RCMP use of Clearview AI facial recognition service violated Privacy Act, says report

The RCMP’s use of facial recognition technology to conduct hundreds of searches of a database compiled illegally by facial recognition software provider Clearview AI violated the federal Privacy Act, Canada’s privacy commissioner said in a report to Parliament this morning.

“The use of FRT (facial recognition technology) by the RCMP to search through massive repositories of Canadians who are innocent of any suspicion of crime presents a serious violation of privacy,” said Commissioner Daniel Therrien. “A government institution cannot collect personal information from a third party agent if that third party agent collected the information unlawfully.”

The RCMP stopped using Clearview AI after the company ceased offering its services in Canada last summer in the wake of an investigation by four of the country’s privacy commissioners. In a report issued in February, the commissioners denounced Clearview AI  for scraping billions of images of Canadians from across the internet for inclusion in its application. The move represented mass surveillance and was a clear violation of their privacy rights, the commissioners said.

Nevertheless, Therrien said in a statement this morning, the RCMP doesn’t agree with his conclusion that the Mounties contravened the Privacy Act – the legislation that governs federal departments’ use of personal information.  

The legislation says in part “no personal information shall be collected by a government institution unless it relates directly to an operating program or activity of the institution.”

Therrien maintains the onus was on the RCMP to ensure the database it was using was compiled legally. However, he said in the statement, the RCMP argued doing so would create an unreasonable obligation and that the law does not expressly impose a duty to confirm the legal basis for the collection of personal information by its private sector partners.

Therrien says this is just another example of how public-private partnerships and contracting relationships involving digital technologies are creating new complexities and risks for privacy.

“Activities of federal institutions must be limited to those that fall within their legal authority and respect the general rule of law,” Therrien said in a news release. “We encourage Parliament to amend the Privacy Act to clarify that federal institutions have an obligation to ensure that third-party agents it collects personal information from have acted lawfully.”

In the end, the RCMP agreed to implement the Office of the Privacy Commissioner’s recommendations to improve its policies, systems and training. This includes conducting fulsome privacy assessments of third-party data collection practices to ensure any personal information is collected and used in accordance with Canadian privacy legislation.

The RCMP is also creating a new oversight function intended to ensure new technologies are on-boarded in a manner that respects individuals’ privacy rights.

The report also includes proposed guidance from the country’s four privacy commissioners to police departments on the use of facial recognition applications. The commissioners don’t call for a ban on facial recognition, but the guidance they provided indicates it has the potential to be “a highly invasive surveillance technology.”

“Used responsibly and in the right circumstances, [facial recognition] may assist police agencies in carrying out a variety of public safety initiatives, including investigations into criminal wrongdoing and the search for missing persons,” the commissioner’s report explained.

Clearview AI technology allows law enforcement and commercial organizations to match photographs of people against the company’s databank of more than three billion images scraped from internet websites without users’ consent. Each picture includes a hyperlink to the internet address from where it was scraped. This allows users to collect additional contextual information from the internet if such information is still accessible. The hyperlink itself can contain personal information in some cases, depending on the web address. The RCMP said it relied on the assertions from Clearview AI that their images were all from publicly available information.

But the result, said Therrien, was that billions of people essentially found themselves in a “24/7” police line-up.

Publicly, the Mounties said they only used the company’s technology in a limited way, primarily for identifying, locating and rescuing children who have been, or are, victims of online sexual abuse.

However, Therrien found the RCMP didn’t satisfactorily account for the vast majority of the searches it made. According to Clearview’s records, the RCMP conducted hundreds of searches using the service through at least 19 paid and trial user accounts across the country.

“This highlights what our investigation revealed in more detail: that the RCMP has serious and systemic gaps in its policies and systems to track, identify, assess and control novel collections of personal information,” Therrien wrote. “Such system checks are critical to ensuring that the RCMP complies with the law when it uses new technology such as FRT, and new sources, such as private data.”

Therrien is also asking Parliament to amend the Privacy Act to clarify that the RCMP has an obligation to ensure that third-party agents it collects personal information from — such as Clearview Ai — have acted lawfully.

The federal and provincial privacy commissioners have created draft guidance for Canadian police forces on the use of facial recognition software. It emphasizes that police agencies must have a lawful authority for the proposed use of the technology, and the importance of applying privacy-protective standards that are proportionate to the potential harms involved.

The guidance suggests police should not use FRT just because it is thought to be “useful” for law enforcement in general. Police should have a specific reason to use the technology and it should be based on evidence. “It is not enough to rely on general public safety objectives to justify the use of such an intrusive technology. The pressing and substantial nature of the specific objective should be demonstrable through evidence.”

This guidance has yet to be finalized.

The use of facial recognition software by police departments and governments has been controversial around the world. It has been banned by a number of U.S. cities. Last month the state of Massachusetts passed one of the first state-wide restrictions of facial recognition as part of a sweeping police reform law. Police need a court order before they can compare images of suspects to the database of photos and names held by the motor vehicle registry, the FBI, or Massachusetts State Police.

In April the European Union’s privacy watchdog, the European Data Protection Supervisor (EDPS), said facial recognition should be banned in Europe because of its “deep and non-democratic intrusion” into people’s private lives.

At a news conference Therrien said one of his concerns is that the RCMP couldn’t account for the overwhelming majority of its use of Clearview.Six per cent of the searches related to incidents involving possible offences against children. However, 85 per cent of the searches couldn’t be accounted for. At least some of them involved tests of the system’s potential.