RCMP's use of facial recognition tech violated privacy laws, investigation finds

The RCMP's use of a controversial, third-party facial recognition technology was a serious violation of Canada's privacy laws, the privacy commissioner says.

Privacy Commissioner Daniel Therrien tabled a report to Parliament this morning after investigating the national police force's use of software from U.S.-based Clearview AI.

He concluded that by using this software, the RCMP violated the section of the Privacy Act that says that no personal information can be collected by a government institution "unless it relates directly to an operating program or activity of the institution."

"The use of facial recognition technology by the RCMP to search through massive repositories of Canadians who are innocent of any suspicion of crime presents a serious violation of privacy," Therrien said in the report.

"A government institution cannot collect personal information from a third party agent if that third party agent collected the information unlawfully."

RCMP initially denied using Clearview AI

Concerns about Clearview AI's software intensified last year after a New York Times investigation revealed the software had extracted more than three billion photos from public websites like Facebook and Instagram. It then turned them into a database used by more than 600 law enforcement agencies in the U.S., Canada and elsewhere.

The RCMP at first denied using Clearview AI but confirmed it had been using the software last year, after news broke that the company's client list had been hacked.

At the time, the RCMP acknowledged vaguely that "a few units in the RCMP" had been using the tech to "enhance criminal investigations."

It's still not clear what the force was using the technology for.

"Our investigation found that approximately six per cent of the searches made through Clearview was an incident involving child exploitation or child sexual cases. But in something like 85 per cent of the searches that we were able to to look at, the RCMP did not actually account for the use," Therrien said.

"And that is extremely troubling."

Clearview AI has since stopped offering its services to Canada. While Therrien said the RCMP is no longer using the software, he remains troubled that the force did not agree with his conclusion that it contravened the Privacy Act.

The RCMP argued that the law does not "expressly impose a duty to confirm the legal basis for the collection of personal information by its private sector partners, says the report.

"We acknowledge that there is always room for improvement and we continually seek opportunities to strengthen our policies, procedures and training," said the RCMP in a media statement.

NDP MP Charlie Angus said the RCMP's use of this technology adds to the mistrust of the RCMP felt in Indigenous, Black and racialized communities and protest groups.

"The Privacy Commissioner's findings in this report are startling and incredibly disturbing," he said in a media statement.

"Privacy rights are fundamental. Clear rules over the consent and taking of private information must be a priority for our government. The Liberal government must now hold the RCMP to account to implement these recommendations put forward by the Privacy Commissioner."

Better personal data controls needed: Therrien

The report also found the RCMP did not have proper systems in place to track, identify, assess and control this type of personal information.

It recommends that within a year, the RCMP improve its policies, systems and training, which the force has agreed to do.

Brenda McPhail, director of the privacy, surveillance and technology project at the Canadian Civil Liberties Association, said it appears the RCMP was in a rush to use the technology.

"It's not that genie is out of the bottle. It's that people are wanting to use this technology before we've had the necessary public conversations about whether or not we should be using it because it is deeply rights infringing," she said.

"We need to talk to how it can be done to protect people."

A February report from Therrien and three other privacy commissioners found Clearview AI created a significant risk to individuals by allowing law enforcement and companies to match photos against its database of more than three billion images, including Canadians and children.

It called on governments to beef up federal and provincial privacy laws after it found Clearview AI violated Canadian privacy laws by collecting photos of Canadians without their knowledge or consent.

A lawyer for Clearview AI said the company disagrees with the privacy commissioner's assertion that their actions are not fully in accordance with Canadian law.

"Clearview AI respects the RCMP and was honoured to deploy its groundbreaking, lawful technology to help the agency solve crimes, especially crimes against children," said Doug Mitchell, of IMK Advocates.

"Clearview AI has gone beyond its obligations and is willing to consider further accommodations in order to meet some of the Privacy Commission's concerns within the bounds of the law and feasibility.  Clearview AI hopes to continue the dialogue in order to find common ground."