Information & Ethics Committee on June 16th, 2022

[René Villemure, Bloc, Trois-Rivières, QC]

I'm so sorry to interrupt you, but we have very little time.

Is there anything in the BIPA that Canada should take inspiration from?

[Esha Bhandari]

The consent provisions are key and it has to be meaningful consent. I think Mr. Israel spoke about the downsides of opt-out consent, and particularly one concern we have is that we all interact with so many businesses, particularly online, that if you have to opt out every time people get opt-out fatigue.

I think affirmative express consent is one thing that should inspire this committee and meaningful opt-in consent for particular uses.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

Do you believe that one day we will be able, as European legislation now allows, to invoke the right to be forgotten, or the right to have our images removed from databases?

[Esha Bhandari]

Yes, that's a critical part of any regulation. There should be a sunset period, as I mentioned. We've suggested one year after the last interaction with a business as a default, but certainly any time an individual chooses to have their biometrics deleted from a database, that option should remain.

Again, recognizing that people may choose to use biometrics for a very specific purpose, even with the risks that entails, that doesn't give carte blanche to the company to hold on to those because they are such sensitive identifiers and could lead to identity theft and a whole host of other issues.

[René Villemure, Bloc, Trois-Rivières, QC]

We will need to pass a law that will clearly give people the ability to have their images easily removed from databases.

Is that correct?

[Esha Bhandari]

Yes, and there should also be a clear limit on any private sector collection of biometrics. There should be a clear limit on sharing with other entities, including law enforcement, without the consent of the individual. We should carve a very important regulation so that it's not that once you give up your biometrics for one purpose it can be shared broadly.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

[The Chair, Conservative, Pat Kelly]

Thank you.

Now we'll go to Mr. Green for two and a half minutes.

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you.

I'd love for the guests to be able to summarize in their final thoughts any information for the good and welfare of this committee for the consideration of our analysts when drafting a report.

I'll start with Ms. Bhandari.

Do you want to take a minute and perhaps share any concluding thoughts you might have that you want the committee to take away from this?

[Esha Bhandari]

My final thoughts are that I would urge the committee to act expeditiously. The technology's developing every year, and as things stand it's a too-far unregulated field that is inflicting harm every day. There are very concrete, specific laws that can be enacted. There is regulation that can be effective, regardless of what has happened before, so I hope that the committee will keep in mind the very specific recommendations that Mr. Israel provided and others. It's not too late to act.

[Matthew Green, NDP, Hamilton Centre, ON]

That's very important.

Mr. Israel, would you like to just conclude.

[Tamir Israel]

I would second what Ms. Bhandari is saying. It's not too late to act.

I would just also add really quickly that we have a very big enforcement problem in Canada. Obviously we had rulings against Clearview here as well. Clearview is currently challenging those rulings against it from the B.C. privacy commissioner, the Alberta privacy commissioner and the Quebec commissioner.

Federally though, it did not challenge the federal Privacy Commissioner's ruling because that ruling is not binding, so it's essentially, “take it as a recommendation and move on.” I think the enforcement mechanisms that will come through in the private right of action that is coming through Bill C-27—which I imagine may come before you shortly—is something that you would also like to take a look at very closely when you're considering how to make sure that whatever laws you put in place are respected by Clearview and all the other companies that follow its model.

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you so much to both witnesses. I'm happy to end the rest of my time, Mr. Chair.

[The Chair, Conservative, Pat Kelly]

Okay. That catches us up by about 45 seconds. Thank you, Mr. Green.

The final two rounds go to Mr. Kurek, and then we'll be done with Mr. Fergus.

Go ahead, Mr. Kurek.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thank you very much, Mr. Chair.

Again, thank you to the witnesses.

Ms. Bhandari, you mentioned that there were a couple of exemptions to the Clearview biometrics. You had referenced this in one of your previous answers. Would you be able to expand on that for the committee?

[Esha Bhandari]

I'm sorry that I don't have the specifics of those exemptions to provide. They're written into the law for very specific purposes. I can send details to the clerk later on the specifics of the settlement, which outlines what those exemptions in BIPA are.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

That would be appreciated.

Mr. Israel, you had referenced the WEF's known travel digital identity program. I've certainly heard from many constituents who are concerned about the idea of a very powerful type of digital ID. The government is participating in a pilot program in that regard. Do you have any concerns with the KTDI pilot program that you could outline to the committee, in particular if there's any concern about how a program like this may disproportionately affect certain elements of the population, whether they be people of colour, racial minorities, young, old, etc.?

[Tamir Israel]

Yes, absolutely.

I am very concerned. The pilot did get a little bit interrupted by the pandemic, and I don't know how aggressively it's being moved forward now. I'm very concerned with the idea of using the pinpoint of the travel experience to encourage people to opt in and create these types of profiles, knowing that they're then going to be used against them, not just in border control contexts, where many marginalized communities are already at a massive disadvantage, but here and abroad, in other countries that end up implementing the same system. It's intended to be a global system. It's also with the idea that these same systems are going to then be used by the private sector for fraud detection or identity management in interactions with private companies.

The facial recognition component of this is a big part. All the errors there are going to, again, fall most heavily on visible minorities and members of marginalized communities. Then the other assessment and social ranking mechanisms that are included in this identity verification program that will sit on your device and be linked to through your facial recognition also tend to weigh very heavily and disproportionately against members of marginalized communities.

I think this is not the way to go, personally.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

I appreciate that. If you'd bear with me here, certainly I've heard from constituents who are concerned about the inclusion of one's political beliefs as to whether or not they could travel, the inclusion of something like race as to whether or not they're allowed to rent an apartment, or a whole host of hypotheticals that could be included in some nebulous database that exists somewhere on a server that may or may not have human oversight. Certainly I think we all need to be very careful about that. Is that something you would agree with?

[Tamir Israel]

Absolutely. Part of the challenge with this type of system is that, by relying on artificial intelligence assessing tools, you're able to implicitly do what you couldn't do directly. You couldn't necessarily say, “I'm not renting to you because you're indigenous,” but then maybe you could adopt an algorithm that relies on biased historical data and ends up coming to that conclusion without the transparency that would let someone challenge that type of decision explicitly. That's a very big problem as we move towards this broader set of assessment mechanisms. Again, facial recognition is a tool that really allows a lot of implementation of those types of mechanisms. The KTDI profile has lots of elements of that built into it.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Just in my few seconds left, you had referenced the public sector and private sector. I know that Air Canada, KLM and some airports that are quasi private-public entities, depending on where they are in the world, are some of the partners included in this program. Is that of concern to you?

[Tamir Israel]

Absolutely. That's a concern more broadly with facial recognition systems. There's a lot of back and forth in other jurisdictions—and we anticipate it will get here eventually—where airlines are incentivized to adopt facial recognition systems for border control reasons. They're even given some funding sometimes and then they use that for their own commercial reasons.

There's a lot of really problematic interplay between how the private sector is increasingly picking up a lot of this very sensitive data at the borders.

[The Chair, Conservative, Pat Kelly]

Thank you, Mr. Israel.

For the last five minutes, we have Mr. Fergus.

[Greg Fergus, Liberal, Hull—Aylmer, QC]

Thank you, Mr. Chair.

Through you, I'd like to really thank these two witnesses. They've been outstanding and I really do appreciate their insights.

For the two witnesses, if you don't know how committees work here in the House of Commons, we actually have to receive written or verbal testimony for us to make recommendations. We have to hear something on the issue before we can go forward on it.

I would like to take this on a different tack. I'll ask both witnesses this today.

Mr. Israel, in response to Mr. Kurek, you were talking about transparency—or the other side, the opacity—of these FRT systems and how they surreptitiously take pictures and identify people. I guess my question would be this: Are either of you aware of a registry of companies that engage in facial recognition technology? Is there a list somewhere of companies, governments or agencies of governments that engage in capturing images for the purposes of FRT?

[Tamir Israel]

I'm not aware of a list.

Sometimes you get lists when there's a procurement process. Often you get a number of companies that register to sign up for that, but that takes a little bit of investigative work from journalists to really uncover that and it's never complete.

I will say really briefly that some states—and Ms. Bhandari may or may not know more about this—do actually require data brokers to register. That might be something to look at in connection to these types of companies if we want to get more transparency on exactly what is happening on the ground.