Appearance before the Standing Committee on Access to Information, Privacy and Ethics (ETHI) on Facial Recognition Technology

May 10, 2021
Ottawa, Ontario

Opening statement by Daniel Therrien
Privacy Commissioner of Canada

(Check against delivery)

---

Thank you for the invitation to speak with you.

Facial recognition technology has emerged as a powerful tool that, as we saw in the Clearview AI case, can identify one person in a database of billions of photos. Or among thousands of protesters. If used responsibly and in the right circumstances, it can offer significant benefits to society.

In law enforcement, for example, facial recognition can assist police in solving crimes or finding missing persons.

At the same time, it involves sensitive personal information that is unique to the individual and is permanent.

Facial recognition technology has the potential to be extremely privacy invasive. It can enable widespread surveillance, provide biased results, and erode other human rights.

Clearview AI

A recent joint investigation with three of my provincial counterparts into Clearview AI shows how facial recognition technologies can lead to mass surveillance and other harms and to treat billions of innocent people as potential suspects.

Despite our findings that Clearview's activities violated Canadian privacy laws, the company refused to follow our recommendations, such as to delete Canadians’ photos.

My office is also investigating the RCMP’s use of Clearview AI. This investigation is nearing completion. We are also working with provincial and territorial colleagues to develop guidance for law enforcement agencies on the use of facial recognition technologies and expect to publish a draft for consultation in the coming weeks.

Risks

The Clearview case demonstrates how citizens are vulnerable to mass surveillance, facilitated by the use of facial recognition technology.

This is not the kind of society we want to live in.

The freedom to live and develop free from surveillance is a fundamental human right. Individuals do not forego their rights merely by participating in the world in ways that may reveal their face to others, or enable their image to be captured on camera.

The right to privacy is a prior condition to the exercise of other rights in our society. Poorly regulated uses of facial recognition technology therefore not only pose serious risks to privacy rights but also impact the ability to exercise other rights such as freedom of expression and association, equality, and democracy.

We must ensure that our laws are up to par, and that they impose limits to ensure respect for fundamental rights when this technology is used.

Legal framework

To effectively regulate facial recognition technologies, we need stronger protections in our privacy laws including: a rights-based approach to privacy; meaningful accountability measures; and stronger enforcement powers, among others.

The federal government recently introduced two proposals to modernize our privacy laws. These are important opportunities to better regulate the use of facial recognition and other new technologies.

Last November, the Department of Justice released a comprehensive and promising consultation paper that outlined numerous proposals to improve privacy legislation in the federal public sector. It proposes enhanced accountability requirements and measures aimed at providing meaningful oversight and quick and effective remedies.  It also proposes a stronger collection threshold which would require institutions to consider a number of factors to determine if the collection of personal information is “reasonably required” to achieve a specific purpose, such as ensuring the expected benefits are balanced against the privacy intrusiveness, so that collection is fair, not arbitrary, and is proportionate in scope.

In the private sector, Bill C-11 would introduce the Consumer Privacy Protection Act.  In my view, that Bill requires significant amendments to reduce the risks of facial recognition technology.

A rights-based approach

The significant risks posed by facial recognition technology make it abundantly clear that the rights and values of citizens must be protected by a strong, rights-based legislative framework. The Department of Justice proposes adding a purpose clause to the Privacy Act that specifies that one of the key objectives of the legislation is “protecting individuals’ human dignity, personal autonomy, and self-determination”, recognizing the broad scope of the right to privacy as a human right.

Conversely, Bill C-11 maintains that privacy and commercial interests are competing interests that must be balanced. In fact, compared to the current law in the private sector (the Personal Information Protection and Electronic Documents Act), the Bill gives more weight to commercial interests by adding new commercial factors to be considered in the balance, without adding any reference to the lessons of the past twenty years on technology’s disruption of rights.

Clearview was able to rely on the language of the current federal Act to argue that its purposes were appropriate and the balance should favour the company’s interests rather than privacy. Although we rejected these arguments, some legal commentators have suggested our findings would be a way to circumvent PIPEDA’s purpose clause by not giving sufficient weight to commercial interests. If C-11 were passed in its current form, Clearview and these commentators could still make such arguments.

I urge you to make clear in Bill C-11 that where there is a conflict between commercial objectives and privacy protection, Canadians’ privacy rights should prevail. Our submission analyzing this bill makes specific recommendations on the text that would achieve this goal.

Demonstrable accountability measures

Demonstrable accountability measures are another fundamental mechanism to protect Canadians from the risks posed by facial recognition.  

Key aspects of a meaningful accountability framework include a requirement for Privacy by Design and to conduct privacy impact assessments, as well as obligations for what is known as “traceability” for automated decision-making.

While most of these accountability measures are part of Justice’s proposals for modernizing the Privacy Act, they are all absent from Bill C-11.

Enforcement powers

Efforts to regulate facial recognition technologies must also include strong compliance mechanisms that provide quick and effective remedies for individuals.

Our investigation into Clearview revealed that the organization had contravened two obligations under Canadian privacy law.  On the one hand, it collected, used and disclosed biometric information without consent, and for an inappropriate purpose. Remarkably – and shockingly – the new administrative penalty regime created by Bill C-11 would not apply to these and other important violations of the legislation. Such a penalty regime renders meaningless laws that are supposed to protect citizens.

I therefore urge you to amend the Bill to remedy this fundamental flaw.

Conclusion

The nature of the risks posed by facial recognition technology calls for collective reflection on the limits of acceptable use of this technology. These limits should be defined not only by the risks associated with specific facial recognition initiatives, but by taking into account the aggregate societal effects of all such initiatives over time.

In the face of ever-increasing technological capabilities to intrude on our private lives, we need to ask ourselves what are the expectations we should be setting now for the future of privacy protection.

I welcome any questions you may have.