On June 10, 2021, the Office of the Privacy Commissioner (OPC) released its Special Report to Parliament further to its investigation into the Royal Canadian Mounted Police’s (RCMP) use of the Clearview AI facial recognition technology (FRT). The OPC found that the Privacy Act had been violated, and made several recommendations to the RCMP relating to the law enforcement agency’s privacy policies, systems and training.
An OPC investigation earlier this year found that Clearview AI violated the Personal Information Protection Electronic Document Act through the use of its FRT to collect individuals’ photographs without their consent. FRT scrapes the internet for photographs of individuals which are used to create a “face-print”, or digital representation of that person’s unique facial features. The FRT compares an uploaded photograph or image against its database to identify an individual. When used by law enforcement, that identified individual may now be a suspect for a crime.
Clearview AI had scraped more than 3 billion images from the internet without obtaining consent from the pictured individual. It has been used by more than 600 law enforcement agencies worldwide. The RCMP started to use this FRT in October 2019. The OPC investigation determined that 6% of the RCMP searches were for child exploitation or child sexual abuse cases, and approximately 85% were unaccounted for searches.
The RCMP did not agree with the OPC’s conclusion that it had violated the Privacy Act, arguing that the legislation did not expressly impose an obligation on a federal public organization to ensure that a personal information database created by private sector partners had been compiled in compliance with applicable privacy legislation. It also argued that imposing such an obligation would be an unreasonable one for the police service. Despite this fundamental agreement, the RCMP agreed to implement the recommendations of the OPC.
In the Special Report, Privacy Commissioner Daniel Therrien stressed the importance of having privacy protections in place in the context of law enforcement. He stated:
Canadians must be free to participate voluntarily and actively in the regular, and increasingly digital, day-to-day activities of a modern society. They must be able to navigate public, semi-public, and private spaces without the risk of their activities being routinely identified, tracked and monitored.
While certain intrusions on this right can be justified in specific circumstances, individuals do not forego their right to privacy merely by participating in the world in ways that may reveal their face to others, or that may enable their image to be captured on camera. Privacy is vital to dignity, autonomy, personal growth and the free and open participation of individuals in democratic life. When surveillance increases, individuals can be deterred from exercising these rights and freedoms.
While the RCMP is a public institution, there are lessons to be learned for private sector businesses from this OPC investigation. Businesses are collecting and using large amounts of personal information of their clients – and often potential clients – when they adopt and implement new technologies. It is imperative that they are doing so in compliance with the applicable privacy law obligations. Businesses need to balance their commercial interests with the privacy interests of their clients.
One of the OPC’s recommendations was that the RCMP ensure that assessments for compliance with the Privacy Act are carried out in a timely way, informed by appropriate subject matter expertise commensurate to the issues identified, before personal information is collected for any law enforcement purposes. Private sector businesses would be wise to follow this recommendation – privacy impact assessments should be completed before undertaking the collection, processing or use of any personal information.
Alysia M. Christiaen is available to assist businesses comply with privacy obligations and to perform privacy impact assessments.
 Conducted with its counterparts in British Columbia, Alberta and Quebec.