It is the same jurisdictional divide as for other technologies. There's a federal private sector law that governs the private sector when the provinces have not legislated. Obviously, the provinces would legislate the conditions under which their own officials would use facial recognition, so the same jurisdictional issues would arise here as with other technologies.
On May 10th, 2021. See this statement in context.