By Jim Bronskill, The Canadian Press
OTTAWA — It should be illegal for police to use facial recognition technology to monitor people involved in peaceful protest, Canada’s privacy commissioners say in flagging a need for new legislation governing the emerging tool.
In a joint statement published Monday, federal, provincial and territorial privacy watchdogs also call for a prohibition on any police deployment of the technology that could result in mass surveillance.
The commissioners acknowledge the tool, which analyzes images for biometric facial data unique to a person, can be used to help solve serious crimes, locate missing people and support national security.
But they say facial recognition use by police for prevention and investigation of crimes should be authorized only if it is targeted, led by intelligence and subject to appropriate time limitations.
Facial recognition use by police is not subject to a clear and comprehensive set of rules, the commissioners warn. Instead, it is regulated through a patchwork of statutes that, for the most part, does not specifically address different uses or risks posed by the technology.
Federal privacy commissioner Daniel Therrien told a House of Commons committee studying the issue Monday that a national public consultation he and his counterparts carried out did not find a consensus on the content of a new law. “Legislators will therefore have to decide how to reconcile various interests.”
The privacy commissioners of British Columbia, Alberta and Quebec have ordered facial recognition company Clearview AI to stop collecting, using and disclosing images of people without consent.
An investigation by the three watchdogs and Therrien found in February last year that Clearview AI’s technology resulted in mass surveillance of Canadians and violated federal and provincial laws governing personal information.
They said the New York-based company’s scraping of billions of images of people from across the internet — to help police forces, financial institutions and other clients identify people — was a clear breach of Canadians’ privacy rights.
Last June, Therrien found the RCMP broke the law by using Clearview AI’s software to collect personal information.
In the statement issued Monday, the country’s privacy regulators say that as a starting point, the law should clearly and explicitly define the purposes for which police are allowed to use facial recognition.
Appropriate limits should entail restrictions on the creation and use of databases of facial images, including a prohibition on the indiscriminate collection of images for use in a database against which individual pictures might be compared and matched, they said.
“It should also include limits on police authorization to access or use databases of images created or maintained by other public bodies or by private entities. If police in Canada are authorized to use any such databases, the authorization should be clearly defined and narrow in scope, and it should require that the personal information within the database was collected lawfully.”
The law should also include restrictions on the circumstances in which an individual’s image may be entered into a comparison database — for example, only upon conviction of certain offences, or when a specific threat rises to a certain level, the commissioners said.
They also advocate:
— that any police use of facial recognition be both necessary and proportionate, weighing potential benefits against drawbacks;
— strong, independent oversight to ensure responsible implementation of facial recognition initiatives;
— rigorous testing of systems given the potential consequences of misidentification, which can include systemic bias against certain races and other groups; and
— prohibitions against keeping images of people who have been cleared of suspicion, such as bystanders captured on video, as well as individuals who have never been convicted of an offence or those who receive a pardon.