The Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the Office of the Information and Privacy Commissioner for British Columbia and the Office of the Information and Privacy Commissioner of Alberta have found Clearview AI violated federal and provincial privacy laws.
Following its joint investigation, the commissioners determined Clearview's collection of more than three billion images, millions of which belong to Canadians, took place without the knowledge or consent of citizens. Additionally, the commissioners found the company did not use and disclose the collected data properly.
Clearview's actions drew a strong rebuke from Privacy Commissioner of Canada Daniel Therrien.
"What Clearview has done is mass surveillance, and it is illegal," said Therrien during a call on the investigation. "It is an affront to individuals’ privacy rights and inflicts broad-based harm on all members of society who find themselves continually in a police line-up. This is completely unacceptable."
Therrien's sentiments were echoed by the other commissioners.
"What stands out to me in this investigation is the vast amount of personal information that was collected without people’s knowledge or consent," said British Columbia Information and Privacy Commissioner Michael McEvoy. "This type of collection represents mass identification and surveillance of individuals, and I find it unacceptable, and to be frank, deeply troubling that a company would create a giant database of our biometric data and sell it for profit without acknowledging how invasive it really is."
The facial recognition company has been in the news frequently over the past year, and the results of the commissioners' investigation will likely be closely analyzed. Borden Ladner Gervais Senior Associate Max Jarvie found the findings ultimately met expectations.
"Fundamentally the finding is unsurprising and aligns with existing guidance and jurisprudence," Jarvie said in an emailed statement. "The analysis is wide-ranging and there are a variety of comments that will be important to parse carefully, but the crux of the issue is whether the information in question is publicly available."
The public availability of those images were one of the arguments Clearview brought forth in its disagreement with the commissioners' findings, as the facial recognition firm said consent was not needed to use the information since it was freely made available.
Clearview said it did not violate federal and provincal privacy laws since it did not have a "real and substantial connection to Canada." It also argued that those who had their images scraped "did not have substantial privacy concerns justifying an infringement of the company’s freedom of expression" and that Clearview's line of business constituted an appropriate purpose for using the data.
The commissioners rejected Clearview's arguments, but Therrien noted elements in Canada's current laws allowed the company to put forth its claims.
"I think the worse part of the arguments, as far as I’m concerned, is that their corporate interests should prevail over the privacy interest of people whose images were scraped and then disclosed. I think that’s preposterous, frankly, but there is some foundation in federal law for the argument that Clearview is advancing," said Therrien. "I think we are right legally in our conclusions, but I think federal law, for one, could be clearer on the fact that this kind of mass surveillance should be completely prohibited and that commercial interests shouldn’t give way to privacy rights."
The commissioners offered recommendations for Clearview to address the findings. One suggestion is for Clearview to delete all biometric images belonging to Canadians. Therrien acknowledges this task will not be an easy one given the large number of images the company possesses.
As part of its ongoing legal issues in the U.S. state of Illinois, Therrien said Clearview is accepting submissions from individuals who wish to have their information deleted. One would have to send in a picture of themselves for Clearview to match with their systems in order to do so.
Therrien said the commissioners have been in contact with Clearview about finding a better method for image deletion, but given the company's reluctance to accept the findings, he does not anticipate a solution any time soon.
"It’s not obvious how Clearview would be able to provide a remedy, but we have started discussions with them last summer and these discussions have not been pursued," said Therrien. "Let’s just say that we were not satisfied with the Illinois solution. We are in conversation with the company to offer something better. At this point, we made recommendations and Clearview doesn’t want to follow our recommendations so I’m not too optimistic."
Under the current federal law, the OPC has no order-making authority. Therrien said the option to take Clearview to federal court is on the table, and he will look toward his provincial colleagues who do have order-making powers, or perhaps foreign data protection authorities in other jurisdictions, to take the lead.
What the commissioners also found is the current slate of privacy laws in Canada are not sufficient to regulate facial recognition. The provincial commissioners said the Clearview situation shows their respective laws need improvements.
"This investigation once again emphasizes our need to strengthen privacy laws both in B.C. and other jurisdictions across Canada to properly protect the public," said McEvoy. "In this case, we are left without the ability to consider financial sanctions. This lack of enforcement power, combined with Clearview’s blatant disregard of privacy laws, leaves Canadians vulnerable."
Alberta Information and Privacy Commissioner Jill Clayton made a similar statement for her province.
"Our joint investigation into Clearview AI shows that in Alberta, we also need to be discussing the acceptable uses and regulations of facial recognition. Regulation would not only assist in upholding privacy rights, it would provide much needed certainty to all organizations thinking about using or developing this technology," said Clayton. "In my view, Alberta’s legislature should be reviewing and assessing the use of this technology, and others, when considering amendments to Alberta’s private and public sector privacy laws."
Conventional wisdom may suggest the effort to revamp the Personal Information Protection and Electronic Documents Act may alleviate some of these concerns on a federal level. While Bill C-11, also known as the Consumer Privacy Protection Act, would give the OPC order-making powers and the ability to administer financial penalties, Therrien would not have been permitted to fine Clearview for its infractions under the proposed bill.
Therrien said Bill C-11 does not contain any provisions that allow him to penalize an organization for consent violations. Therrien said he plans to address these concerns when he is ultimately called to speak to Parliament on the legislation.
"We have a problem with how narrow the fines are for potential violations of the new law, and we think that provision should be amended," said Therrien. "When you hear in the media when data protection authorities fine violations of privacy law, it usually relates to whether consent provisions were appropriately respected. It is, I think, a huge gap in Bill C-11 that only very few violations are subject to penalties."
The Clearview investigation may have reached its conclusion, but that does not mean regulators are done with facial recognition. The OPC still has an ongoing investigation into the Royal Canadian Mounted Police's use of Clearview's service.
It is likely when the RCMP investigation is concluded the OPC will offer a similar stance to the one it took in the Clearview case and other facial recognition investigations.
"The commissioners have demonstrated in this case, and in other recent findings relating to facial recognition technologies that collect biometric information, that they take a dim view of the collection of such information without meaningful consent," said Jarvie. "In these contexts, express opt-in consent is likely to be required. That said, it will still be a context-specific exercise."
The OPC and its provincial counterparts are also working on guidance for law enforcement agencies on the proper use of facial recognition, demonstrating the conversations around the technology are far from over.
"We are at the final stages on working on this document, but what this case illustrates is the absence of clear rules and regulations about facial recognition should lead to law," Therrien said. "In the meantime, we have been working on guidance to police forces that we intend to make public in the spring."
Photo by Ravi Patel on Unsplash
