The RCMP’s use of a controversial, third-party facial recognition technology was a serious violation of Canada’s privacy laws, the privacy commissioner says.
Privacy Commissioner Daniel Therrien tabled a report to Parliament this morning after investigating the national police force’s use of software from U.S.-based Clearview AI.
He concluded that by using this software, the RCMP violated the section of the Privacy Act that says that no personal information can be collected by a government institution “unless it relates directly to an operating program or activity of the institution.”
“The use of facial recognition technology by the RCMP to search through massive repositories of Canadians who are innocent of any suspicion of crime presents a serious violation of privacy,” Therrien said in the report.
“A government institution cannot collect personal information from a third party agent if that third party agent collected the information unlawfully.”
RCMP initially denied using Clearview AI
Concerns about Clearview AI’s software intensified last year after a New York Times investigation revealed the software had extracted more than three billion photos from public websites like Facebook and Instagram. It then turned them into a database used by more than 600 law enforcement agencies in the U.S., Canada and elsewhere.
The RCMP at first denied using Clearview AI but confirmed it had been using the software last year, after news broke that the company’s client list had been hacked.
At the time, the RCMP acknowledged vaguely that “a few units in the RCMP” had been using the tech to “enhance criminal investigations.”
“We are concerned by the willingness of the RCMP to abrogate its responsibility in respecting the privacy rights of Canadians in favour of accepting general assertions of a private company without any attempt at validation,” says the report.
Clearview AI has since stopped offering its services to Canada. While Therrien said the RCMP is no longer using the software, he remains troubled that the force did not agree with his conclusion that it contravened the Privacy Act.
“While the Office of the Privacy Commissioner maintains the onus was on the RCMP to ensure the database it was using was compiled legally, the RCMP argued doing so would create an unreasonable obligation and that the law does not expressly impose a duty to confirm the legal basis for the collection of personal information by its private sector partners,” says the report.
CBC News has requested comment from the RCMP.
NDP MP Charlie Angus said the RCMP’s use if this technology adds to the mistrust of the RCMP felt in Indigenous, Black and racialized communities and protest groups.
“The Privacy Commissioner’s findings in this report are startling and incredibly disturbing,” he said in a media statement.
“Privacy rights are fundamental. Clear rules over the consent and taking of private information must be a priority for our government. The Liberal government must now hold the RCMP to account to implement these recommendations put forward by the Privacy Commissioner.”
Better personal data controls needed: Therrien
The report also found the RCMP did not have proper systems in place to track, identify, assess and control this type of personal information.
It recommends that within a year, the RCMP improve its policies, systems and training, which the force has agreed to do.
A February report from Therrien and three other privacy commissioners found Clearview AI created a significant risk to individuals by allowing law enforcement and companies to match photos against its database of more than three billion images, including Canadians and children.
It called on governments to beef up federal and provincial privacy laws after it found Clearview AI violated Canadian privacy laws by collecting photos of Canadians without their knowledge or consent.
A lawyer for Clearview AI said the company disagrees with the privacy commissioner’s assertion that their actions are not fully in accordance with Canadian law.
“Clearview AI respects the RCMP and was honoured to deploy its groundbreaking, lawful technology to help the agency solve crimes, especially crimes against children,” said Doug Mitchell, of IMK Advocates.
“Clearview AI has gone beyond its obligations and is willing to consider further accommodations in order to meet some of the Privacy Commission’s concerns within the bounds of the law and feasibility. Clearview AI hopes to continue the dialogue in order to find common ground.”