Language selection

OPC Logo Office of the Privacy Commissioner of Canada

Search

Statement by the Privacy Commissioner of Canada following an investigation into the RCMP’s use of Clearview AI

June 10, 2021
By teleconference

Privacy Commissioner of Canada Daniel Therrien issued the following statement at a media teleconference.

(Check against delivery)

Good morning.

The Special Report on my office’s investigation into the RCMP’s use of Clearview AI’s facial recognition technology has been tabled in Parliament.

Our report of findings tells the second part of a story that began earlier this year, when we released the results of an investigation into the practices of Clearview itself.

Clearview AI created a databank of more than three billion images scraped from internet websites without users’ consent. Clients of the service, such as the RCMP, could match photographs of people against the photographs in the databank.

Back in February, we and our counterparts in Quebec, Alberta and B.C. found Clearview’s practices to be mass surveillance and illegal under federal and provincial private sector privacy laws.

Now, our most recent investigation has concluded that the RCMP contravened the federal public sector law, the Privacy Act, when it collected information from Clearview. In our view, a government institution simply cannot collect personal information from a third party agent if that third party’s collection was unlawful in the first place.

Our investigation highlighted other concerns.

Notably, we found there were serious and systemic gaps in the RCMP’s policies and systems to track, identify, assess and control novel collections of personal information through new technologies.

Police use of facial recognition technologies, with its power to disrupt anonymity in public spaces, and enable mass surveillance, raises the potential for serious privacy harms unless appropriate privacy protections are in place.

Canadians must be free to participate in the increasingly digital, day-to-day activities of a modern society without the risk of their activities being routinely identified, tracked and monitored.

While certain intrusions on this right can be justified in specific circumstances, individuals do not forego their right to privacy merely by living and moving in the world in ways that may reveal their face to others, or that may enable their image to be captured on camera.

Today, my office, along with our provincial and territorial counterparts, are launching a consultation on draft guidance to help police ensure any use of facial recognition technology complies with current laws and minimizes privacy risks. We will be consulting police, civil society and other stakeholders on the content of the guidance before it is finalized.

We also believe that it is necessary to carefully consider issues related to facial recognition technology as Canada looks to modernize federal privacy laws.

Currently, the use of this technology is regulated through a patchwork of statutes and case law that, for the most part, do not specifically address the risks posed by the technology. This creates room for uncertainty concerning what uses of facial recognition may be acceptable, and under what circumstances.

The nature of the risks posed by FRT calls for collective reflection on the limits of acceptable use of the technology.

For instance, our Clearview AI and RCMP investigations underscore a key gap that we see more and more frequently when our federal privacy laws apply to public-private partnerships.

In the RCMP investigation, we found the onus was on the police force to ensure the database it was using was compiled legally. However, the RCMP has argued doing so would create an unreasonable obligation and that the law does not expressly impose such a duty. That being said, we appreciate the RCMP is now committing to implement our recommendations, notwithstanding this fundamental disagreement.

Common privacy principles enshrined in both our public and private sector privacy laws would help address gaps in accountability where the sectors interact.

To that end, our submissions regarding Bill C-11 (in the privacy sector) and the Department of Justice consultation on the Privacy Act (in the public sector) propose that our federal privacy laws should share a rights-based foundation. They should also include the privacy principles of necessity and proportionality to ensure that practices that could be privacy invasive are carried out for a sufficiently important objective, and that they are narrowly tailored so as not to intrude on privacy rights more than is necessary.

Furthermore, our laws should clarify that the concept of publicly available personal information (public information), which allows for some exceptions within privacy legislation, does not apply to information where an individual has a reasonable expectation of privacy. This is particularly critical in the case of facial recognition technology, which relies on massive databases of images that Canadians do not always consider public.  

I would be happy to answer any questions you have about our investigative findings, our draft guidance for police or our proposals for legislative reform.

Related content:

Date modified: