Webinar

Thinking of Using Biometric Facial Data? Proceed With Caution

Published:

June 9, 2023

Author(s):

• Sarah Anderson Dykema, CIPP/C, CIPM, AIGP
• David Wallace
• David Fraser
• Olivia Feschuk

Share

Print

You arrive at the legendary Madison Square Garden to catch the Mariah Carey concert. It’s the big event of the trip – the reason you came to New York City. Suddenly, a security guard pulls you aside, says they know you’re a lawyer, and tells you to leave the premises immediately due to pending litigation in which your law firm is involved. How’d they know? Biometric facial recognition technology. While we haven’t seen this kind of over-the-top scenario play out in Canada, use of biometric facial recognition technology is growing here, but not without pains. As recently as April 2023, the Office of the Information & Privacy Commissioner of British Columbia determined that 12 independently owned B.C. Canadian Tire dealers contravened Canadian privacy laws by employing facial recognition technology in their stores without obtaining the required consumers’ consent. The Commissioner recommended the province revamp its information protection legislation and highlighted the importance of Privacy Management Programs – which are set to become mandatory under the proposed new federal Consumer Privacy Protection Act (CPPA) – for businesses.

Biometric facial recognition technology is a powerful tool. Several Canadian privacy commissioners have described facial recognition as “generally referring to a category of biometric software that maps an individual’s facial features mathematically and stores the data as a faceprint”. Essentially, it uses software to analyze digital images, such as video/still images of individuals as they enter premises, and processes them using an algorithm to generate matches to facial images in a database. These matches can then be used to identify individuals.

Businesses across the globe are harnessing the power of biometric facial recognition technology. But there are important privacy law implications. If you’re thinking about using biometric facial recognition technology in your business, proceed with caution – and ask yourself these four questions first.

1. Why use biometric facial recognition?

Despite Madison Square Garden’s questionable use of biometric facial recognition technology to identify and exclude its business critics and opponents, there are many ways in which businesses can productively, reasonably and legally use this rapidly developing technology. Most businesses cite safety as their primary reason to deploy biometric facial recognition technology. For instance, the B.C. Canadian Tire dealers stated they used it to protect the safety of staff and customers, support asset protection and loss prevention and prevent “persons of interest” from causing more dangerous situations or committing repeat offences. Madison Square Garden also uses it to identify potential security threats, such as individuals who’ve previously broken rules or been violent at the venue. Other examples of reasonable uses include:

• Airports using it to efficiently check in globetrotters and guide them through security checkpoints.
• Casinos using it to bar patrons they suspect are likely to cheat or have previously “self excluded”.
• Retail stores using it to flag customers who have shoplifted in the past.

Despite these valuable uses of biometric facial recognition systems, many Canadian businesses remain hesitant to adopt the technology due to privacy concerns and uncertainty about the applicable rules.

2. Which Canadian laws apply to your use of biometric facial recognition technology?

In Canada, a business’s use of biometric facial recognition technology is subject to legal regulation under Canada’s federal privacy law and substantially similar provincial privacy laws.

PIPEDA. The Personal Information Protection and Electronic Documents Act (PIPEDA) governs how private sector organizations in Canada collect, use, and disclose personal information in the course of commercial activity. Businesses operating in Quebec, Alberta, and British Columbia are instead subject to provincial laws that are substantially similar to PIPEDA. The Consumer Privacy Protection Act (CPPA) will soon replace PIPEDA and will continue to require consent and reasonable purposes for the collection, use and disclosure of personal information. However, the CPPA will impose more significant penalties for non-compliance and create a new obligation for businesses to document and implement “Privacy Management Programs” – but it won’t specifically address biometric data as a subset of “personal information”.

Quebec. So far, Quebec is the only Canadian jurisdiction to enact a law specifically governing the use of biometric facial recognition technology. Quebec’s Act to establish a legal framework for information technology permits the use of the technology – but imposes registration and reporting requirements where there’s use of any database containing biometric information or where biometric systems are used for identification or authentication purposes.

To date, no other Canadian province appears to be contemplating new laws to regulate biometric data.

3. What are the legal requirements to use biometric facial recognition technology?

Canadian businesses using this technology must:

Get Consent. The Office of the Privacy Commissioner of Canada (OPC) and various provincial privacy regulators have been clear that whenever there is a collection of a facial image – even if only briefly retained – there is a collection of personal information. Generally, consent is the only basis upon which you can collect, use or disclose personal information under Canadian privacy laws. The Office of the Privacy Commissioner considers biometric information to be sensitive in almost all circumstances because it’s intrinsically, and in most instances permanently, linked to the individual: it’s distinctive, stable over time, difficult to change and largely unique to the individual. Given this sensitivity, an individual’s express (as opposed to merely implied) consent is required for any collection, use or disclosure of biometric information. For consent to be valid, customers must understand the purposes for the collection of the information – at or before the time the information is collected. In the context of biometric facial recognition technology, there could be two distinct forms of personal information collected: facial images or videos; and facial biometrics generated from those images. And as the B.C. Office of the Information & Privacy Commissioner noted in its Canadian Tire Dealers’ Investigation Report, both forms of personal information require sufficient consent (and none of the Canadian Tire dealers got it). Under PIPEDA, the collection, use or disclosure of “publicly available” information doesn’t require consent. But this consent exception is only available in very limited circumstances with respect to specific kinds of information outlined in PIPEDA’s regulations. For example, the exception doesn’t apply to the collection of personal information via security cameras. And to use it, a business must demonstrate it collected or used the “publicly available” information for a purpose related to that for which it was initially collected. For example, Clearview AI used technology that scraped facial images from the internet and created a searchable database containing more than three billion images of individual faces and corresponding biometric identifiers. Clearview argued it wasn’t required to obtain individuals’ consent because the images were found on and acquired from publicly accessible websites. The Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the Information and Privacy Commissioner for British Columbia, and the Information Privacy Commissioner of Alberta all disagreed: the information wasn’t “publicly available” and consent was required – and Clearview didn’t obtain it.

Consider Purposes. Even with consent, you must only collect or use personal information for purposes that a reasonable person would consider appropriate in the particular circumstances as informed by balancing the individual’s right to privacy with the business’s commercial needs. Relevant factors to weigh include:

• The amount and sensitivity of the personal information collected. As the C. Office of the Information & Privacy Commissioner confirmed in its Canadian Tire Dealers’ Investigation Report, biometric facial recognition data like facial images constitutes the “highest level of sensitivity” and “[t]he vast amount of information collected is one indicator of unreasonableness.”
• The likelihood of achieving the purposes for the collection. As the B.C. Office of the Information & Privacy Commissioner emphasized in its Canadian Tire Dealers’ Investigation Report, it’s critical that you be prepared to demonstrate the effectiveness of the technology in achieving your purposes; anecdotal evidence won’t make the cut. The gold standard: conduct a privacy impact assessment before you take the leap.
• The availability of less-intrusive methods. Explore methods of achieving your purposes that are less intrusive than biometric facial recognition technology. For example, in the Canadian Tire Dealers’ case, the stores in fact rarely used the personal information they collected, relying primarily on “traditional’ methods to achieve their purposes.

Secure Data. PIPEDA requires that security safeguards protecting data be commensurate with the sensitivity of the personal information. PIPEDA doesn’t define biometric data but it’s generally considered to be sensitive personal information so requires a higher degree of protection than other forms of personal information. You must implement appropriate security safeguards, and only retain the data for as long as is necessary to achieve the purpose for which it was collected.

Consider Quebec. Quebec businesses are subject to additional strict reporting requirements. They must inform the Commission d’acces a l’information (CAI) of any process that uses biometric data to verify an individual’s identity, regardless of whether the data is stored in a database. And if a business creates a database of biometric characteristics it must notify the CAI at least 60 days before the database becomes operative.

However, we expect these requirements will continue to develop rapidly – and soon. In late 2022, at the 44^th Global Privacy Assembly, privacy regulators from across the globe, including the Office of the Privacy Commissioner of Canada, adopted resolutions on the appropriate use of personal information in facial recognition technology and outlined six principles and expectations for organizations seeking to use this technology.

4. Could using biometric facial recognition technology be discriminatory?

After turning away numerous patrons based on their affiliations with Madison Square Garden’s adversaries, the company is being sued for violating a U.S. anti-discrimination law that protects against “wrongful refusal of admission” to “places of public entertainment or amusement.” Discrimination and bias is a consideration in the use of biometric facial recognition technology in Canada as well. For example, the accuracy of facial recognition systems has been reported to differ according to skin colour. Each Canadian province and territory, and the federal jurisdiction, has human rights legislation. While each law varies to some degree, they uniformly strictly prohibit businesses from using technology to discriminate based on any protected ground(s), including sex, race, national or ethnic origin, religion, age, sexual orientation and gender identity. So, before using biometric facial recognition technology, carefully consider how your specific use could have discriminatory impacts on groups protected by human rights laws.

Please contact your McInnes Cooper lawyer or any member of our Privacy, Data Protection & Cyber Security Team @ McInnes Cooper to discuss the legal risks of using biometric facial recognition technology and how you can mitigate those risks.

Share

Print