Evidence of meeting #18 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was technology.

A recording is available from Parliament.

On the agenda

MPs speaking

Also speaking

Daniel Therrien  Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Patricia Kosseim  Commissioner, Office of the Information and Privacy Commissioner of Ontario
Diane Poitras  President, Commission d'accès à l'information du Québec
Vance Lockton  Senior Technology and Policy Advisor, Office of the Information and Privacy Commissioner of Ontario

11:50 a.m.

Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada

Daniel Therrien

We're not aware of other FRT systems that the RCMP is using. There are, of course, many FRT systems other than Clearview, but they do not all have the same level of accuracy, which is a concern.

As far as the RCMP is concerned, we do not know that they are using a system other than Clearview. They are not currently using Clearview.

11:50 a.m.

Conservative

Ryan Williams Conservative Bay of Quinte, ON

Thank you.

Ms. Kosseim, do we know how Ontarians' images are being gathered and stored at this point? Companies using FRT are gathering images. Do we know how they're gathered and stored in Ontario?

11:50 a.m.

Commissioner, Office of the Information and Privacy Commissioner of Ontario

Patricia Kosseim

Unfortunately, I don't have insight into companies in Ontario, because that's not in our jurisdiction. I can't answer that question with any certainty.

11:50 a.m.

Conservative

Ryan Williams Conservative Bay of Quinte, ON

I'll stick to the public sector, then. Do we know how they're being stored?

11:50 a.m.

Commissioner, Office of the Information and Privacy Commissioner of Ontario

Patricia Kosseim

Is that in general or in using facial recognition technology?

11:50 a.m.

Conservative

Ryan Williams Conservative Bay of Quinte, ON

I think in general, including FRT.

11:50 a.m.

Commissioner, Office of the Information and Privacy Commissioner of Ontario

Patricia Kosseim

I'll give you a couple of examples.

Certainly police services are using images in mug shot databases pursuant to their powers under the Identification of Criminals Act. There is also obviously much video surveillance that is ongoing in terms of general, municipal and other collection of video surveillance. That too is fairly common and ongoing in terms of collection of video surveillance and therefore images of people.

11:50 a.m.

Conservative

Ryan Williams Conservative Bay of Quinte, ON

Thank you very much.

Thank you, sir.

11:50 a.m.

Conservative

The Chair Conservative Pat Kelly

Thank you.

Ms. Hepfner, you have five minutes.

11:50 a.m.

Liberal

Lisa Hepfner Liberal Hamilton Mountain, ON

Thank you very much.

I'd like to thank all the witnesses here with us today.

I'll begin with Mr. Therrien, but will do so in English because it's easier for me.

You talked about how all the stakeholders you consulted with agreed that privacy legislation in Canada needs to be updated. It makes sense, because when it was drafted, we didn't know about facial recognition technology.

I'm wondering what sort of advice you have for legislators to be flexible in the legislation so that we don't have to rewrite the legislation every time a new piece of technology comes. How do we make it flexible so that when there are more advancements in technology, the legislation still applies?

11:50 a.m.

Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada

Daniel Therrien

That's a good question.

My starting point would be to say that we do have laws. Obviously, we have the charter and we have the common law, and there are some statutes like the RCMP Act that govern the situation. In the private sector, we have PIPEDA.

To your point about flexibility to ensure that the law does not become obsolete, one of the virtues of PIPEDA is that it is principles-based, so it does not seek to regulate particular situations but deals with principles. However, I think facial recognition is where we start to see the limits of the virtues of a principles-based approach, because if you regulate facial recognition by saying that the user ought to be accountable, or you apply principles of that nature or say that a necessary proportionality should apply, you leave a lot of discretion to the police to exercise these broad principles in a way that suits their interests.

I'm not saying there ought not to be principles-based legislation. As a general principle, it makes a lot of sense, but in the case of facial recognition, because of the extremely high risks to privacy and other rights, such as democratic rights of demonstrating or equality rights, we say that there ought to be specific provisions—for instance, in the case of the police—to prohibit uses except in certain circumstances.

A good grounding of principles-based legislation makes sense, but in the case of facial recognition it should include the addition of a few specific rules that ensure that the broad principles are not abused or not interpreted in an overly generous way.

11:55 a.m.

Liberal

Lisa Hepfner Liberal Hamilton Mountain, ON

Very good. That's helpful. Thank you.

I know that the Competition Bureau is also looking at the changes in privacy issues brought on by technology. Can you talk to us about whether you have a relationship with the Competition Bureau and if your office is working in conjunction with that office to tackle some of these issues?

May 2nd, 2022 / 11:55 a.m.

Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada

Daniel Therrien

The short answer is yes, we do work with the Competition Bureau. We have discussions with them fairly regularly, but both of us, the bureau and the OPC, are limited by our current laws in that we are not able to share, for instance, detailed information that we gather in the context of an investigation because we're both bound by a confidentiality rule that prevents us from sharing with the other regulator the details of what we affirm.

We can have discussions at a level of general principle. We can talk about general trends, but it would be extremely helpful, as both of us have recommended in previous months and years, to be able to share what we have learned through investigations so that our collaboration could be more effective.

11:55 a.m.

Liberal

Lisa Hepfner Liberal Hamilton Mountain, ON

I have 30 seconds left, so I'll go quickly.

You said you were moved by the RCMP's saying that FRT should be targeted, time-limited and subject to verification by trained experts. In what ways is FRT used for good, as in your examples of fighting crime or finding missing children? In what ways is this technology used in an acceptable way?

11:55 a.m.

Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada

Daniel Therrien

As far as the police are concerned, I think those two examples would be the most important ones. As for “crime”, I would qualify that and say “serious crime”. I'm not sure that facial recognition should be used for common theft, for instance, given the risks of the use of facial recognition for privacy and other democratic rights, but it can certainly be acceptable for serious crimes, such as missing children, and for other compelling state purposes, such as in the border context to ensure that people of concern can be identified at the border while not impeding the flow of travellers to the country. To me, the necessity of identifying people of concern at the border in that context would be a compelling ground.

11:55 a.m.

Conservative

The Chair Conservative Pat Kelly

Thank you, Commissioner. That was another round with generous time, but I think we have the ability to do that today.

Go ahead for your round of two and half minutes, René.

Noon

Bloc

René Villemure Bloc Trois-Rivières, QC

Thank you, Mr. Chair.

Mr. Therrien, I'm going to be brief, but if you could send us information afterwards, that would be great.

We talked about Clearview AI, which left the country for someplace where it would not be subject to our legislation, but there are also companies like Palantir, which are major players in the facial recognition and data management industry.

Are these companies able to self-regulate?

Noon

Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada

Noon

Bloc

René Villemure Bloc Trois-Rivières, QC

Ethics is not a concern for these companies, which are relatively open about their willingness to use data in an unlimited way, I believe.

Noon

Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada

Daniel Therrien

In fact, I think that's one of the lessons we can learn from how the technology has been used in recent years. We have to put a stop to self-regulation by companies, and those in the surveillance field deserve particular attention. Generally speaking, elected representatives need to regulate the use of the technology. That's the main lesson to be drawn from the past few years.

Noon

Bloc

René Villemure Bloc Trois-Rivières, QC

Can you tell us a bit about Palantir, which is still a Government of Canada supplier?

Noon

Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada

Daniel Therrien

It's clear that we are greatly concerned about Palantir's practices, but as we haven't investigated the company, I don't feel comfortable commenting about it.

Noon

Bloc

René Villemure Bloc Trois-Rivières, QC

Ms. Kosseim, have you investigated Palantir?

Noon

Commissioner, Office of the Information and Privacy Commissioner of Ontario

Noon

Bloc

René Villemure Bloc Trois-Rivières, QC

How about you, Ms. Poitras?