Three of Canada’s provincial privacy commissioners have ordered facial recognition software provider Clearview AI to comply with recommendations made earlier this year after a joint investigation with the federal privacy commissioner.
In that investigation, the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the Information and Privacy Commissioner for British Columbia and the Information and Privacy Commissioner of Alberta found that Clearview violated federal and provincial private-sector privacy laws by scraping images from the internet without permission and using them in a solution used by some Canadian police forces.
On Tuesday the three provincial commissioners followed up on that report by issuing legally binding provincial orders requiring Clearview to:
- stop offering the facial recognition services that have been the subject of the investigation in the three provinces;
- stop collecting, using, and disclosing images of people in the three provinces without consent; and
- delete images and biometric facial arrays collected without consent from individuals in the three provinces.
But in May, Clearview told the B.C. commissioner that “it is simply not possible, merely from photographs, to identify whether the individuals in the photographs are in Canada at the time the photograph was taken, or whether they are Canadian citizens, residents, etc. ”
While it voluntarily decided in 2020 to stop offering its product in Canada, Clearview also told B.C. it was only willing to do that for another 18 months.
Commenting on the move by the three provincial commissioners, Federal Privacy Commissioner Daniel Therrien noted that Clearview AI refuses to cease the collection and use of Canadians’ data or delete images already collected. Clearview can go to the Federal Court to appeal the orders.
Under Alberta’s privacy act it has 50 days to report to the provincial privacy commissioner on the good faith steps that it has taken to comply with this order. The order may be subject to judicial review.
In a statement, Doug Mitchell, IMK Advocates, attorney for Clearview AI, said the service is a search engine that only collects public data just as much larger companies do, including Google, which is permitted to operate in Canada.
“Clearview AI’s technology is not available in Canada and it does not operate in Canada. In the circumstances, Clearview believes the orders being sought are beyond the powers of the provincial privacy commissioners, as well as being unnecessary.
“To restrict the free flow of publicly available information in the sense proposed by the privacy commissioners would be contrary to the Canadian constitutional guarantee of freedom of expression”
A total of 48 law enforcement and other organizations across the country used the application formally or informally for a time. With Clearview AI, police forces can compare images of suspects to a database of three billion images that Clearview believes it legally assembled from photos that individuals upload to social media and other sites.
But privacy experts around the world question the legality of scraping images of people without their permission. Last month Australia’s privacy commissioner ordered Clearview AI to stop collecting images from websites and destroy data collected in the country after an investigation found it breached privacy law.
In their February decision, the four privacy commissioners concluded Clearview AI not only collected peoples’ images without their consent, it creates the risk of significant harm to individuals, the vast majority of whom have never been and will never be implicated in a crime.
In reply, Clearview refused to comply with the recommendations in that report, saying Canadian privacy laws don’t apply to its activities because the company does not have a “real and substantial connection” to Canada. It also argued consent for collection is not required because the images are publicly available.
In the order Tuesday, B.C. privacy commissioner Michael McEvoy noted that in an Illinois court proceeding, Clearview said it could remove some images using their metadata to identify a location. “I reject Clearview’s bare assertion that it cannot comply [with the Canadian requests] and conclude that Clearview does have the means and ability to severely limit if not eliminate the collection, use, and disclosure of personal information of British Columbians,” he wrote.
“Put another way, this is not a question of cannot [comply] but rather will not.”
Clearview AI’s response illustrates a problem with this country’s federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), which gives the federal privacy commissioner’s office the power to only make recommendations. It has to go to the Federal Court to get binding orders. In 2020 the Liberal government proposed overhauling the law in Bill C-11, which would give the commissioner power to make enforceable orders. However, that bill died when the government called an election in the fall. Recently the government said it will introduce a new bill next year.
Alberta, British Columbia and Quebec have their own privacy legislation covering the private sector. The other provinces and territories follow PIPEDA.
In his remarks, Therrien noted that recent amendments to Quebec’s privacy law and proposals for legislative reform in British Columbia and Ontario provide for greater authority to impose meaningful penalties and create strong incentives for businesses to comply with the law.