Companies have started collecting and selling databases of Canadians’ biometric information that can identify them. However, these companies don’t always ask for your consent. Is this legal? What are the rules?
What are biometrics?
Biometrics are increasingly popular. It’s a technology that allows computers to identify people using their physical characteristics. There are many ways of identifying people, such as using your fingerprints, DNA, voice, or retina. For example, many cellphones have fingerprint or facial scanners, and some banks can use your ‘voice print’ to identify you when you call.
What are the rules?
Quebec has strict rules about the collection of biometric information. Companies must inform the Commission d’accès à l’information (access to information commission) before collecting any biometric information. This allows the Commission to protect people’s privacy and prevent the misuse of this sensitive data.
For a company to legally collect biometric information, there are two requirements:
- Obtain your informed consent. This means you must understand why your biometric information is being recorded.
- Have a serious reason to collect your biometric information. The definition of a “serious reason” to collect biometric information in Quebec is not yet clear. However, the Commission has decided that collecting client’s fingerprints to let them check-out faster at a store is not a valid reason.
Clearview’s database declared illegal
Clearview, a private company, collected publicly available photographs from social media to create a database of millions of faces. Importantly, Clearview did not obtain anyone’s consent to do so.
It then sold access to that database to various agencies, including the Royal Canadian Mounted Police (RCMP).
Quebec’s Commission conducted a joint investigation with the privacy commissions of Canada, Alberta, and British Columbia. This joint investigation found that Clearview’s practice of collecting and sale of biometric information was illegal because Clearview did not ask for consent before using publicly available images of people’s faces.
Clearview ceased operating its Canadian database in August 2020.
To learn more about biometrics, you can visit the Commission’s website.