Information & Ethics Committee on May 10th, 2021

[Daniel Therrien]

Thank you again, Mr. Chair.

Facial recognition technology has become an extremely powerful tool that, as we saw in the case involving Clearview AI, can identify a person in a bank of billions of photos or even among thousands of protesters. If used responsibly and in appropriate situations, it can provide significant benefits to society.

In law enforcement, for example, it can enable police to solve crimes or find missing persons. However, it requires the collection of sensitive personal information that is unique to each individual and permanent in nature. Facial recognition technology can be extremely privacy invasive. In addition to promoting widespread surveillance, it can produce biased results and undermine other human rights.

The recent Clearview AI investigation, conducted jointly with my counterparts in three provinces, demonstrated how facial recognition technology can lead to mass surveillance and help treat billions of innocent people as potential suspects. Despite our findings that Clearview AI's activities violated Canadian privacy laws, the company refused to follow our recommendations, such as destroying the photos of Canadians.

In addition, our office is currently investigating the Royal Canadian Mounted Police, or RCMP, use of Clearview AI technology. This investigation is nearing completion. We are also working with our colleagues in all provinces and territories to develop a guidance document on the use of facial recognition by police forces. We expect to release a draft of this document for consultation in the coming weeks.

The Clearview case demonstrates how citizens are vulnerable to mass surveillance facilitated by the use of facial recognition technology. This is not the kind of society we want to live in. The freedom to live and develop free from surveillance is a fundamental human right. Individuals do not forgo their rights merely by participating in the world in ways that may reveal their face to others or enable their image to be captured on camera.

The right to privacy is a prior condition to the exercise of other rights in our society. Poorly regulated uses of facial recognition technology, therefore, not only pose serious risks to privacy rights but also impact the ability to exercise such other rights as freedom of expression and association, equality and democracy. We must ensure that our laws are up to par and that they impose limits to ensure respect for fundamental rights when this technology is used.

To effectively regulate facial recognition technologies, we need stronger protections in our privacy laws, including, among other things, a rights-based approach to privacy, meaningful accountability measures and stronger enforcement powers. The federal government recently introduced two proposals to modernize our privacy laws. These are important opportunities to better regulate the use of facial recognition and other new technologies.

Last November, the Department of Justice released a comprehensive and promising consultation paper that outlined numerous proposals to improve privacy legislation in the federal public sector. It proposes enhanced accountability requirements and measures aimed at providing meaningful oversight and quick and effective remedies. It also proposes a stronger collection threshold, which would require institutions to consider a number of factors to determine if the collection of personal information is “reasonably required” to achieve a specific purpose, such as ensuring that the expected benefits are balanced against the privacy intrusiveness, so that collection is fair, not arbitrary and proportionate in scope.

In the private sector, Bill C-11 would introduce the consumer privacy protection act. In my view, as I stated in the last hearing, that bill requires significant amendments to reduce the risks of facial recognition technology. The significant risks posed by facial recognition technology make it abundantly clear that the rights and values of citizens must be protected by a strong, rights-based legislative framework. The Department of Justice proposes adding a purpose clause to the Privacy Act that specifies that one of the key objectives of the legislation is “protecting individuals' human dignity, personal autonomy, and self-determination”, recognizing the broad scope of the right to privacy as a human right.

Conversely, Bill C-11 maintains that privacy and commercial interests are competing interests that must be balanced. In fact, compared with the current law in the private sector, PIPEDA, the bill gives more weight to commercial interests by adding new commercial factors to be considered in the balance without adding any reference to the lessons of the past 20 years on technology's disruption of rights.

Clearview was able to rely on the language of the current federal act, PIPEDA, to argue that its purposes were appropriate and the balance should favour the company's interests rather than privacy. Although we rejected these arguments in our decision, some legal commentators have suggested that our findings would be a way to circumvent PIPEDA's purpose clause by not giving sufficient weight to commercial interests. Even though we found that Clearview breached PIPEDA, a number of commentators, including the company but not limited to the company, are saying that we actually misapplied the current purpose clause.

If Bill C-11 were passed in its current form, Clearview and these commentators could still make these arguments, buttressed by a purpose clause that gives more weight to commercial factors. I urge you to make clear in Bill C-11 that where there is a conflict between commercial objectives and privacy protection, Canadians' privacy rights should prevail. Our submission analyzing this bill makes specific recommendations on the text that would achieve this goal.

Demonstrable accountability measures are another fundamental mechanism to protect Canadians from the risks posed by facial recognition. Obligations to protect privacy by design, conduct privacy impact assessments, and ensure traceability with respect to automated decision-making are key elements of a meaningful accountability framework. While most of these accountability measures are part of the Department of Justice's proposals for modernizing public sector law, they are all absent from Bill C-11.

Efforts to regulate facial recognition technologies must also include robust compliance mechanisms that provide quick and effective remedies for individuals.

Our investigation into Clearview AI revealed that the organization had contravened two obligations under Canadian privacy law. On the one hand, it collected, used and disclosed biometric information without consent, and for an inappropriate purpose.

Remarkably—and shockingly—the new administrative penalty regime created by Bill C-11 would not apply to these and other important violations of the legislation. Such a penalty regime renders meaningless laws that are supposed to protect citizens.

I therefore urge you to amend the bill to remedy this fundamental flaw.

In conclusion, I would say that the nature of the risks posed by facial recognition technology calls for collective reflection on the limits of acceptable use of this technology. These limits should not be defined only by the risks associated with specific facial recognition initiatives, but by taking into account the aggregate social effects of all such initiatives over time.

In the face of ever-increasing technological capabilities to intrude on our private lives, we need to ask ourselves what are the expectations we should be setting now for the future of privacy protection.

I thank you again for your attention.

I welcome any questions you may have.

[The Chair, Conservative, Chris Warkentin]

Thank you, Commissioner.

Colleagues, I want you to be aware that we should be expecting a vote in the House of Commons. The bells may start as early as 12:35, so unless there's an objection at that point in time, I will assume there's unanimous consent to continue with the questions. We will ensure that sufficient time is allowed for members to log in, so that at 1:05, when the voting begins, members are logged in and able to vote.

Unless there's an objection from committee members, we'll continue with the questioning.

We will begin with Mr. Carrie.

[Colin Carrie, Conservative, Oshawa, ON]

Thank you very much, Mr. Chair.

Monsieur Therrien, I want to thank you for your wisdom. With Bill C-11 coming down the pipe, it's so important that we lean one way versus the other way.

I know with facial recognition, when you first see it, it's so cool. We all heard about the issue with Cadillac Fairview, the shopping mall issue. Maybe we'll get to that today, but even sites like Facebook, they have these tag suggestions and they insert them as default settings. Theses sites are collecting our data, our faces, and many times people are totally unaware of it. That's where I want to start our conversation today.

I come from Oshawa. Oshawa is one of those communities that historically built cars and sent people back and forth across the border, things along those lines. I want to talk to you a little bit about the international utilization of facial recognition. I've heard that border efficiencies could be improved. I was wondering if you could comment on the opportunity, perhaps, for these opt-in, opt-out options if we're going back and forth across borders for business or as individuals.

Are there any international conversations about the right to delete and destroy information that may be gathered from Canadians as they cross borders into other countries?

[Daniel Therrien]

I will answer the question by going back to the point that I made early in my statement that facial recognition can serve society. At the border, for instance, it can greatly accelerate and make more efficient the triage of individuals who wish to cross the border. In police and law enforcement, it can facilitate the resolution of crimes or find missing persons.

I would not start from the premise that facial recognition should be banned completely or even in certain sectors completely, as in law enforcement, for instance. It can be useful, but it is very special in that it collects the attributes of a person that are immutable. If there's a breach of that information in the company or the government department that has collected it, you cannot change your biometrics like you can change a password. It is immutable and that means that this particular technology needs to be regulated very rigorously so that it does bear fruit and provides benefits to society without creating nightmares for individuals who, again, can no longer protect their privacy if someone uses their biometrics, including facial recognition, for nefarious ends.

That would be my answer for the border.

[Colin Carrie, Conservative, Oshawa, ON]

It's a good answer. I sat on the international trade committee, and we just completed the CUSMA, agreement. As we move through this process with the framework of our trade agreements, do you have any thoughts about ensuring Canadians have their rights looked after when we enter into these trade agreements? Do you think CUSMA has sufficient protections in it, basically?

[Daniel Therrien]

That's a huge issue.

[Colin Carrie, Conservative, Oshawa, ON]

I know. That's why you get the big bucks.

[Daniel Therrien]

When the time comes to share personal information outside Canada, and still do it in a privacy-protected way, I think there needs to be additional safeguards to those that apply within Canada, because the risks to privacy are not the same when the data leaves the country. This does not mean that we should live in a data localization world where the data of Canadians does not leave Canada, but I think it's important to acknowledge that the risks are higher when the data leaves Canada.

Then of course comes the question of what additional protection should come in these situations, because we live in an interconnected world. We're neighbour to the United States. It's a reality that data often moves to the United States. I'm afraid I won't give an opinion on whether CUSMA adequately does that. Whether data leaves Canada is not a benign issue, and we should think hard about what additional protections should be created by Parliament to ensure that privacy continues to be protected when data does leave Canada.

[Colin Carrie, Conservative, Oshawa, ON]

That's excellent. Thank you very much.

Maybe another time I'll ask you about China and that might be a more interesting conversation.

Thank you very much, Mr. Commissioner.

[The Chair, Conservative, Chris Warkentin]

Thank you, Mr. Carrie.

We'll go to Mr. Dong next.

[Han Dong, Liberal, Don Valley North, ON]

Thank you, Chair.

I want to thank the commissioner and his staff for agreeing to stay longer to answer some very important questions. I had some questions prepared, but after your opening statement I have a few others added to the list.

First, there has been a lot of discussion, our committee included, with regard to facial recognition technology and whether it could potentially be more harmful to racialized communities. In your findings, is there any evidence to support that?

[Daniel Therrien]

There's certainly a lot of literature and analysis by academics and experts on this question. We have not actually made findings on this in the context of Clearview AI, but we have read a lot of very credible scientific research that is concerned with whether the technology is sufficiently precise, particularly in the case of racialized communities, to be used in a way that does not violate privacy or other rights like equality rights. There are concerns about this.

From a privacy perspective, the issue would be that facial recognition needs to be used in a way where accurate information is collected. The principle of accuracy is one of the important privacy principles. Again, there is a lot of literature to the effect that, for racialized communities, the information collected may not always be accurate, depending on the technology in question.

[Han Dong, Liberal, Don Valley North, ON]

Without any empirical evidence that facial recognition technology could be harmful, particularly to a racialized community, is there anything in Bill C-11 that we can do to provide a guardrail to make sure that the vulnerable communities don't get harmed as facial recognition technology develops?

[Daniel Therrien]

Bill C-11, as mentioned, does not have a human rights approach to the privacy law in question. It would be very beneficial if the proposed CPPA had a human rights foundation because then the principle of accuracy that I just alluded to could be used to ensure that potential discrimination against populations in the use of facial recognition would be part of our remit to ensure that, under privacy principles, technology that would result in discrimination would be found contrary to privacy.

I'll say that some would argue that these issues should be addressed through human rights legislation. Certainly, that's a credible point. I would say that, in the virtual world as in the physical world, the fact that there is some overlap in the jurisdiction of regulators here, as between my office and the Canadian Human Rights Commission, is not a bad thing as long as the regulators speak to one another, are efficient and benefit from each other's expertise. Our model would be to have a human rights approach to privacy law.

[Han Dong, Liberal, Don Valley North, ON]

I see. That's a very good point.

You mentioned that the facial recognition technology could be beneficial to our law enforcement system. Do you have any thoughts on what processes are in place or should be in place to ensure that the Government of Canada has the public's trust in utilizing facial recognition?

[Daniel Therrien]

I'll say something on the general level because we have not completed our investigation on the RCMP. The issue you raise is central. Obviously, whether it's companies or government departments—including law enforcement agencies—that use facial recognition, they should have processes ahead of the implementation of these technologies to assess the impact that they may have in order to ensure that privacy is respected. That's a central part, I think, before the technology is actually put into place.

[Han Dong, Liberal, Don Valley North, ON]

I don't mean to cut you off, but I want to get my next question in.

Does your office currently have enough resources to dive deeper on the algorithm, data storage or process to access data? Does your office currently have enough resources to do this type of investigation? It's not just with money. I'm also talking about technically—

[Daniel Therrien]

You mean the nature of our expertise.

[Han Dong, Liberal, Don Valley North, ON]

Yes.

[Daniel Therrien]

We do have a group of technologists. Roughly 12 individuals who are experts in technology assist in our policy development and investigative activity. In terms of the kinds of people, I think we have the right people. Then there's the question of how many resources, and that was the subject of some discussion in the last hour.

[Han Dong, Liberal, Don Valley North, ON]

You mentioned a partnership between the federal government and the provincial government. In your mind, what is the jurisdictional divide between the provincial and federal systems?

[Daniel Therrien]

Do you mean as to facial recognition?

[Han Dong, Liberal, Don Valley North, ON]

I mean the legislative aspect of facial recognition.

[Daniel Therrien]

It is the same jurisdictional divide as for other technologies. There's a federal private sector law that governs the private sector when the provinces have not legislated. Obviously, the provinces would legislate the conditions under which their own officials would use facial recognition, so the same jurisdictional issues would arise here as with other technologies.

[The Chair, Conservative, Chris Warkentin]

Thank you, Mr. Dong.

We'll turn to Monsieur Fortin now for the next round of questions.

Monsieur Fortin.