The RCMP broke the law by using cutting-edge facial-recognition software to collect personal information, the federal privacy watchdog said Thursday in advocating national standards for police concerning the controversial technology.
In a report to Parliament, privacy commissioner Daniel Therrien said there were serious and systemic failings by the RCMP to ensure compliance with the Privacy Act before it gathered information from U.S. firm Clearview AI.
Clearview AI’s technology allows for the collection of huge numbers of images from various sources that can help police forces, financial institutions and other clients identify people.
In a related probe, Therrien and three provincial counterparts said in February that Clearview AI’s database amounted to mass surveillance of Canadians and violated federal and provincial laws governing personal information.
They said the New York-based company’s scraping of billions of images of people from across the internet was a clear violation of Canadians’ privacy rights.
Therrien announced last year that Clearview AI would stop offering its facial-recognition services in Canada in response to the privacy investigation. The move included suspension of the company’s contract with the RCMP.
The complainant who sparked the probe, New Democrat MP Charlie Angus, had expressed serious concerns about the RCMP’s use of Clearview.
The commissioner found that In the course of using paid and trial accounts, the RCMP uploaded images of individuals to Clearview, which then displayed a number of matching images. Along with each matched image, Clearview provided an associated hyperlink to the web page from which the image had been collected.
The commissioner said the RCMP accessed images of Canadians from Clearview AI in the course of its investigative work.
“We were also concerned that the RCMP at first erroneously told our office it was not using Clearview AI,” the report said.
When the Mounties later acknowledged its use, they said publicly it had only used the company’s technology in a limited way, primarily for identifying, locating and rescuing children who were victims of online sexual abuse.
“However, our investigation found the RCMP did not satisfactorily account for the vast majority of the searches it made,” the commissioner’s report said.
Used responsibly and in the right circumstances, facial-recognition technology has the potential to offer great benefits to society, it said.
“For instance, it can support national security objectives, assist police in solving crime or help authorities find missing persons.”
At the same time, facial recognition can be a highly invasive surveillance technology fraught with many risks, the report added.
“Studies have shown that it can provide racially biased results and, given the chilling effect it can have on certain activities, it has the potential to erode privacy and undermine freedoms and human rights such as free expression and peaceful assembly.”
Canadians must be free to participate in the increasingly digital day-to-day activities of modern society without the risk of these activities being tracked and monitored, Therrien told a news conference.
While certain intrusions on this right can sometimes be justified, “individuals do not forgo their right to privacy merely by living and moving in the world in ways that may reveal their face to others, or that may enable their image to be captured on camera.”
The commissioner’s office said Thursday it remains concerned that the RCMP did not agree with the conclusion that it contravened the Privacy Act.
While the commissioner maintains the RCMP was required to ensure the Clearview AI database was compiled legally, the police force argued doing so would create an unreasonable obligation.
Therrien said this is the latest example of how public-private partnerships and contracting relationships involving digital technologies are creating new complexities and risks for privacy.
He encouraged Parliament to amend the Privacy Act to clarify that federal institutions have an obligation to ensure the organizations from which they collect personal information have acted lawfully.
In the end, the RCMP agreed to implement the privacy commissioner’s recommendations to improve its policies, systems and training, the watchdog said.
The measures include full privacy assessments of the data-collection practices of outside parties to ensure any personal information is gathered in keeping with Canadian privacy law.
The RCMP is also creating an oversight function to ensure new technologies are introduced in a manner that respects privacy, the commissioner said.
Implementing the changes will require broad and concerted efforts across the national police force, the report said.
In a statement, the RCMP acknowledged “there is always room for improvement and we continually seek opportunities to strengthen our policies, procedures and training.”
Therrien’s report also includes draft privacy guidance on facial recognition for police agencies. A joint initiative with his provincial and territorial counterparts, the guidance seeks to clarify police agencies’ privacy obligations relating to use of the technology.
The RCMP said there is a need for further engagement concerning not just facial recognition, but all biometric analysis that could be used to support criminal investigations.
“Technologies will continue to evolve rapidly, and with the prevalence of digital media, automated searching and comparison tools are likely to become increasingly useful and available to law enforcement agencies.”
—Jim Bronskill, The Canadian Press
RELATED: RCMP commits to changes on how it collects, uses information about protesters
