Information & Ethics Committee on June 16th, 2022

[Tamir Israel]

That's certainly a very valid and salient concern.

The no-fly lists have been a long-standing problem. There have been proposals to create facial recognition-enabled lists with comparable objectives. CBSA did, in fact, pilot one for a while, and decided not to implement it yet, I think. That is something they piloted, and that's deeply problematic.

The response from CBSA has been concerning. For example, one CBC report tried to probe into the racial biases in one of those facial recognition systems. When they asked for more detailed breakdowns of error rates and racial bias rates.... First, through access to information requests, it appeared that CBSA was not aware, at the time of its adoption, that these were real. Later on, they responded that there are national security concerns with providing this type of error data, which is just not.... In other jurisdictions, this is publicly available. It's required to be publicly available by law in other jurisdictions. That's not a good approach.

More recently, there have been developments, in the sense that CBSA announced they will try to implement a biometric study hub within their infrastructure, but we haven't seen much going on yet.

[Matthew Green, NDP, Hamilton Centre, ON]

Quickly, before my round wraps up....

I think about the nightmare that is Toronto Pearson—the three- to four-hour-long waits for domestic travel, because security lanes are closed. Do you think these are the right preconditions for filtering people into things like Nexus?

I know when I'm standing in line and look at the business class, visa or Nexus lines, they are empty. Do you think the inconsistencies and inefficiencies at our borders might result in a peak of people applying for things like Nexus?

[Tamir Israel]

I think it really is putting people in an unfair position of having to choose that, if it's the only way they can make their airport and travel experiences a little less unpleasant.

The direction things are going in is worse. There are proposals around the world to automate that screening process. You'll walk up to a screen and get a facial recognition scan. There will be an assessment of your profile pulled in digitally, and you'll automatically get channelled through gates to a high-security, medium-security or low-security line.

That will just be this on steroids. If you don't have the right profile in place to interact with this—

[Matthew Green, NDP, Hamilton Centre, ON]

Yes, I can imagine where this is headed. I've been pulled out into secondary more than my fair share of times.

Thank you very much, Mr. Chair.

Thank you very much to our witnesses.

[The Chair, Conservative, Pat Kelly]

Thank you. We went quite a bit over time, but I let it go. We were getting good information. Hopefully, we'll try to keep our rounds tight to time.

With that, next we have Mr. Bragdon. Welcome to our committee. You have up to five minutes.

[Richard Bragdon, Conservative, Tobique—Mactaquac, NB]

Thank you, Mr. Chair.

Greetings to all the other committee members here today.

It's a very important subject we're covering. A lot of Canadians have genuine and sincere concerns when they consider this. As our world continues to change at such a rapid pace and we're seeing concerns about privacy continue to rise—balanced with the need for security for populations—I think Canadians want to be assured that all the possible safeguards are put in to protect individual rights and the privacy rights of Canadians.

Mr. Israel, I'll go to you first. Your report makes several interesting recommendations when it comes to what you would like to see in a legislative framework for facial recognition technology, which we do not currently have. In your report, you write that the need for legislative backing applies to border control implementations that rely on a form of consent, such as opt out or opt in.

Do you believe all use of facial recognition technology by border control should have an opt-in, opt-out component?

[Tamir Israel]

Yes. Part of the problem with the technology is that, if there's not an explicit opt-in requirement, you're not even necessarily aware that you're being subjected to the technology. For example, with the customs screening mechanisms they have at Pearson, from the traveller's experience, you don't necessarily realize that a facial recognition scan is happening. There is no explicit obligation to get your consent. That's equally problematic. In the U.S., we saw examples where there was an obligation to provide an opt-out, but the signs were hidden in the corner. People didn't see them very well.

I would say that requiring, at the very least, an opt-out with very clear notification, and perhaps even an opt-in, would be a useful addition.

[Richard Bragdon, Conservative, Tobique—Mactaquac, NB]

Can you further explain the difference between centralized and decentralized architecture in facial recognition technology? How is each type of system susceptible to breaches? What breaches might they be susceptible to? Can you explain that for us a bit?

[Tamir Israel]

In a centralized system, all the images are held in one spot. If I were to walk up to a camera, my picture would be taken and it would be compared to the centralized database of millions and millions of images.

A decentralized system would be something like what we have on our passports, where there's a digital passport image encoded on the passport. When I use that, a picture is taken. The digital image on my passport gets compared with the one that was just taken. The comparison happens in that way.

There are still security risks, because the security on the digital radio device encoded on the passport can have breaches, but then you breach one passport. Not all of the biometric templates are in one place, where it's a lot easier to just grab the entire database.

[Richard Bragdon, Conservative, Tobique—Mactaquac, NB]

Further to this, images of travellers who are children or elderly are less accurately identified by FRT, in addition to people of ethnic backgrounds. That's a significantly large group of people combined.

For this reason, should all travellers, once again, be able to opt in or opt out of the FRT systems to avoid being misidentified when travelling?

[Tamir Israel]

In many jurisdictions, at the airports, facial recognition is not applied to travellers under the age of 14 and over the age of 79, I believe. Again, that greatly undermines any efficiency gains you get from adopting these systems, while subjecting everybody else to the intrusiveness of having to give up their biometrics. I think that needs to be taken into account when assessing how effective this is.

It is also a safeguard that has to be in place and taken into account, so that these systems are not applied to those age groups where it's known that there are significant drop-offs in accuracy. For the rest, I think maybe an opt-in is okay, but I think a moratorium is still a good idea, given where things are in terms of the rapidness of the adoption of this technology and the ongoing errors that it produces.

[Richard Bragdon, Conservative, Tobique—Mactaquac, NB]

Following up on that, you're recommending that there be a moratorium until we know more. That would definitely seem to be a wise and prudent approach. A lot of this is emerging technology. The technology is coming in, and there's a lack of awareness in the Canadian population as a whole as to the ramifications of this type of technology and what it could mean for their privacy rights, their individual rights and where that information is going to be stored and where that information may get shared. I think there are a lot more questions to this than there are potential benefits, from what we're hearing.

Thank you.

[The Chair, Conservative, Pat Kelly]

You're welcome, and you did use all of your time and then some, so there isn't time for a response.

We will go now to Mr. Bains for up to five minutes.

[Parm Bains, Liberal, Steveston—Richmond East, BC]

Thank you, Mr. Chair.

Thank you to our guests for joining us today. I'm going to ask a question of Mr. Israel.

One of the key findings of the report states that FRT has higher levels of social acceptance in comparison to other biometrics. What other biometric technologies is FRT being compared to, and why would FRT be more acceptable than the alternatives?

[Tamir Israel]

I think Ms. Bhandari touched on this as well.

Because facial recognition operates surreptitiously and doesn't have associations with things like fingerprinting that historically come out of a criminal justice kind of context, there's a bit less social stigma attached to it in the minds of people, although there shouldn't be, because it's increasingly used in the same context as mug shots, etc.

The other part of that is what Ms. Bhandari was talking about before, which is that, because it happens remotely and with less direct interference with individuals, sometimes people are just not aware of how intrusive FRT is in comparison to other biometrics, where you have to physically grab peoples' fingers or scan their eyes in a way where they're leaning in to ensure a good iris scan. For those two reasons, facial recognition has been easier to get adopted.

[Parm Bains, Liberal, Steveston—Richmond East, BC]

My next question is this: How should FRTs be regulated in the private sector? This is for Mr. Israel again.

[Tamir Israel]

I think the harm in the private sector can be even worse in some contexts than in the public sector. There's probably wider variation.

We recommend empowering the Privacy Commissioner to look into the adoption of intrusive technologies and impose conditions and even moratoria on specific technologies as a meta way of addressing this. We also recommend encoding biometric information as sensitive and explicitly requiring express consent for biometric information as is, I believe, the case in the Illinois law Ms. Bhandari mentioned and in the Quebec law now.

I think those are two good steps and then perhaps even a moratorium. It's just a broader use case.

[Parm Bains, Liberal, Steveston—Richmond East, BC]

Thank you.

Ms. Bhandari, U.S. police authorities have been much more willing to engage with FRT technology.... I'm sorry—wrong question.

The state of Illinois has a law that applies specifically to biometrics, the Biometric Information Privacy Act, and therefore to facial recognition technology. What are the benefits of this legislation?

[Esha Bhandari]

One of the main ones is that it enabled us to hold a company like Clearview accountable for creating a database of hundreds of millions of people's face prints without consent and selling it to private companies and law enforcement for a whole host of purposes.

We have been advocating for other states to adopt biometric privacy laws and, in particular, make changes, because the Illinois law is at this point quite old, and we have more knowledge about the technology and the risks of the technology.

Among the recommendations that we make in the context of states that were to adopt a legislation like the Illinois BIPA, one is clearly requiring companies to obtain notice and written consent before collecting, using or disclosing any person's identifier, and prohibiting companies from withholding services from people who choose not to consent, so that they're not given the choice of accessing a service versus not accessing the service if they're not willing to give up their biometrics.

We also urge that any legislation require businesses to delete biometric identifiers after one year of the individual's last interaction with a business. For example, if someone gave their biometrics to access a service and consented but no longer has a relationship with that business, the business shouldn't be able to hold on to and amass a database of these sensitive biometrics. As Mr. Israel mentioned, there's a risk of breach. We've seen instances of those, and there's no need for those private entities to hold on to those. We advocate adopting legislation like Illinois' BIPA but also updating it.

[Parm Bains, Liberal, Steveston—Richmond East, BC]

Are there any modernized laws in other states that Canada could be inspired by?

[Esha Bhandari]

I would have to think and get back to the committee on whether there was sort of a perfect model. I think the Illinois law is a good place to start and I think that there have been proposals in places like Maryland and Maine. Those laws have not been enacted but they are out there. Those models are available and we urge their passage. I would look to Maryland and Maine specifically for models.

[Parm Bains, Liberal, Steveston—Richmond East, BC]

Thank you.

How much time do I have, Mr. Chair?

[The Chair, Conservative, Pat Kelly]

You're done. You had about three seconds left.

We're now going to go to Monsieur Villemure for two and a half minutes.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you, Mr. Chair.

Ms. Bhandari, this morning, the Government of Canada introduced Bill C‑27, which, among other things, implements the Digital Charter. Part 3 of the bill is entitled “Artificial Intelligence and Data Act.”

The bill therefore deals with artificial intelligence and facial recognition. It will be sent to committee for study so that we can discuss it and make suggestions for improvement.

From what you know of the Biometric Information Privacy Act, or BIPA, what should we look to in that legislation to enrich our digital charter that will eventually be implemented?

[Esha Bhandari]

I will point out to the committee that the Maryland bill is SB 335, which is a biometric privacy law. I think that is one model this committee could look to.