Evidence of meeting #18 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was technology.
A recording is available from Parliament.
Noon
Bloc
René Villemure Bloc Trois-Rivières, QC
Okay.
In connection with the four elements you mentioned earlier, you said that there was an entity responsible for oversight.
What entity are you referring to?
Noon
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
As the authorities on protecting information, we believe that we will have a role to play in protecting personal data. However, facial recognition brings other rights into play, such as the right to equality in cases of discrimination against certain groups, and also democratic rights.
So we are not asking for a monopoly on facial recognition regulation, but I think that, as in other areas, it would be both possible and useful to have a number of regulatory organizations. In cases of discrimination, for example, it would be the Canadian Human Rights Commission or its provincial counterparts.
So we think we have a role to play in data protection, but other regulatory agencies should also have responsibilities.
Noon
Bloc
René Villemure Bloc Trois-Rivières, QC
So there ought to be a set of organizations that could together constitute another entity.
Noon
Conservative
The Chair Conservative Pat Kelly
Thank you.
We go now to Mr. Green. It's nice to have you back. Go ahead for two and a half minutes.
Noon
NDP
Matthew Green NDP Hamilton Centre, ON
Thank you.
Mr. Chair, we've heard in a previous answer by a witness today that a private industry is not able to regulate itself. You'll recall that in previous testimony, the RCMP disagreed with the findings of the Privacy Commissioner about violations that were present, so I want to ask the Office of the Privacy Commissioner about this.
The OPC found that the RCMP's use of Clearview AI contravened the Privacy Act and PIPEDA. The RCMP testified that they disagreed with the findings of the investigation. Through you, Mr. Chair, why does the OPC believe that the RCMP violated the Privacy Act and PIPEDA?
Noon
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
The RCMP is saying that the Privacy Act does not explicitly require it to verify the legality of the practices of its private sector contractors. It is true that the Privacy Act does not explicitly say that. We are of the view that a correct interpretation of that law is that they do have that responsibility, and if there is any ambiguity in the law, I would strongly urge parliamentarians to close that loophole and make it clear, as I suggested a few minutes ago.
Noon
NDP
Matthew Green NDP Hamilton Centre, ON
In other words, they can't do indirectly what they can't do directly. Is that correct?
12:05 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Exactly.
12:05 p.m.
NDP
Matthew Green NDP Hamilton Centre, ON
Yet here we are, with a scenario in which we know that police services are using this surreptitiously through many ways of procurement, through purchases and also through trial examples as well.
We heard the RCMP state in their testimony that they had no idea who signed off on the use of this technology. Are you aware of any other police agencies in Ontario that currently use Clearview?
May 2nd, 2022 / 12:05 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Clearview has stated to us that they have left the Canadian market. They are not offering their services at this point to anyone in Canada.
12:05 p.m.
NDP
Matthew Green NDP Hamilton Centre, ON
How would you close the loop specifically to ensure that these breaches of privacy, information and civil liberties aren't breached again in the future, not just by the private sector but most clearly through our law enforcement?
12:05 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Today I, along with provincial and territorial commissioners, have made a number of recommendations to amend the law. I think it should be done urgently, because the risks are very important.
It starts with better laws. Until such time as laws are amended, we have issued guidance on how to use the current law, and we hope this guidance will mitigate risk.
12:05 p.m.
Conservative
12:05 p.m.
Conservative
James Bezan Conservative Selkirk—Interlake—Eastman, MB
Thank you, Mr. Chair.
I want to thank our witnesses for their presentations and their participation in this important study. The announcement you made jointly earlier today definitely couldn't have been timed better, considering the work we're doing right now.
Mr. Therrien, to follow up on Mr. Green's questioning, you said the RCMP was unlawfully using Clearview technology. Were any penalties assigned to the RCMP—or to Clearview, for that matter?
12:05 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
No, but we should look at this as an institutional issue. I would tend to look at it through the eyes of the institution, rather than in terms of individuals.
We've made recommendations for the RCMP to improve its processes, but I'm not aware of any sanctions.
12:05 p.m.
Conservative
James Bezan Conservative Selkirk—Interlake—Eastman, MB
Are you aware of the organization IntelCenter and the IntelCenter database of facial recognition technology?
12:05 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Personally, I am not. Perhaps some of my colleagues at the OPC are aware of it. We can provide information if we have any.
12:05 p.m.
Conservative
James Bezan Conservative Selkirk—Interlake—Eastman, MB
Based upon access to information requests that we just got back, it appears that the RCMP, CSIS and the Department of National Defence are making use of this technology. I think it's something we need to dive into as well.
Their own documents suggest that they use open-source images to identify things like terrorists from the Internet and then provide that to law enforcement agencies like the RCMP and CSIS.
12:05 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
If we have information, we'll provide it.
12:05 p.m.
Conservative
James Bezan Conservative Selkirk—Interlake—Eastman, MB
You can maybe take that under advisement.
When you talk about amending existing legislation, you're talking about the Privacy Act and PIPEDA. Should it be extended to include the Criminal Code?
12:05 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Possibly. I haven't thought about the exact pieces of legislation that need to be amended.
As I responded in answering an earlier question from Ms. Hepfner, I think we need to start from a principles base, augmented with a few provisions to ensure that general principles cannot lead to overly generous interpretation. It means definitely PIPEDA and the Privacy Act, and potentially the Criminal Code.
There is a lot of authority in the common law for the use of various technologies. Potentially, the Criminal Code could be examined from the perspective of restricting some of these common law powers, but I haven't thought this through seriously.
12:05 p.m.
Conservative
James Bezan Conservative Selkirk—Interlake—Eastman, MB
When you're looking at the use of facial recognition technology and protecting charter and privacy rights, should we take the same approach as we do for wiretaps?
I know the CSE and CSIS do a lot of monitoring of online chatter, trying to focus on things like terrorism and transnational criminal organizations. Again, they can't do indirectly what they're prohibited from doing directly. Whenever they're going to be in violation of the charter, they have to get a warrant or ministerial authorization to ensure that they become charter compliant. When you talk about authorized purposes, is that what you had in mind? Do there need to be warrants or ministerial authorizations making the claim that it is required and proportionate to the violation that may happen to an individual's rights?
12:10 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
It is conceivable that warrants may be required in some cases. When we recommend that legislation define “allowable” and “prohibited” uses, we have in mind categories of circumstances, such as serious crime, however parliamentarians may want to define it. It's that kind of thing. It's not a case-by-case authorization.
We come closer in our recommendations when we say that there should be “program-level authorization or advanced notification before use”. That's closer to Quebec legislation, whereby a police body would come to an independent regulator and say they want to use FRT in the following use case—not an individual circumstance, but a group of cases—which would then be discussed with the data protection authority and approved at the program level. That's closer to individual authorization.
It's not inconceivable that, in some cases, individual warrants would be issued by a judge for an individual case, but that's not our starting point.