Facing the Realities of Facial Recognition Technology: Recommendations for Canada’s Privacy Act

Abstract

Canada’s federal institutions are collecting, using, and disclosing people’s facial information. They are also increasingly relying on technology that uses this information, in combination with automated decision-making processes, to uniquely identify individuals. This is happening in Canada today, without adequate direction and protection from the Privacy Act. The use of this technology raises significant privacy and security concerns for people in Canada, including the potential to enable mass surveillance and discrimination enabled by systems trained on datasets already imbued with prejudice and bias. \n \nBy implementing the following recommendations to amend the Privacy Act, the Government of Canada can mitigate serious privacy and security risks currently faced by people in Canada with respect to facial recognition technology: \n \n1. Acknowledge and explicitly account for the existence, in the Privacy Act, of personal information relating to a person’s physical or biological characteristics or biometric information, including facial information; \n \n2. Adequately safeguard the privacy and security of Canadians by implementing requirements concerning facial information. These requirements should provide: \n \na. Limitations on the collection, use, and disclosure of such information, requiring notice and either consent or explicit legislative permission; \n \nb. Requirements to minimize information collection; and \n \nc. More expansive security safeguard requirements. \n \nAlign the Privacy Act with the requirements of the Directive on Automated Decision-Making.2 This alignment would dictate more specific terms for use by law enforcement — ensuring public notice, bias testing, employee training, security risk assessments, and the need for a human to make a final decision in the case of high-impact decisions. These requirements should be expanded to provide for adequate and meaningful consultation before the deployment of this technology. \n4. Implement a federal moratorium on automated facial recognition and the disclosure of facial information, until: \n \na. The framework described in this submission has been developed in consultation with Canadians, as well as with government institutions and public servants in relevant government departments; and \n \nb. More research is done on the disproportionate impacts, or potential for disproportionate impact, on members of particular demographic groups, particular to the realities and populations in Canada. \n \nThis would enable legislators to develop a comprehensive and effective policy regulating the development as well as both current and future usage of facial recognition technology by federal institutions. With respect to the responsible governance of facial recognition technology, the Privacy Act has significant gaps and weaknesses that, if addressed, will: \n \nBetter respect the privacy rights of people in Canada; provide stronger accountability mechanisms that facilitate and improve the public’s trust in federal institutions, and; enhance the adaptability of federal institutions’ in the face of technological change.