Law enforcement’s use of facial recognition is, once again, in the news this week. You may remember that a little while ago it garnered some headlines because a number of privacy commissioners in Canada investigated and reported on the Clearview AI matter. In that case, it was revealed that Clearview was selling its technology to various law enforcement offices in Canada.
This week, the issue is in the news because a Parliamentary Committee has been examining the issue. They heard, for example, from the federal commissioner as well as the Ontario and Quebec commissioners.
Ontario Commissioner Patricia Kosseim spoke at the hearing about the need for a legal framework — not just guidance. She said she wants to see a law codifying the requirements that must be met before law enforcement uses facial recognition technology.
Some of the things she said the law would clarify are:
- Before using facial recognition technologies, police agencies should seek legal advice specific to their jurisdiction and establish that they are lawfully authorized to use it.
- Police need to adopt strong accountability measures, including conducting a privacy impact assessment before deploying the technology and implementing a robust program that is reviewed annually to mitigate privacy risks. Quality and accuracy controls are essential to avoid false positives and reduce the potential for bias against individuals, groups and communities.
- Clear limits must be established for how long images will be retained and how they will be destroyed if they do not register a match or are no longer needed.
- Transparency by police is absolutely critical as are open communications with the public and consultations with local communities on the design of facial recognition programs prior to their deployment.
These ideas were further reflected in a joint statement issued by privacy regulators in Canada on the same day these commissioners appeared before the committee. I agree that something more than guidance is required. I like the idea of a legal mechanism being put into place to ensure reasonable, proper and ethical use of this potentially very invasive technology.
And that’s the main point to all of this: ethics. As we continue to develop these amazing new technologies that have the potential to do great things, we need to remember that they can also be used in ways we might not like. We need our privacy pros, now more than ever, to play that crucial role of data ethicist.