Information & Ethics Committee on May 2nd, 2022

[The Chair, Conservative, Pat Kelly]

Thank you.

Now we have Mr. Bezan for five minutes.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

This is a question for all three commissioners.

I think there's an understanding that there are certain times we want to use FRT for police enforcement. Is the way those images are harvested, such as scraping social media, something that should be banned?

[Daniel Therrien]

That's the issue we looked at in Clearview. If you're within a category or circumstance in which the police should be able to use facial recognition and rely on the technology of a private sector partner, we think the police should ensure the private sector partner has acted lawfully. To scrape social media data from the Internet regardless of the privacy settings of a consumer, for instance, would not be lawful. Even for a serious crime, that should not be possible.

[Patricia Kosseim]

I agree.

I would simply add that mass surveillance is the area that caused us the greatest concern on behalf of all federal, provincial and territorial commissioners. Whether it would be done by a third party private sector company on behalf of the police service or the police service itself, this is an area we've highlighted in particular as worrisome.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Poitras, would you comment?

[Diane Poitras]

I don't have anything to add to what my two colleagues have said. Mass surveillance can indeed be carried out by police forces and private companies, in all sorts of ways, including digital surveillance, but that ought not to be the case.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Are there any clear examples of charter rights being violated in FRT-based prosecution of individuals in Canada?

[Daniel Therrien]

I'm not aware of such a case, no.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Are there examples in Ontario?

[Patricia Kosseim]

I'm not aware of any either.

It will be a long time before we get to the point where there is jurisprudence under the charter. This was the concern we had, and it was the reason we were motivated to recommend the adoption of a legislative framework and, in the interim, the development of guidelines to help mitigate risks.

Regarding charter jurisprudence, it may take several years before we see the results.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Are there examples in Quebec?

[Diane Poitras]

I don't have any examples to give you.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

I appreciate the four recommendations to move forward with legislation and the guidelines that Ontario is proposing. Commissioner Kosseim, we really do appreciate that input.

Part of this is going to come under the Privacy Act and PIPEDA, but when you start talking about common law and statute law used in criminal cases, I'd like to know where in the Criminal Code we are going to make these amendments on using FRT so that it can be charter compliant.

[Daniel Therrien]

I'll go back to one of your earlier questions.

If, in certain circumstances, warrants would be required to be issued by a court, then we're probably in a world where these amendments would be made through the Criminal Code. I haven't given a whole lot of thought to the overall instrument. It's important for the law to be adaptable, and therefore principles-based, and to determine allowable and prohibited uses. If you want to get into mechanics such as warrants, then perhaps the Criminal Code would be warranted.

To add to what my colleague Commissioner Kosseim was saying about the evolution of the law, which takes time, we currently have a patchwork of laws that govern facial recognition. We have the charter at the highest end. We have the common law. We have certain statutes, including privacy legislation, but we also have other laws. It's a complex web of laws.

We have not seen many examples of the use of the technology, but through the use of Clearview by the RCMP, we have seen that the use of the technology by police forces is sometimes questionable.

My point is that you have to act fairly quickly, because in the meantime, this patchwork of laws can be used in many ways.

[The Chair, Conservative, Pat Kelly]

We'll now move on to Ms. Saks for five minutes.

[Ya'ara Saks, Liberal, York Centre, ON]

Thank you, Mr. Chair.

Thank you to all of our witnesses today. This has been a really informative process of learning.

I'm happy to have all three witnesses answer.

Each of you has talked about the need for strong, independent oversight powers of audit when it comes to the processes that use FRT technology, particularly law enforcement. We had a brief time with the RCMP and the TPS last week, and they talked about risk evaluation and terms of use.

What are the mechanisms or proposed recommendations regarding who determines the risk level to justify use? I'm pleased that there are recommendations today, but the details on how that would be done are pretty thin. The risk assessment could be on an immediate-needs basis. It's almost as if we'd be assessing whether use was justified after the fact.

Perhaps Mr. Therrien can start.

[Daniel Therrien]

We're back to the complexity of how to craft the law.

Let's say we're within the realm of a serious crime, which, according to our recommendations, would lead to the police being able to use facial recognition. The law cannot know of all individual cases, so there will have to be, as you say, a risk management assessment made by a police force.

What is the conversation with the oversight body, including privacy commissioners? I think it starts with a conversation before the program is put into place—a privacy impact assessment. How are you going to assess risk in a category of circumstances?

Then, if the police want to develop a program, we say that there should be program-level authorization. The police describe the program, which is, say, the protection of very important people in public spaces. That's the program. There's a discussion between the police and the Privacy Commissioner on that program. That's before the use of the technology. Once the technology is adopted and actually used, oversight should include the authority to investigate complaints and make orders as to the lawfulness of the use of the technology in a given case.

[Ya'ara Saks, Liberal, York Centre, ON]

Thank you.

Just stepping off on that, on the issue of transparency, when there's a risk assessment done and the level of risk determines that FRT would be used, do you feel that there should be public transparency in this, whether it's in law enforcement or...? We'll get into commercial settings shortly.

Anyone can answer.

[Patricia Kosseim]

Thank you for the question.

Directly to your latter question, we do believe that a certain level of transparency is absolutely critical. We understand that transparency is not going to be possible with every specific use, but certainly it should exist at the programmatic level, including in privacy impact assessments—if not in their entirety, then at least as a summary of the privacy impact assessments.

To your earlier question about oversight, I think there are multiple ways of achieving that oversight short of a comprehensive legislative review. That includes the role of the boards that play an important oversight role, the data protection authority of that jurisdiction, including my office and my colleagues, and also the public. The Ontario Human Rights Commission, for instance, in my jurisdiction, played an important role in consultation with us and others in the development of a body-worn camera program that was adopted.

I think there's a multilateral consultation process that needs to take place in determining the spectrum of risks. I want to make a point that I think we've made several times, which is that there is a great spectrum of use cases, including administrative uses of facial recognition that may be on the acceptable side of the spectrum and may be adopted.

[Ya'ara Saks, Liberal, York Centre, ON]

Thank you.

I know that I'm going to be short on time and I want to make sure I get this in.

Madame Poitras, I apologize that the question is in English; I'm just simply more comfortable.

You talked about consent, particularly when it comes to commercial use and so on. For example, Cadillac Fairview and other companies operate public spaces, but they're private property spaces.

What kinds of mechanisms could we consider for operating and managing FRT in those spaces in terms of making sure the public is informed?

[The Chair, Conservative, Pat Kelly]

Could we have a very brief answer, please?

[Diane Poitras]

Thank you, Mr. Chair.

Once again, I think that the mechanisms can be tailored to the circumstances. There are different forms of facial recognition. There is facial recognition proper, whose purpose is to identify individuals. However, the term “facial recognition” is sometimes used to designate derivatives of the technology that can be used for corporate purposes, in shopping centres for example, where the goal is not to identify individuals, but rather their characteristics, like age, sex, time spent window shopping…

[The Chair, Conservative, Pat Kelly]

I'm going to have to stop there. We're way over time now. I think we can maybe time this nicely, hopefully, with the expected bells and our final round of questioners.

First we have Mr. Villemure.

[René Villemure, Bloc, Trois-Rivières, QC]

Do I still have two and a half minutes left, Mr. Chair?

[The Chair, Conservative, Pat Kelly]

Yes.