M. Imtiaz Karamat is an IP Osgoode Alumnus and Associate Lawyer at Deeth Williams Wall LLP. This article was originally posted onĚý on November 16, 2022.

On October 28, 2022, the Office of the Privacy Commissioner of Canada (the OPC)ĚýĚýthat data protection authorities around the world endorsed resolutions on facial recognition technology (FRT) and cybersecurity at the 44th Global Privacy Assembly (GPA) in Istanbul, TĂĽrkiye.

The GPA is an international forum where data protection and privacy authorities from more than 130 countries meet to discuss privacy matters of interest and coordinate efforts on an international scale.Ěý The theme of the public portion of the event was, “A matter of balance – Privacy in the era of rapid technological advancement”.

During the conference, the GPA members adopted a resolution on the use ofĚý, which outlined a series of principles and expectations that they would promote to external stakeholders, assess the real-world application therein, and report back on. These principles require an organization to do the following:

1. Lawful basis:Ěý have a lawful basis for collecting and using biometrics;
2. Reasonableness, necessity and proportionality:Ěýdemonstrate the reasonableness, necessity, and proportionality of their use of FRT;
3. Protection of human rights:Ěýassess and protect against unlawful interference with privacy and other human rights;
4. Transparency:Ěýensure that the use of FRT is transparent to affected individuals and groups;
5. Accountability:Ěýinclude clear and effective accountability mechanisms for the use of FRT; and
6. Data protection principles:Ěýensure that FRT is used in a way that respects all data protection principles.

The GPA also saw the adoption of aĚýĚýfor international cooperation in improving cybersecurity regulation and understanding the harms that results from cyber incidents. As part of this resolution, the endorsing GPA members would take steps to understand the responsibilities of data protection authorities regarding cybersecurity, and explore possibilities for international cooperation amongst members to avoid duplication in investigations and other regulatory activities.

The post 44th Global Privacy Assembly Leads To Resolutions On Facial Recognition Technology And Cybersecurity appeared first on IPOsgoode.

Raenelle Manning is an IPilogue Writer and a 2L JD Candidate at Osgoode Hall Law School.

On May 11^th, 2022, Google unveiled the , a 10-point scale designed to increase skin tone representation in image-based machine learning and artificial intelligence (AI) systems. The MST Scale is expected to be a more inclusive alternative to the current tech industry’s standard, , which has generally people with darker skin tones.

This representative scale is the result of a collaboration between the Google Research Center for Responsible AI and Human Centred Technology (RAI-HCT) and , a Harvard professor and sociologist, who leveraged his extensive research on racial inequality and colourism. , Monk hoped to disassociate race from skin tone in view of the fact that racial and ethnic groups often include a spectrum of skin tones. “A lot of the time people feel that they are lumped together into racial categories: the Black category, White category, the Asian category, etc., but in this there’s all this difference. You need a much more fine-grain complex understanding that will really do justice to this distinction between a broad racial category and all these phenotypic differences across these categories”.

Along with other Google products, the MST Scale will be implemented into the . Google’s search field will include a feature that allows users to refine their results by skin tone. For example, beauty-related searches like, “prom make up looks” can be filtered to produce images of people with the selected skin shade.Ěý Google also intends to create a standardized method of labelling web content with attributes like skin tone, hair texture and hair colour to increase representation.

Photo of

Skin Tone Equity in Technology

is a type of AI that allows computers to “see and understand images”, but when these systems are not intentionally built to include a spectrum of skins tones, they have been found to perform poorly on darker skin. Dr. Courtney Heldreth, a core researcher on the RAI-HCT team states that “ in how people are treated …and one example of colorism is when technology doesn’t see skin tone accurately, potentially exacerbating existing inequities”.

The issue of colour-biased technology has been previously raised in relation to facial recognition algorithms. A is another domain of computer vision that uses AI and machine learning to identify human faces in digital images.

As a MIT student, a dark-skinned black woman, noticed that some facial recognition systems could not identify her face, until she put on a white mask. In an effort to advocate for “algorithmic accountability”, she published an empirical study entitled, “” in 2018.Ěý The study assesses the facial analysis software used by Microsoft, IBM and Face ++. The objective of the study was to determine how well these systems could identify the gender of people with various skin tones. She tested each company’s systems using a personally developed data set of 1270 faces of people with light and dark skin tones. The faces were comprised of notable male and female parliamentarians from three African nations and three Nordic nations. The subjects’ skin tones were labelled using the six-point Fitzpatrick scale. that “darker-skinned females are the most misclassified group with error rates of up 34.7%, while the error rate for lighter skinned males is 0.8%.”Ěý

The study emphasizes that used to train it. The central issue was that the data sets used to develop the facial analysis software did not include a broad range of skin shades. Even if the data set was more inclusive, the those various darker shades. Since this study, there have been improvements to the accuracy of these company’s products. claims to have taken a more serious approach to addressing AI bias in their products.

Monk Skin Tone Scale Hopes to Improve Technology

There are to using computer vision systems that are not suitable to perform on darker skin tones. For example, the facial recognition software employed by law enforcement in the United States have been found to disproportionately misidentify African-Americans as suspected criminals. This is because they are underrepresented in the datasets used to develop the software, but overrepresented in mugshot databases. Resultingly, these biased have the potential to exacerbate racial disparities in criminal justice system and threaten civil liberties.

By making the MST Scale publicly available , Google is hoping that the MST Scale build systems that work better for people of all skin tones by creating representative data sets for Ěýtraining and evaluating AI models for fairness. As our society becomes increasingly dependent on AI processes, it is important that these technologies are developed responsibly and with inclusivity and diversity in mind.

The post How Google is Reducing AI Bias with Skin Tone Inclusive Technology appeared first on IPOsgoode.

M. Imtiaz Karamat is an IP Osgoode Alumnus and Associate Lawyer at Deeth Williams Wall LLP. This article was originally posted onĚý on May 18, 2022.

On May 2, 2022, Canada’s privacy regulatory authorities (the Regulators) issued aĚýĚýcalling for a legal framework that clearly establishes the acceptable circumstances for police to use facial recognition technology (FR).

Police agencies greatly benefit from FR, because it is a useful resource for solving crimes, locating missing persons, and supporting national security objectives. However, the Regulators noted that FR involves the collection and processing of highly sensitive biometric information, which raises a series of privacy and human rights concerns when it is applied on a large scale. Widespread adoption of the technology would enable police agencies to covertly identify and surveil individuals and this may impair Canadians’ privacy right to participate in the world without being regularly identified, tracked, and monitored.

The Regulators called for Canadian legislators to implement a legal framework that outlines the boundaries associated with FR. Although Canada’s current principle-based privacy laws are adaptable to evolving technologies, the Regulators took the position that they are too high-level to address the specific risks associated with police use of FR. They argued that the current legal framework leaves much discretion to police agencies, which creates the possibility for serious harms to an individual’s privacy and other fundamental rights.Ěý

In the joint statement, the Regulators suggested that a new legal framework should be implemented by legislators that includes the following:

• Defined Purpose and Prohibited Uses:ĚýA clearly defined purpose for police agencies to use FR and a list of prohibited uses, i.e. “no-go zones”.
• Necessity and Proportionality:ĚýOverarching requirements for the use of FR to be necessary and proportionate for a given objective.
• Independent Oversight:ĚýEmpowering an independent, external public body to oversee police use of FR, including requirements for police agencies to obtain authorization to launch an initiative.
• Mitigate Privacy Risks:ĚýPrivacy control measures that mitigate individuals’ risks, including controls to ensure the accuracy of information and appropriately limit data retention for police databanks.

Together with their joint statement, the Regulators released the final version of their joint privacy Ěýon FR use by police agencies that clarifies the agencies’ obligations under current laws. The guidance and joint statement are the product of a public consultation launched in June 2021, in which a large majority of stakeholders agreed that new legislation is required to govern police use of FR going forward.

The post Canada’s Privacy Regulators Call For New Legal Framework To Govern Police Use Of Facial Recognition Technology appeared first on IPOsgoode.

Photo by EFF ()

Brandon Pierre is an IPilogue Writer and a 1L JD Candidate at Osgoode Hall Law School.

Ěý

Facial recognition software company muddies the waters again, challenging orders from privacy authorities in British Columbia and testing current Canadian privacy law. In February 2021, the Privacy Commissioner of Canada (“the Commissioner”) released a on , concluding the company engaged in the unlawful collection, use, and disclosure of personal information through its facial recognition software. The Commissioner ordered Clearview AI to delete all data related to Canadians. While the Commissioner does not have the legislative authority to enforce this order, each province may generate privacy legislation to bind certain actors to its provisions.

Legal action in British Columbia

On December 14th, 2021, the Office of the Information and Privacy Commissioner for British Columbia issued a binding order to comply with the Commissioner’s 2021 recommendations (see ). The order cites sections of the Personal Information Protection Act about the provision of consent (ss. 6,7, 8) and limitations on the collection (s. 11), use (s. 14), and disclosure (s. 17) of personal information. This order serves as the basis of Clearview AI’s petition to the courts of British Colombia. According to the , Clearview AI petitioned the Supreme Court of British Columbia to declare the unreasonableness of the order. Clearview AI has previously defended its position that the biometric data it leverages assists law enforcement agencies around the world. Surprisingly, a discloses that many Canadian law enforcement agencies used Clearview AI’s facial recognition technology - including the , and the . Read more on the ethical implications of law enforcement’s use of this technology in Nikita Munjal’s article, .

Why Clearview AI matters In the wake of ’s swift and certain death on the order paper, the Clearview problem underscores the need for provincial legislation in the absence of clear federal directives in regulating privacy and accountability for the processing of personal information. Although Clearview AI and its supporters highlight the technology’s benefits, others argue that these benefits are insignificant when the general means by which it derives its technology clearly violates Canadians’ consent and privacy.

Privacy

Canadians are not the only people affected. Australia, Italy, France, and the United Kingdom have issued similar notices, each ordering the company to stop collecting, using, and disclosing biometric data and images from their residents. The self-described “World’s Largest Facial Network” boasts some 10 billion facial images sourced from public websites, news outlets, and social media.

Clearview AI matters because the Supreme Court of British Colombia’s decision can provide a roadmap for Canadian legislators to tackle urgent privacy violations.

Accountability

Among other legal defenses of its use and sourcing of the images that images, Clearview asserts that because these images are publicly available, they are not subject to copyright laws. Privacy considerations aside, this assertion has garnered the attention of prominent actors including Google, Facebook, Twitter, and LinkedIn. Clearview AI sources many, if not most, of their images from users of these services without the authorization of the companies that provide them. The technology companies contend that anything posted using their service is their protected intellectual property.

Conclusion

The Clearview problem exemplifies the multi-faceted issues of ownership, privacy, and accountability that confront legislators when drafting laws in the era of disruptive technologies such as facial recognition. To complicate matters further, rapidly developing technologies have the potential to circumvent the bounds of the laws before legislators can adequately address them.

There are muddy ethical and legal waters ahead for Clearview AI. The company abandoned all operations in Canada during the Commissioner’s investigation. Clearview AI retains images and biometric data on the likeness of thousands of Canadians among its hoard of billions of facial images.

Ěý

Ěý

Ěý

Ěý

Ěý

Ěý

Ěý

Ěý

Ěý

Ěý

Ěý

Ěý

Ěý

Ěý

Ěý

Ěý

Ěý

Ěý

Ěý

The post Muddy Waters Ahead for Clearview AI appeared first on IPOsgoode.

Photo by on

Shannon Flynn is a Guest Writer and the Managing Editor of Rehack Magazine

Although facial recognition may have begun as a useful tool for the masses, as with many things, it has become something that can be used against them. When paired with artificial intelligence, facial recognition software can sort through millions of photos to identify a single face or even a fragment of one.

The problem lies in the sourcing of these photos. Why is AI-driven facial recognition problematic, and what regulations and restrictions are in place in Canada to prevent its abuse?

The Problem With Clearview

Clearview is probably one of the best-known facial recognition programs in the world. Its AI is designed to detect and prevent crimes. By itself, this doesn’t sound like a bad thing. Ideally, AI programs can sort through many times the data a human worker could manage, finding collections and identifying people easily even with partial images to work with.

The problem does not lie in the algorithm itself, but rather in where it sources the images it sorts through. Clearview’s AI crawls the internet and can access, download, and store any image uploaded to social media. That means Clearview considers anything posted on Facebook, Twitter, Instagram, or other sites to be fair game. The company has also been accused of using to train the AI’s algorithm.

Many social media companies, including Google, Facebook, and Twitter, have of utilizing user images without authorization. It is important to note that this isn’t user authorization, but rather authorization of the social media program. Instagram’s terms of service include a to use anything individuals post on their site — but that doesn’t allow AI programs like Clearview to swoop in and take what they need.

Even under the best circumstances, allowing a program like Clearview to sort through social media imagery — even in public posts — could be considered a violation of privacy. The average user should not have to worry that corporations or government entities are watching everything they post online. Indeed, there is an in favor of stronger consumer protections where data gathering is concerned.

Regulations and Restrictions

In June 2021, the Office of the Privacy Commissioner of Canada (OPC) submitted a special report to Parliament about the Royal Canadian Mounted Police (RCMP) and their use of facial recognition technology. Again, Clearview AI was in the crosshairs for improper use of private user data scraped from various social media sites across the internet.

Billions of people, both in Canada and around the world, have suddenly found themselves in a “,” as the report states, without even the courtesy of due process.

As a result of this report, new policy guidelines have been drafted that clarify when and where the use of facial recognition technologies is appropriate. These guidelines focus on four key points: accuracy, data minimization, accountability, and transparency. Accuracy is one of the biggest concerns because AI-powered facial recognition technologies tend to be a lot less accurate than human detectives completing the same task. Law enforcement officials shouldn’t take any matches discovered by facial recognition at face value, and should always double-check the results before making an arrest or pursuing legal action.

Data minimization ensures large swaths of the population are not included in a search. It also helps reduce the impact of a data breach if one happens, which grows more common every year. Accountability is essential so everyone involved knows what data is being collected and how. This key component also includes information security.

Finally, transparency helps keep innocent people out of digital lineups simply for sharing a certain demographic with an assailant.

Looking Toward the Future

It may seem as if an individual’s information is fair game because it’s available on a public post, but this is not the case. Facial recognition technologies can be valuable for preventing and detecting crime, but only if those in power are not allowed to abuse it.

The new policy guidelines being embraced in Canada are just one piece of the puzzle. Every government that utilizes facial recognition should follow suit by embracing key tactics like accountability, transparency, accuracy, and data minimization to ensure the technologies are used properly.

The a fine line between tyranny and law enforcement should not be crossed, regardless of how easily one could click a button and find the “bad guy.”

The post Regulations and Restrictions for AI Facial Recognition Tech in Canada appeared first on IPOsgoode.

Photo Credit: ()

Natalie Bravo is anĚýIPilogueĚýWriter and a 2L JD Candidate atĚýOsgoodeĚýHall Law School.Ěý

Ěý

(FRT) is an increasingly popular and controversial tool used by public authorities and commercial institutions. FRT increases surveillance methods for investigative or security work. FRT easily collects vast quantities of biometric information with minimal cost or effort. Sensitive identity-based data is particularly valuable.

These databases and data collection methods are not without risk. Reports of and Canadian privacy law violations weaken the argument for implementing FRT. On June 10, 2021, issued a on FRT and -related surveillance as it pertains to the Canadian public. The special report specifically investigates the RCMP’s use of Clearview AI (with FRT), pursuant to section .

What is Clearview?

(“Clearview”) is an American-based entity that has amassed a wide catalogue of facial images with associated location information. Users with Clearview accounts can access the images for matching purposes. In October 2019, the RCMP confirmed that it . The OPC subsequently received a complaint under the . Clearview also has their

Canadian Legislation

The OPC investigation and report engages the Privacy Act, specifically : “No personal information shall be collected by a government institution unless it relates directly to an operating program or activity of the institution.”

Further, applies to “private-sector organizations across Canada that collect, use or disclose personal information in the course of a .” Commercial activity is defined by law as “any particular transaction, act, or conduct, or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists.”

, , and have their own privacy laws that may apply instead of PIPEDA. Most organizations within these provinces rely on provincial privacy laws, except for “,” or “ (FWUBs) such as banks, telecommunications and transportation companies,” .

2020 Investigation into Clearview

On February 21, 2020, the OPC, along with privacy authorities in , , and (“the Offices”), began investigating Clearview, their FRT database, and database disclosures pursuant to . Clearview’s collection practice was found to contravene privacy laws in all investigating jurisdictions. This investigation provided much of the backdrop for the subsequent RCMP investigation. As outlined in the , the Offices set out to identify whether Clearview:

1. “obtained requisite consent to collect, use and disclose personal information; and
2. collected, used and disclosed personal information for an appropriate purpose.”

The Commission d'accès à l'information (CAI) also sought to determine if Clearview had:

• “reported the creation of a database of biometric characteristics or measurements.”

The OPC’s February 2021 report of Clearview’s facial recognition tool identified .

“C±ô±đ˛ą°ů±ąľ±±đ·É:

1. “scrapes” images of faces and associated data from publicly accessible online sources (including social media), and stores that information in its database;
2. creates biometric identifiers in the form of numerical representations for each image;

• allows users to upload an image, which is then assessed against those biometric identifiers and matched to images in its database; and

1. provides a list of results, containing all matching images and metadata. If a user clicks on any of these results, they are directed to the original source page of the image.”

The OPC found that Clearview’s database contains over , including pictures of Canadian faces (including children) collected without their knowledge or consent. Clearview allows law authorities and commercial entities to match people to online images within their database. The OPC found that the large image database “The OPC stated that police authorities can “essentially” subject billions of people Ěýto a non-consensual .

The OPC concluded that Clearview’s operations harm Canadians as they may detriment individuals whose photos are used without their explicit and informed consent. The method in which images were scraped from web pages was also found to be “”, among other Clearview activities.

The OPC provided three recommendations for Clearview to better comply with federal and provincial privacy laws: cease offering its facial recognition tool to clients in Canada; (ii) cease the collection, use and disclosure of images and biometric facial arrays collected from individuals in Canada; and (iii) delete images and biometric facial arrays collected from individuals in Canada in its possession.”

, noting that they had withdrawn from Canada during the investigation, and did not commit to the recommendations. Clearview also suggested that the OPC should suspend the investigation and not publish the report.

RCMP Investigation in the Special Report:

As Clearview was clearly found to contravene privacy laws, the RCMP’s use of Clearview technology was also the Privacy Act’s collection policies.

Curiously, ; that was false and concerned the OPC. According to , the RCMP made hundreds of search requests through the database on at least 19 accounts. The OPC assessed the RCMP’s They found that the RCMP failed to properly ensure that their use of Clearview technology complied with the Privacy Act. Further, the RCMP did not report any system implemented to “ Clearview’s data. This represented a serious lack of care regarding the sensitive information collected. Ultimately, the OPC recommended “ within a year to handle (any) novel collections of data.

The RCMP that they violated section 4 of the Privacy Act. In fact, they argued that under the Act, they do not have a duty to ensure legal compliance of private third parties like Clearview. However, they did agree to OPC’s recommendations in an effort to improve operations.

Soon after the OPC launched their RCMP investigation, the RCMP internally worked to some of the issues. They restricted their use of Clearview and started the “National Technology Onboarding Program” to look into how novel investigative techniques comply with the Privacy Act and the . As of July 2020, Clearview stopped offering its services to Canada, and the RCMP stopped using it altogether.

In light of this , the OPC published the “” (“the Draft”) to provide provincial, regional, federal, and municipal police agencies with more detailed privacy compliance information. The guide offers a with various related guidance, and data management related to , , , , , and more.

The OPC also offers up-to-date information on the accuracy of FRT and algorithms, emphasizing the . In the same way, the guide underlines “.” In other words, agencies should only collect and retain what is necessary, rather than cast a wide net. The is a rather thorough document with many references to specific case law and related authority. It demonstrates the importance of privacy in Canadian society and the seriousness in which Canadian officials deal with consent, surveillance, and novel technology. FRT may evolve into a useful tool, but until it meets the recommendations of the OPC, the RCMP will need some constructive and careful effort to use FRT again.

The post A 24/7 Police Line-up: Clearview AI, the RCMP, and Privacy Laws appeared first on IPOsgoode.

Tiffany Wang is an IPilogue Writer, IP Innovation Clinic Fellow, and a 2L JD Candidate at Osgoode Hall Law School.

Ěý

“Always eyes watching you and the voice enveloping you. Asleep or awake, indoors or out of doors, in the bath or bed—no escape. Nothing was your own except the few cubic centimeters in your skull.”

Nineteen Eighty-Four by George Orwell

Sprawling throughout New 91ŃÇÉ« City, cameras observe and record faces and movements. These seemingly omnipresent lenses conduct and generate facial-recognition data for the New 91ŃÇÉ« Police Department (“NYPD”), capturing footage to identify individuals for criminal enforcement efforts.Ěý

Surveillance by security cameras is not unique to the Big Apple. Chinese police forces deploy , notifying security personnel whenever or target appears in sight. . In total, operate to surveil the population of New 91ŃÇÉ«.Ěý

Not only do public cameras tower over the city, but also record information that the NYPD may access with permission.

The Big Apple’s capture action in an area less than two square miles. Over ninety percent of residents are racial minorities.Ěý

, serves the United States federal and state police forces. In 2019, the revealed that Idemia’s algorithms are prone to confuse racial minorities’ faces. Similarly, the

of facial data raises concerns of . If commercial algorithms continue to demonstrate significant errors in identifying individuals with varying skin tones, these concerns will quickly escalate to . Tensions may ultimately result in the NYPD

Could over 15,000 eyes create a dystopia? After all, .ĚýĚý

The post 15,000 Eyes in New 91ŃÇÉ« City appeared first on IPOsgoode.

The Push: It seems inevitable for facial recognition technologies to evolve for use beyond unlocking smartphones, and Tamir agrees with this hypothesis. He notes that the technology has improved substantially and will be able to provide a new level of efficiency at the border. For one, facial recognition has become cheaper overall, notably in relation to the cameras necessary. This renders these technologies affordable for large-scale security use at the border.

A basic example of current usage is an online passport application process adopted in the UK, through which a facial analytic process checks the quality of the images and rejects the ones that do not meet the requirements. Though this example a rudimentary, Tamir projects this to be the mere beginning of such technology use at airports. He specifically speaks to a pilot project that may result in facial recognition technology eliminating the need to check travellers’ passports. Instead, their .

The Pull: Facial recognition technology must still overcome a demonstrable capacity for error before it can be widely adopted. Tamir acknowledges that the current technology has reached a general level of accuracy that renders it useful for the government to implement, but it is still not perfectly accurate. Alarmingly, even an error rate of 1% would result in thousands of errors per day when considering the mass flow of people in and out of an airport daily.

Of more concern here, however, is that these errors are not evenly distributed among the population. Tamir identifies two specific forms of errors: false positives (whereby someone is erroneously matched as an individual they are not, which is of primary concern if an innocent individual is falsely matched as a suspect/wanted criminal), and false negatives (whereby the technology cannot match an individual to a genuine photo of them). A particular challenge with regard to these errors is racial bias: facial recognition systems have a harder time matching people of darker skin tones. If airports implement facial recognition technologies, members of visible minorities would face an unfairly greater risk of a false negative.

The magnitude of such errors can be seen within the aforementioned UK passport application process, which . Though not mentioned on the podcast, examples of false negatives have also .Ěý Tamir notes that such biases would severely affect immigration where an individual would lack the necessary means to dispute errors in the system. Conclusively, large-scale border use of facial recognition technology presents a genuine danger of inflicting more harm on some people than others.

The Peril: Zooming in more closely on Canadian law, Tamir notes that our current legal toolkit is inadequate. Canada does not have much regulation on facial recognition specifically. The central privacy protection we have is the , which was enacted in 1983 and has not been meaningfully updated to accommodate rapidly changing facial recognition technology. More specifically, we would require laws that prioritize transparency. The public should be able to access information about facial recognition technology and its error rates, or other possible downfalls. If we are to implement facial recognition technology at our borders, we need a legal framework that touches upon these issues.

The ongoing pandemic has halted many pilot projects surrounding facial recognition at airports. Considering these technologies are currently at somewhat of a standstill, now is a great time to engage in discourse regarding the future of facial recognition technology, which appears to be evolving faster than the law can keep up. In considering whether or not we are ready for widespread facial recognition use, Tamir’s insights help us understand how we can prepare to be ready before facial recognition lands at our airports, and this podcast is therefore a worthwhile listen.Ěý

Written by Saumia Ganeshamoorthy, a second-year JD candidate at Osgoode Hall Law School and a contributing IPilogue editor.

The post Facial Recognition: Are We Ready for It? appeared first on IPOsgoode.

For the past months, people in major cities of North America were back on the streets to protest amid the pandemic happening around the world. Two of those unfortunate incidents that led to these protests are: being killed while being arrested by the Minneapolis police officers and the death of after her mother called the Toronto police to take her to Centre for Addiction and Mental Health. Protestors are now facing not only concerns but also .

There are various ways in which individuals can protect themselves while participating in a protest, from their to their . ĚýMany online resources have stressed the importance of being anonymous in protesting against police brutality. The anonymity is an important factor as it can help protestors avoid being identified by the authorities, attracting unwanted surveillance and other possible negative consequences. There is significant for people participating in a protest. Journalists and fellow protestors may have recorded or live streamed the protest and relevant events or posted on social media. This kind of footages might not only be documenting what have happened, but also might be used to identify the protestors. In certain situations, being recognized or identified as participating in a protest might result in negative consequences, such as individuals losing their jobs.

Previously on IPilogue, “” discussed about facial recognition technology and Clearview AI and the relevant privacy law matters in Canada. Ěý“” has pointed out how the facial recognition technology works and how uploading mask selfies may have an unintended effect of enriching the training data for the algorithm.

People () have used masks long before this pandemic. Masks have been used when people were sick, allergic to something, facing air pollution, working in a hazardous environment, not wearing make up or preferring to disguise their identity. Due to the current COVID-19 outbreak, people outside Asia started to view the face coverings differently. At the beginning of this year, there were as to whether masks can prevent the virus from transmission. One of the arguments against wearing masks is that it would provide a for people and people might act less carefully. This might also be true in the situation for people believing that masks can conceal their identity.

On the one hand, the mask can provide protection to the person who is wearing it so that person will be less likely to be exposed to possible COVID-19 infection, since in some circumstances, physical distance cannot be kept. To some extent, marks (with protective glasses and other protective gear) can protect the person when there is tear gas or pepper spray. Also, to some extent, the mask can prevent the person from being identified by the facial recognition technology used by law enforcement surveillance.

However, on the other hand, the mask needs to be used properly in order to prevent the spread of COVID-19. Though masks might be medical grade, they are not always helpful in protecting the person from teargas or pepper spray. Moreover, there is being developed for recognizing people with partial images. in the United States and in Germany both developed the periocular technology for commercial use. While Rank One Computing specified law enforcement as one of their potential clients, BioID focused mostly on biometric authentication services and stated that their service separated identity from biometrics.

Periocular recognition technology was to enhance the performance of iris recognition algorithms. The currently developed by Rank One Computing uses only the eye and eyebrow regions of the face for recognition. Therefore, it can detect the human faces even when they are wearing masks. After the successful recognition of human faces, the periocular recognition algorithms will then proceed to the identification stage which is similar to the templates that face recognition algorithms use.

Periocular recognition technology as well as facial recognition and iris recognition technologies are not only developed for the use of law enforcement, but also for identify verification in retail, financial services, consumer electronic devices and healthcare sectors. These technologies can do more than preventing . On the one hand, people expect law enforcement to investigate crimes using the most updated technology available when watching TV shows like Forensic Files or fictional procedural dramas. However, on the other hand, people feared that the authority might be using the most updated technology available for surveillance purposes on or just ordinary citizens. The worries about one’s privacy became more imminent as the risk of surveillance increases.

The periocular recognition technology is relatively new and not yet attract much attention. It is also unknown as to how Canadian courts would react to periocular recognition results, either on a privacy perspective or as evidence in criminal law cases. Nonetheless, the concerns about privacy, human rights and civil liberty threatened by the use of facial recognition surveillance in Canada surely has been rising among . It is clear that people are becoming more and more concerned about their appearance in public, with or without masks.

Written by Ya-En Cheng, a second year JD Candidate at Osgoode Hall Law School. Ya-En is also an IP Innovation Clinic Fellow.

The post Anonymity and Security of Protestors: Can Masks Really Protect your Identity? appeared first on IPOsgoode.

Far less attention has been paid to how retailers are using the same technology to improve customer loyalty and increase sales.Ěý For example, has been using facial recognition technology to identify VIPs in its Toronto store.

For brick and mortar retailers, facial recognition technology holds tremendous value. Marketing analysts have described how shoppers interact and behave within the actual retail environment as a Facial recognition technology could potentially provide marketers with the insights they’ve been missing.Ěý

From an IP commercialization perspective, patents represent only a fraction of facial recognition technology’s value. The data extracted by the algorithm is extremely lucrative. However, who can claim ownership rights over this data is not entirely clear cut.Ěý

Who Owns the Data?

Under Canadian law, . Instead, is protected by a number of different privacy laws at the federal and provincial levels. , the federal Personal Information Protection and Electronic Documents Act (PIPEDA) would apply to most retailers.

The economic importance of data has led to increased discussion around the need to create . However, that may not be necessary in this case. It’s uncertain if individuals could claim ownership over the personal information collected by a facial recognition technology program by virtue of their personality rights.ĚýĚý

What are Personality Rights?

Personality rights recognize that individuals have the right to protect their image, name, and voice from commercial exploitation. Several jurisdictions () protect the right through their provincial privacy legislation. provides statutory protection through its Civil Code. In , the right is entirely governed by the common law.Ěý

that are owned by individuals. Like other forms of property, they can be licensed and even inherited upon death.

The limited cases on wrongful appropriation of personality in Canada have involved celebrities or well-known figures, though celebrity is not a requirement. This raises the question of whether individuals could license their personality rights to companies. Licensing personality rights could potentially provide a new revenue stream for individuals and even data brokerages that already buy and sell personal data. For companies, it can create a burdensome problem of ensuring that appropriate permissions have been obtained.

Using someone’s personality for commercial purposes, without their consent is considered a . If successful, a plaintiff may be entitled to an injunction and damages.Ěý Case law suggests that a successful cause of action will require that (i) the plaintiff can be identified; and (ii) that their image was used for the purpose of commercial gain.

In , the court narrowed the scope of the tort to “endorsement-type situations.” This does not necessarily limit the cause of actions to celebrities endorsing products. The flexible language leaves the door open for courts to consider whether tracking and analyzing a customer’s shopping preferences to customize how they are marketed to would be considered an “endorsement-like situation.”ĚýĚýĚý

While some companies may be able to anonymize the data so that individuals aren’t identified, this may prove more difficult for retailers relying on facial recognition technology to identify customers within their loyalty programs.

Moreover, using someone’s facial identity to increase sales is a primary objective behind the retail sector’s use of the technology.Ěý For example, in New 91ŃÇÉ«, athletic footwear giant uses an algorithm to snap photos of shoppers in-store and rapidly build a profile that can track their emotional cues, for example, how interested they are in a particular product.Ěý Reebok has expressed hope that Ěýthese insights could be used to customers see while they’re in store.

Remaining Competitive Post-COVID-19 ĚýĚý
ĚýĚýĚý ĚýĚýĚý
The value of facial recognition technology to retailers may be even more important in the aftermath of COVID-19. Although the true financial ramifications of COVID-19 on the global economy are not yet fully known, competition among retailers has always been tough.
In light of this, the pressure to lower customer acquisition costs and keep existing customers is higher. (what a business must spend on marketing to obtain and keep a new customer), is a critical metric that can shine light on a company’s performance and future success. Anything companies can do to lower their marketing costs, while increasing their precision to enhance loyalty, will likely be helpful in

Facial recognition technology offers retailers a promise of improved customer service, lowered costs, and more efficient marketing. While tempting, the technology comes with strings attached and requires ongoing maintenance and vigilance on the retailer’s part to ensure they are compliant with privacy laws and larger public policy goals. Even if personality rights are not engaged, retailers must still be aware of their legal responsibility to safeguard individuals’ personal information under privacy legislation like PIPEDA.Ěý

In a , Kay Firth-Butterfield, Head of AI and Machine Learning at the World Economic Forum (WEF) cautioned companies to be aware of potential problems that AI can introduce, noting that substantial brand value can be lost if the wrong decisions are made about the use of AI. Firth-Butterfield stressed that the fast pace of change surrounding the technology requires companies start thinking about regulatory and governance mechanisms now not later.

The around the use of artificial intelligence by companies. As more jurisdictions are enacting privacy legislation to respond to the growing use of artificial intelligence in commercial settings, businesses may face additional barriers before they can fully implement the technology. Companies could see new compliance requirements that either reflect or closely align with the legislation that is already in force in other jurisdictions, like the General Data Protection Regulation (GDPR) in Europe.

The added expense required to safeguard the information and ensure that staff are trained to use it may not be enough to justify taking on the risk, particularly for small- to mid-size businesses who cannot shield the costs and administrative burdens as easily.Ěý

If there is a silver lining for companies, it may be that that PIPEDA serves a distinct purpose that can be distinguished from other federal and provincial privacy legislation. Namely, PIPEDA must balance protecting individuals’ privacy with the need for commercial organizations to collect and use personal information.Ěý

So while it is unlikely that the OPC will issue recommendations that stifle commercial activity, it would be reasonable for retailers to expect that they will need to take extra precautions to ensure highly sensitive personal information is protected.

Ultimately, it will be for retailers to decide if the benefits outweigh the costs.ĚýĚýĚý

Maggie Vourakes is a JD candidate at Osgoode Hall Law School.

The post Facial Recognition Technology and the Retail Sector: Opportunity or Liability? appeared first on IPOsgoode.