PRIVACY LAW IN CANADA
Through the ever-increasing improvements in technology, facial recognition software is becoming more and more common. Privacy laws, on both the provincial and federal level, determine when and where this type of technology may legally be used. Federal privacy laws in Canada are enforced and protected by the Privacy Commissioner of Canada and are governed by two pieces of federal legislation. The first, the Personal Information Protection and Electronic Documents Act (PIPEDA) governs the protection of personal information obtained through the private sector (mainly certain businesses in Canada). The second piece of legislation, the Privacy Act, governs the protection of personal information in the hands of the Canadian government.
Personal Information Protection and Electronic Documents Act (PIPEDA)
As outlined in the Personal Information Protection and Electronic Documents Act (PIPEDA), businesses who wish to gather personal information from customers or clients must first inform the individual that the information is being collected and the reason for the collection (i.e. what they intend on doing with the information). This allows the customer or client to provide informed consent to their personal information being collected, stored and potentially utilized in the future. The Act states that businesses must limit the collection of information to only what is required for the intended purpose. For example, if a business intends to collect customer information regarding the age of their customers to determine their target age range for marketing purposes, there would be no need to collect information regarding the customers gender as this is irrelevant to the intended purpose.
As such, private businesses bound by PIPEDA who wish to utilize facial recognition software must first inform their customer or client base of this intent and then obtain meaningful consent. Failure to do so may result in a complaint being made to the Privacy Commissioner of Canada. The Commissioner may then look into the business and may offer recommendations (but not orders) on how to resolve the issue. In certain circumstances, PIPEDA allows the Courts to intervene and order the business to change their business practices and/or pay damages to the complainant for suffering incurred as a result of the businesses actions.
Frequently Asked Questions
What is the Privacy Act?
Similar to PIPEDA, the Privacy Act states that the Canadian government must limit their collection of personal information from Canadian’s to information that directly relates to the purpose of the institution or operating program collecting the information. For example, a government institution dedicated to higher learning collecting information on the education levels of Canadians would not be permitted to collect information regarding the individual’s criminal history as this information is irrelevant to the purpose of the institution. The government institution collecting the information must also advise the individual of the purpose of the collection. Additionally, the government may not disclose personal information that it has collected without the consent of the individual to whom the information pertains, unless otherwise in accordance with the Act (the Act outlines a list of situations in which information may be disclosed without prior consent).
In situations where an individual feels as though facial recognition software is being improperly utilized by the government in regard to the collection and disclosure of personal information, the individual may file a complaint against the offending government agency or institution with the Privacy Commissioner of Canada. The Privacy Commissioner may then carry out an investigation to determine whether or not a breach of the Privacy Act has occurred. As with complaints made under PIPEDA, the Commissioner may make recommendations on how to resolve the issue, and in rare cases the Courts may step in and order that changes be made in how the government institution is collecting or utilizing personal information.
Expectation of Privacy – Airport v. Public
Though the Privacy Act protects Canadian’s privacy interests in relation to government institutions, it should be noted that individuals right to privacy may vary in certain circumstances. Particularly when dealing with facial recognition software, there is a difference between the level of privacy that can be expected by Canadians in different settings. For example, one would expect a lower threshold of privacy when traveling through an airport than they would walking down a public street. Individuals traveling through airports or across international borders are subject to a heightened level of scrutiny. Facial recognition software’s are being used at an increasing rate in airports as a way to document travelers’ movements and reduce fraud. In recent years, Canada Border Service Agency has begun to utilize Primary Inspection Kiosks in place of live agents. These kiosks use facial recognition software to verify the traveler. These programs comply with Canadian privacy laws, as it has long been decided by Canadian courts that individuals have a lesser expectation of privacy when traveling through airports and across borders.
What is Facial Recognition Software?
Facial Recognition software is a type of biometric software used to map an individual’s facial features and store the data for future recognition (similar to the idea of finger printing). The software then uses complex algorithms to compare images captured through live video to the stored data in order to determine the identity of the individual. Facial recognition software is utilized in a variety of ways including; to detect criminals or those known to cheat in casinos, as a safety feature on smartphones, in airports and at border crossings and on social media sites like Facebook. Additionally, facial recognition is used by the provincial government to prevent fraud in the processing of driver’s licenses in many provinces in Canada including Ontario, Manitoba and British Colombia.
The Future of Facial Recognition Software
Facial recognition software is becoming more popular across both the public and private sectors, a trend which is unlikely to fade. Most recently, a Cadillac Fairview owned mall in Calgary Alberta implemented facial recognition software in their digital directories to gather information on shoppers. Specifically, Cadillac Fairview indicated that they were using the software to monitor traffic and gather the ages and genders of shoppers, asserting that they were not storing images of the shoppers. Shoppers had not been notified of the existence of the software prior to using the directories, and as a result the software was quickly removed after shoppers expressed concern over privacy issues. The Privacy Commissioner of Canada also launched an investigation into the use of the software after numerous media reports surfaced.
Despite concerns over a reduction in privacy, many advocates for the software argue that it could also have many benefits. For example, a homeless shelter, the Calgary Drop-In, operating out of Calgary Alberta has begun exploring the idea of utilizing facial recognition software as an alternative to finger printing when checking in visitors to the centre. Finger printing can be a negative psychological trigger to those who have spent time incarcerated or those with mental health issues. Additionally, facial recognition software would be beneficial for those without government issued ID, who would not otherwise be permitted to check into the drop in centre.