Privacy commissioners in all four Atlantic provinces have come together to warn Canadians about the implications of facial recognition software.
Timed to coincide with Data Privacy Day on Tuesday, the commissioners sent a joint release outlining concerns they have about the growing popularity of facial recognition technology by public bodies and private companies.
Newfoundland and Labrador information and privacy commissioner Michael Harvey told SaltWire that facial recognition technology has been on his radar and that of his predecessors for a while, but has been employed relatively infrequently in Canada.
“It really came to our attention when it was announced that the Atlantic provinces were moving forward with a collaborative initiative. . .to use facial recognition technology as part of the
driver's licences,” Harvey said.
In a nutshell, provincial governments in the region have been using facial recognition to confirm the identity of individuals seeking a driver’s licence or government-issued photo identification card. “Once a photo has been taken, facial recognition software compares the picture of the individual with the picture on file, and searches for other matches to verify the identity of the individual,” the commissioners explained in a news release.
The intent of the technology is to reduce the risk of identity theft and fraud and help prevent suspended drivers or fraudsters from getting a driver's licence or photo identification card, but Harvey said it comes with concerns of its own.
First of all, Harvey said he believes that if a public body is going to be collecting personal information, then the collection of that personal information should be proportional to what is minimally necessary to serve the purpose for which it is being collected. This minimum threshold principle is already reflected in many privacy acts including in Newfoundland and Labrador.
“This particular technology is pretty privacy-invasive because of its comprehensive nature. It takes pictures of everyone, so our public bodies need to think very carefully about whether it even makes sense to use it because it will almost by definition exceed that minimum necessary threshold in almost every circumstance.”
Also top of the list of concerns is function creep, the propensity for data collected for one thing to eventually be used for something else.
Then there’s the possibility of breaches and the data being accessed by those who should be nowhere near it.
“Even though we regularly hear from public bodies ‘Oh everything is very secure’ we regularly hear about data breaches, sometimes pretty big ones, from actors that we would expect would be using the very highest level of security like major banks like Desjardins or a major health company like LifeLabs.
“These are companies that should have the highest levels of protection and probably do but nevertheless are still vulnerable because the criminals are innovative.”
Finally, Harvey said, is concern about the margin for error in this new and advanced technology.
“There’s still lots of false positives, so people being identified as someone they're not or people who are not being identified as themselves, and there are some studies that have shown that the technology can better at identifying white males than others,” he said. “Particularly if it's being used for law enforcement there's a potential for a racial and gender bias to creep into our justice system.”
While Harvey said the use of facial recognition technology isn’t always inherently bad or worrisome, it’s important for Canadians to be aware of their privacy and to ask questions of their elected officials.
He said he’s pleased that the federal government plans to review its privacy legislation but said legislation reviews are also needed at the provincial and territorial level in order to account for new developments and technological advancements.
“We believe we need strong laws to protect the privacy of Canadians,” Harvey said.