i.e. ‘no-go zones’ such as the indiscriminate scraping of images from the Internet)? Should there be special rules for (or a prohibition against) the application of FR to youth? |
| 10. | Are there any other important policy issues that should be addressed in relation to police use of FR? This includes, for example, emerging legal, ethical, or social issues in relation to the development and implementation of faceprint databases by the police. If so, what are these issues, and how do you recommend they should be addressed? |
Feedback procedures
Submissions may be sent via email to OPC-CPVPconsult1@priv.gc.ca until October 15, 2021. Feedback may be sent in the form of an email or Word document, in either official language. When submitting feedback, please provide your name and contact information and also indicate which category best represents your perspective (e.g. individual, academia, business, civil society/nonprofit, business association, government, etc.). Any comments that violate Canadian law or violate our comment policy will not be considered within scope of this call for feedback and will either be deleted or dealt with in accordance with our legal authorities under the Privacy Act. Please note that the OPC is not providing funding for any feedback related to this call for comment.
Your feedback will not be posted on the OPC website but we may post an overall summary of feedback that we receive. If you post your feedback online, please advise us and provide us with a link. If you are submitting previously published works as part of your feedback, please include appropriate references and links. Your feedback may also be shared with relevant provincial or territorial privacy protection authorities who may contact you for further discussions about your submission.
The OPC is subject to the Access to Information Act and the Privacy Act. The Access to Information Act provides a public right of access to government records. The Privacy Act provides individuals with a right of access to their own personal information and protects that information from unauthorized disclosure. Some of the information you provide to us in this process may be accessible under the Access to Information Act; this does not include personal information as defined in the Privacy Act.
Please see the OPC’s Privacy Policy, Terms and Conditions, and comment policy for how we handle your information. The personal information you provide will be used and may be disclosed for the purpose for which the information was obtained or compiled by the OPC, or for a use consistent with that purpose.
If you have a question unrelated to this call for feedback, please use our Online information request form or contact our Information Centre. Feedback will not be treated as a privacy complaint under the Privacy Act or PIPEDA. For further information on filing complaints under either Act, please see File a formal privacy complaint.
If you have any questions, please feel free to contact us at OPC-CPVPconsult1@priv.gc.ca.
- Date modified: