The heads of Canada’s privacy protection authorities today issued a joint statement recommending legislators develop a legal framework that establishes clearly and explicitly the circumstances in which police use of facial recognition may be acceptable.
Facial recognition has emerged as a tool of significant interest for police agencies in Canada. Used responsibly and in the right circumstances, the technology could provide public safety benefits such as helping solve serious crimes, locating missing persons and supporting national security objectives.
At the same time, the use of facial recognition involves highly sensitive biometric information, and raises concerns for privacy and human rights.
Canada currently has a patchwork of laws governing facial recognition, which are insufficient to address the risks to privacy and other fundamental rights associated with the technology. A new legal framework should therefore set appropriate limits on police use of facial recognition.
In the joint statement, privacy regulators say a new legal framework for regulating police use of facial recognition technology should include:
- A clear and explicit definition of the purposes for which police use of facial recognition would be authorized, and a list of prohibited uses. “No-go zones” should include a prohibition on any use of facial recognition that can result in mass surveillance.
- Strict necessity and proportionality requirements. Legislation should require police use of facial recognition to be both necessary and proportionate for any given deployment of the technology.
- Independent oversight. Police use of facial recognition technology should be subject to strong independent oversight. Oversight should include proactive engagement measures. Police should be required to obtain pre-authorization from an oversight body at the program level, or provide it with advance notice of a proposed use, before launching an FR initiative.
- Privacy rights and protections. Appropriate privacy protections should be put in place to mitigate risks to individuals, including measures to ensure the accuracy of information and limits to how long images can be retained in police databanks.
Privacy guardians also released final guidance to clarify police agencies’ privacy obligations relating to the use of facial recognition under the current law
