Photo Credit: ()

Natalie Bravo is anÌęIPilogueÌęWriter and a 2L JD Candidate atÌęOsgoodeÌęHall Law School.Ìę

Ìę

(FRT) is an increasingly popular and controversial tool used by public authorities and commercial institutions. FRT increases surveillance methods for investigative or security work. FRT easily collects vast quantities of biometric information with minimal cost or effort. Sensitive identity-based data is particularly valuable.

These databases and data collection methods are not without risk. Reports of and Canadian privacy law violations weaken the argument for implementing FRT. On June 10, 2021, issued a on FRT and -related surveillance as it pertains to the Canadian public. The special report specifically investigates the RCMP’s use of Clearview AI (with FRT), pursuant to section .

What is Clearview?

(“Clearview”) is an American-based entity that has amassed a wide catalogue of facial images with associated location information. Users with Clearview accounts can access the images for matching purposes. In October 2019, the RCMP confirmed that it . The OPC subsequently received a complaint under the . Clearview also has their

Canadian Legislation

The OPC investigation and report engages the Privacy Act, specifically : “No personal information shall be collected by a government institution unless it relates directly to an operating program or activity of the institution.”

Further, applies to “private-sector organizations across Canada that collect, use or disclose personal information in the course of a .” Commercial activity is defined by law as “any particular transaction, act, or conduct, or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists.”

, , and have their own privacy laws that may apply instead of PIPEDA. Most organizations within these provinces rely on provincial privacy laws, except for “,” or “ (FWUBs) such as banks, telecommunications and transportation companies,” .

2020 Investigation into Clearview

On February 21, 2020, the OPC, along with privacy authorities in , , and (“the Offices”), began investigating Clearview, their FRT database, and database disclosures pursuant to . Clearview’s collection practice was found to contravene privacy laws in all investigating jurisdictions. This investigation provided much of the backdrop for the subsequent RCMP investigation. As outlined in the , the Offices set out to identify whether Clearview:

1. “obtained requisite consent to collect, use and disclose personal information; and
2. collected, used and disclosed personal information for an appropriate purpose.”

The Commission d'accĂšs Ă  l'information (CAI) also sought to determine if Clearview had:

• “reported the creation of a database of biometric characteristics or measurements.”

The OPC’s February 2021 report of Clearview’s facial recognition tool identified .

“C±ô±đČč°ù±čŸ±±đ·É:

1. “scrapes” images of faces and associated data from publicly accessible online sources (including social media), and stores that information in its database;
2. creates biometric identifiers in the form of numerical representations for each image;

• allows users to upload an image, which is then assessed against those biometric identifiers and matched to images in its database; and

1. provides a list of results, containing all matching images and metadata. If a user clicks on any of these results, they are directed to the original source page of the image.”

The OPC found that Clearview’s database contains over , including pictures of Canadian faces (including children) collected without their knowledge or consent. Clearview allows law authorities and commercial entities to match people to online images within their database. The OPC found that the large image database “The OPC stated that police authorities can “essentially” subject billions of people Ìęto a non-consensual .

The OPC concluded that Clearview’s operations harm Canadians as they may detriment individuals whose photos are used without their explicit and informed consent. The method in which images were scraped from web pages was also found to be “”, among other Clearview activities.

The OPC provided three recommendations for Clearview to better comply with federal and provincial privacy laws: cease offering its facial recognition tool to clients in Canada; (ii) cease the collection, use and disclosure of images and biometric facial arrays collected from individuals in Canada; and (iii) delete images and biometric facial arrays collected from individuals in Canada in its possession.”

, noting that they had withdrawn from Canada during the investigation, and did not commit to the recommendations. Clearview also suggested that the OPC should suspend the investigation and not publish the report.

RCMP Investigation in the Special Report:

As Clearview was clearly found to contravene privacy laws, the RCMP’s use of Clearview technology was also the Privacy Act’s collection policies.

Curiously, ; that was false and concerned the OPC. According to , the RCMP made hundreds of search requests through the database on at least 19 accounts. The OPC assessed the RCMP’s They found that the RCMP failed to properly ensure that their use of Clearview technology complied with the Privacy Act. Further, the RCMP did not report any system implemented to “ Clearview’s data. This represented a serious lack of care regarding the sensitive information collected. Ultimately, the OPC recommended “ within a year to handle (any) novel collections of data.

The RCMP that they violated section 4 of the Privacy Act. In fact, they argued that under the Act, they do not have a duty to ensure legal compliance of private third parties like Clearview. However, they did agree to OPC’s recommendations in an effort to improve operations.

Soon after the OPC launched their RCMP investigation, the RCMP internally worked to some of the issues. They restricted their use of Clearview and started the “National Technology Onboarding Program” to look into how novel investigative techniques comply with the Privacy Act and the . As of July 2020, Clearview stopped offering its services to Canada, and the RCMP stopped using it altogether.

In light of this , the OPC published the “” (“the Draft”) to provide provincial, regional, federal, and municipal police agencies with more detailed privacy compliance information. The guide offers a with various related guidance, and data management related to , , , , , and more.

The OPC also offers up-to-date information on the accuracy of FRT and algorithms, emphasizing the . In the same way, the guide underlines “.” In other words, agencies should only collect and retain what is necessary, rather than cast a wide net. The is a rather thorough document with many references to specific case law and related authority. It demonstrates the importance of privacy in Canadian society and the seriousness in which Canadian officials deal with consent, surveillance, and novel technology. FRT may evolve into a useful tool, but until it meets the recommendations of the OPC, the RCMP will need some constructive and careful effort to use FRT again.

The post A 24/7 Police Line-up: Clearview AI, the RCMP, and Privacy Laws appeared first on IPOsgoode.

The privacy concerns about this automated analysis are central to this recent litigation, in which the plaintiffs allege that Facebook has unlawfully collected and stored biometric information derived from their faces. This case addresses two fundamental questions – are there privacy laws that cover the biometric analysis in question, and do these laws have jurisdiction over Facebook. These questions illustrate both the privacy concerns surrounding biometric analysis and the increasing difficulty addressing informational privacy across jurisdictions in the age of the internet.

Biometric Information

“Tagging” on Facebook is when a user identifies by name individuals in photos that have been uploaded to the site. “Tag Suggestions” is intended to encourage more tagging by users. It works by scanning uploaded photographs and analyzing them using “state-of-the-art facial recognition technology” to extract biometric identifiers. These identifiers are based on the geometric relationship of facial features unique to each person, such as the distance between the eyes, ears, and nose. Facebook then creates and stores this information as a digital representation, known as template, and automatically tag recognized individuals in all pictures in which they appear.

A chief concern articulated in the case is that the biometric information stored in these templates is biologically unique, and so once compromised, “the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions”, though the plaintiffs acknowledge that “[t]he full ramifications of biometric technology are not fully known”.

In Canada the application of privacy laws to biometric information is than the application of privacy laws to any other type of personal information. As of March 2013, the has not received any complaints under involving facial recognition.

However, in their , the OPC made it clear in no uncertain terms that recognition would likely trigger the application of PIPEDA when used by organizations in the course of a commercial activity. Commenting specifically on Facebook, the OPC stated that “of significant privacy concern is the fact that Facebook has the ability to combine facial biometric data with extensive information about users, including biographic data, location data, and associations with ‘friends’.”

In the US, the scope of what constitutes personal information is narrower, and biometric information is unregulated federally.Ìę However, the plaintiffs in this case reside in Illinois, which has its own .

Facebook asserts that the Illinois BIPA does not apply to Tag Suggestions, and even if it did, that the plaintiffs cannot pursue a claim under the Illinois BIPA because California state law, not that of Illinois, governs disputes with Facebook.

Jurisdiction

Unlike Illinois, California has not legislatively recognized a right to privacy in personal biometric data and has not implemented any specific protections for that right or afforded a private cause of action to enforce violations of it. The Facebook (as at January 30, 2015) state that "The laws of the State of California will govern this Statement, as well as any claim that might arise between you and us, without regard to conflict of law provisions."

However, the presiding judge ruled that adhering to Facebook’s terms would essentially override the ability of Illinois to draft legislation to protect the privacy rights of its citizens, and that “enforcing the contractual choice of California law would be contrary to this policy in the starkest way possible”. Thus, BIPA applies to Illinois Facebook users.

Canadian Perspective

Facebook has remained compliant with Canadian law, since the Tag Suggestions feature has not been available for Canadian Facebook users, or for photos they upload. Facebook has come into conflict with withÌę Canada’s stricter privacy rules , and responded by instituting appropriate changes to the site’s privacy terms.

Despite Facebook’s encouraging compliance with the OPC, there is a concern left unaddressed.ÌęThere is no reason to assume that pictures of Canadians uploaded to Facebook derive only from users in Canada. It is reasonable to assume that plenty of American Facebook users have uploaded images of Canadians, taken in Canada or elsewhere. Under the current process, these images are automatically scanned, profiled, and tagged. There is no way to filter out Canadians in advance, since there is no way to identify individuals as Canadian until the Tag Suggestions feature has run. The biometric informational privacy of Canadians is still intruded upon.

Facebook is notÌęconcerned about this because in its view the process occurs solely in the US, and is therefore not subject to PIPEDA, even though Canadians are involved. This illustrates a fundamental limitation of current informational privacy law – it is limited by geographical borders while information, once online, is not.

Lucas Gindin is an IPilogue Editor and a JD Candidate at Osgoode Hall Law School.

The post Re Facebook Biometric Information Privacy Litigation appeared first on IPOsgoode.