The rise of facial recognition technology and Canada's response

Many of us use facial recognition technology on a daily basis when unlocking our phones. This ‎technology continues to evolve and be used more widely, including in ways people may not expect ‎and with associated privacy concerns, including misidentification. For example, many sports stadiums ‎around the world use facial recognition technology to identify banned fans, resulting in the occasional ‎misidentification and false banning of a fan. ‎

Facial recognition technology understandably creates privacy concerns, with both individuals and privacy regulators.

Canadian privacy regulators have released two significant reports in the past years relating to investigations into the use of facial recognition technology. In an investigation of Cadillac Fairview Corporation Limited, released in 2020, the Canadian Office of the Privacy Commissioner (OPC) and provincial counterparts found that the use of “anonymous video analytics” technology, without consent, to collect and analyze facial biometric information to assess the age range and gender of mall visitors, contravened private-sector privacy laws.

The following year, another joint report addressed an investigation of Clearview AI, Inc, where privacy regulators found that facial recognition technology that drew on a database populated with over three billion facial images collected from publicly accessible online sources (including social media) similarly contravened privacy laws.

Most recently, on October 28, 2022, the OPC announced its adoption of a resolution at the 44th Global Privacy Assembly regarding the appropriate use of personal information in facial recognition technology. This resolution outlines six principles and expectations for organizations seeking to use the technology, including:

• Lawful basis: organizations using facial recognition technology should have a clear lawful basis for the collection and use of biometrics.
• Reasonableness, necessity and proportionality: organizations should establish, and be able to demonstrate the reasonableness, necessity and proportionality of their use of facial recognition technology.
• Protection of human rights: organizations should in particular assess and protect ‎against unlawful or arbitrary interference with privacy and other human rights.
• Transparency: the use of facial recognition technology should be transparent to affected ‎individuals and groups.
• Accountability: the use of facial recognition technology should include clear and effective ‎accountability mechanisms.
• Data protection principles: the use of facial recognition technology should respect all data ‎protection principles, including those referenced above.‎

With rising concerns, awareness and legal reforms surrounding the use of facial recognition technology, organizations must be cautious in its use. Organizations wishing to use facial recognition or other biometric technology, should seek professional legal advice on how to do so in a responsible manner.