Information & Ethics Committee on May 2nd, 2022

[Daniel Therrien]

When surveillance is carried out by police services or private companies, they collect information about people's activities or characteristics in order to make certain decisions about them.

The question is whether it's done with people's consent or in accordance with legislation that protects the rights of citizens who are exercising these rights. That, in my opinion, is the key. Consumers, vis‑à‑vis companies, and citizens vis‑à‑vis the state, should be able to exercise their right to use social media, communicate and take part in demonstrations, without being subjected to mass surveillance, except in extremely limited circumstances.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

Similarly, we were told, in connection with police officers who were recording what demonstrators were doing, that it was for the archives. It is nevertheless a form of surveillance.

[Daniel Therrien]

Yes.

[René Villemure, Bloc, Trois-Rivières, QC]

Okay.

You were just getting going earlier when you were talking about the RCMP. Having heard testimony from the people who appeared last week, I'd like you to return to that subject.

[Daniel Therrien]

On a number of occasions, you were told about a moratorium, whether desirable or otherwise, that was going to be applied until an enhanced act was adopted. It's clear to me that a moratorium applicable to police services should be provided for in a law. However, I found it interesting last week when the RCMP representative raised a number of principles governing the use of facial recognition by the RCMP. That's in the English version I'm looking at.

He said it should be “targeted, time-limited and subject to verification by trained experts. Further, [it] should not be used to confirm an identity, but rather only be considered as an investigational aid”.

The matter of verification by someone was raised.

You could ask the RCMP to commit to using facial recognition only in accordance with the principles stated by its representative last week. I feel that would be the best way of handling a moratorium while awaiting the enhanced act.

[René Villemure, Bloc, Trois-Rivières, QC]

The principles were nevertheless legitimate.

[Daniel Therrien]

Yes.

[René Villemure, Bloc, Trois-Rivières, QC]

Okay.

Thank you, Mr. Therrien.

Ms. Poitras, could you briefly summarize the Clearview AI situation for us, given that it was very important in connection with your work in Quebec?

[Diane Poitras]

Thank you for your question.

As you know, Quebec's access to information commission was involved in the joint investigation, with its counterparts from the federal government, Alberta and British Columbia. After that, we issued an order under our own provincial authority. Our decision was appealed, which is possible in Quebec, and it is currently before the courts.

We would be happy to send you our decision, which explains our position and is up on our website. Unfortunately, as the matter is before the courts, I will refrain from making any comments out of respect for the judicial process.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you. We would appreciate your sending it.

I won't ask you to reveal any secret information, but can you tell us what Clearview AI is challenging?

[Diane Poitras]

To summarize the decision as a whole, there is the commission's authority to issue the order, since it's an American firm, and also all our legal conclusions pertaining to compliance with Quebec's act.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

Mr. Therrien, according to you, is the RCMP already carrying out surveillance.

[Daniel Therrien]

I'm going to return to what I heard last week. The RCMP says that it is not doing mass surveillance. I have no reason to doubt this. The RCMP could demonstrate that it is using facial recognition for compelling reasons by committing to using it only for such purposes. I noted last week that the RCMP representative wasn't particularly clear as to whether or not the RCMP is using facial recognition.

At best, I would say that I have no reason to believe the RCMP is using facial recognition for mass surveillance. On the other hand, their definition of the circumstances under which they use it seems rather ambiguous. That, moreover, is why we are sending the guidance document and are recommending that police forces be subject to a clear act that authorizes facial recognition, but also prohibits its use in certain circumstances.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

[The Chair, Conservative, Pat Kelly]

Thank you, Mr. Villemure.

Ms. Gazan, welcome to the ethics committee. You have up to six minutes.

[Leah Gazan, NDP, Winnipeg Centre, MB]

Thank you so much, Chair.

Monsieur Therrien, your office [Technical difficulty--Editor]

[The Chair, Conservative, Pat Kelly]

Your microphone was not activated.

[Leah Gazan, NDP, Winnipeg Centre, MB]

Oh, it was not? I'm sorry.

[The Chair, Conservative, Pat Kelly]

I'm going to reset your time. Go ahead, Ms. Gazan. I'll ask you to restate your question.

[Leah Gazan, NDP, Winnipeg Centre, MB]

Thank you, Chair. Just so you know, this isn't my first committee. I'm sorry, everybody.

Monsieur Therrien, the Office of the Privacy Commissioner published a report in June 2021 entitled “Police use of Facial Recognition Technology in Canada and the way forward”. The report provides a series of recommendations that the RCMP agreed to implement no later than 12 months after receipt of that particular report. Some of the recommendations included a training program to ensure decision-makers are trained on the limitations on collection of personal information under the Privacy Act, policies to clarify who can make decisions on the collection of personal information, and systems to monitor for unauthorized collections.

Could you elaborate on the recommendations you made that the RCMP agreed to and how these will improve privacy practices?

[Daniel Therrien]

Thank you for that.

While the RCMP disagreed with our conclusion at law that the RCMP itself was breaching the public sector law by relying on Clearview, they did co-operate significantly with us in recognizing that they should have a better verification system when they use new technologies, be it facial recognition or other new technologies.

We have, I think, agreement with the RCMP that they ought to have these verification systems, and we have had good discussions with them since June of last year. I do not think they will be able to implement all of these recommendations within a year, but we're making good progress.

[Leah Gazan, NDP, Winnipeg Centre, MB]

However, they had agreed to implement them no later than 12 months after receipt of the report. What you're saying is that they have not implemented the recommendations and it has been over 12 months. Am I correct?

[Daniel Therrien]

They have not yet, and they are unlikely to meet the 12-month deadline, but we are making good progress, and I see a genuine effort on their part.

It is a relatively complex issue, but we obviously would like to see this implemented as soon as possible.

[Leah Gazan, NDP, Winnipeg Centre, MB]

I'll move on.

In June 2021, the OPC report also stated that:

There were serious and systemic failings by the RCMP to ensure compliance with the Act before it collected information from Clearview and, more broadly, before novel collection of personal information in general. This includes widespread failures to know what it was collecting, control how collection occurs, identify potential compliance issues, and assess and prevent contraventions of the Act.

The use of the words “systemic” and “widespread” suggests that this isn't a one-off error or a poor decision, so how can we be assured that the RCMP is compliant with privacy laws going forward and that there aren't other cases like Clearview quietly flying under the radar?

I ask that question because the report uses the words “systemic” and “widespread”.

[Daniel Therrien]

This language refers back to the absence, at that time, of any system at the RCMP to ensure that when new technology is used by its officers, there is a verification and approval process within the RCMP to ensure that the technology respects the law, including privacy rights.

This was far from ideal, to say the least, but the RCMP has recognized the problem and is setting up such a system. It will take a bit more time than we had hoped, but I think it's going in the right direction.