Privacy laws lag behind as police forces consider use of facial recognition technology

Privacy advocates are calling on all levels of government to create specific regulations around police use of facial recognition technology.

Canada does not have a policy on the collection of biometrics, which are physical and behavioural characteristics that can be used to digitally identify people.

Because of that, there are no minimum standards for privacy, mitigation of risk or public transparency, according to the Office of the Privacy Commissioner of Canada’s website.

Biometrics enable a device to recognize an individual. Facial recognition is a type of biometric system.

Those systems work by scanning an image of a person’s face to identify unique measurable characteristics, like the distance between someone’s eyes or the width of their nose.

A computer creates a representation of the face and then compares it to the images in a database in an attempt to find a match.

“We need to have this discussion, and the police need to be dragged into that discussion, out of the shadows where they’re making decisions about currently deploying this sort of technology.”

He and others worry widespread use of this technology without proper oversight could erode individual privacy.

“Broadly speaking, our office has identified facial recognition as having the potential to be the most highly invasive of the current popular biometric identifying technologies,” Vito Pilieci, a spokesperson for the Office of the Privacy Commissioner of Canada, said in an email.

In the fall, privacy advocates and commissioners from across Canada urged federal, provincial and territorial governments to modernize privacy laws to better keep pace with technological change.

Nova Scotia’s Office of the Information and Privacy Commissioner said it is not aware of any province with legislation to specifically address facial recognition technology.

However, some provincial privacy laws might be broad enough to help protect people against the collection and use of their biometric data, according to Janet Burt-Gerrans, the acting director and chief privacy officer with the Nova Scotia office.

The federal Department of Justice said the country’s Privacy Act regulates to what extent federal entities can collect, use, disclose and retain personal information.

But that legislation does not apply to provincial or municipal police forces.

The RCMP are subject to the act, the Department of Justice said, meaning the force “can only collect personal information that relates directly to its mandate as Canada’s national police force.”

The department would not say if there are any plans for more robust regulations to manage the use of facial recognition technology.

Fraser said all police forces need to be more accountable for how their investigative techniques affect people’s privacy.

“We’ve consistently seen from the police that their understanding of reasonable expectation of privacy is completely disconnected from what most of us think a reasonable expectation of privacy is, so we can’t have police making those decisions.”

The RCMP are not using facial recognition technology.

“However we continue to monitor new and evolving technology,” the force said in an email.

Calgary police regularly use the technology and Toronto police have tested out their own system. Edmonton and Saskatoon are considering it.

Montreal police would not confirm whether they use facial recognition systems. Halifax, Winnipeg and Vancouver say they do not.

Other police forces contacted did not respond to inquiries.

Calgary police say the technology has worked well for them, cutting down on the time it takes to identify suspects.

Having an officer manually scroll through mug shots on a computer looking for a potential match to a suspect “would be a considerable amount of hours, if not days, trying to find a suitable match,” said Staff Sgt. Gordon MacDonald of Calgary’s criminal identification unit.

The system returns results within two minutes.

MacDonald said there are strict rules about how the system is run and officers only use it to compare images with mug shots.

“It’s such a valuable technology we wouldn’t want to do anything that would jeopardize our permission to have it,” he said.

There are about 350,000 mug shots of people who have been charged with various offences in Calgary, but MacDonald said a national database would have to be created to make the system truly effective

“We just have a database that’s just purely for Calgary,” said MacDonald.

“Canada has such a transient population. People go from province to province and subjects of interest may appear in Calgary and they may be a resident of Edmonton. And of course our system would never find a possible match.”

A national database would change that, it would allow officers in any part of the country to match images with mug shots from anywhere in Canada.

Fraser said before there is a national database, law enforcement, privacy regulators and members of the public need to develop regulations on how that system would be used. He said there’s a risk of informal national systems being set up as police departments look at sharing more information.

“These sorts of initiatives are probably happening outside of view and so we need to put in place regulations before we end up with a de facto national database,” he said.

Michael Arntfield, a Western University criminologist and former police officer, agrees. He said clear regulations would reassure people that police are using facial recognition responsibly.

He said without rules the door is open to private companies to offer their services to police.

“I think that would alleviate the concerns that I think people have about using a private-sector third party to compare to wedding photos that were scraped from social media accounts,” said Arntfield.

Fraser said police have access to many technologies that allow them to monitor people and society needs to decide when law enforcement should be allowed to use those tools.

“They don’t get to use every tool at their disposal, they get to use appropriate tools,” he said. “There are intrusive technologies that need to be regulated because they could be horrifically abused or they could be mildly abused in a widespread sort of way that leads to a significant diminution in our privacy rights.”

CBC