RCMP's use of facial recognition tech violated privacy laws, investigation finds

The RCMP's use of a controversial, third-partyfacial recognition technology was a serious violation of Canada's privacy laws, the privacy commissioner says.

Privacy Commissioner Daniel Therrien tabled a report to Parliament this morning after investigating the national police force's use of software from U.S.-based Clearview AI.

He concludedthat by using this software, theRCMP violated the section of the Privacy Act that saysthat no personal information can be collected by a government institution "unless it relates directly to an operating program or activity of the institution."

"The use of facial recognition technology by the RCMP to search through massive repositories of Canadians who are innocent of any suspicion of crime presents a serious violation of privacy," Therriensaid in the report.

"A government institution cannot collect personal information from a third party agent if that third party agent collected the information unlawfully."

RCMP initiallydenied using Clearview AI

Concerns about Clearview AI's softwareintensified last year after a New York Times investigation revealed the software had extracted more than three billion photos from public websites like Facebook and Instagram. It then turned them into a database used by more than 600 law enforcement agencies in the U.S., Canada and elsewhere.

The RCMP at first denied usingClearview AI but confirmed it had been using the softwarelastyear, after news broke thatthe company's client list had been hacked.

At the time, the RCMP acknowledged vaguely that "a few units in the RCMP" had been using the tech to "enhance criminal investigations."

It's still notclear what the force was using the technologyfor.

"Our investigation found thatapproximately six percent of the searches made through Clearviewwasan incident involving child exploitation or child sexual cases. But in something like 85 per cent of the searches that we were able to to look at, the RCMP did not actually account for the use," Therriensaid.

"And that is extremely troubling."

Clearview AI has since stopped offering its services to Canada.WhileTherrien said the RCMPis no longer using the software,he remains troubledthat the force did not agree with his conclusion that it contravened thePrivacy Act.

The RCMP argued that the law does not "expressly impose a duty to confirm the legal basis for the collection of personal information by its private sector partners, says the report.

"We acknowledge that there is always room for improvement and we continually seek opportunities to strengthen our policies, procedures and training," said the RCMP in a media statement.

NDP MPCharlie Angus said the RCMP's use of this technology adds to the mistrust of the RCMP felt in Indigenous, Black andracialized communities and protest groups.

"The Privacy Commissioner's findings in this report are startling and incredibly disturbing," he said in a mediastatement.

"Privacy rights are fundamental. Clear rules over the consent and taking of private information must be a priority for our government. The Liberal government must now hold the RCMP to account to implement these recommendations put forward by the Privacy Commissioner."

Better personal data controls needed:Therrien

The report also found the RCMP did not have proper systems in place to track, identify, assessand control this type of personal information.

It recommends that within a year, theRCMPimprove its policies, systems and training,which the force has agreed to do.

Brenda McPhail, director of the privacy, surveillance and technology project at the Canadian Civil Liberties Association, said it appears the RCMP was in a rush to use the technology.

"It's not that genie is out of the bottle. It's that people are wanting to use this technology before we've had the necessary public conversations about whether or not we should be using it because it is deeply rights infringing," she said.

"We need to talk to how it can be done to protect people."

A February report from Therrien and three other privacy commissioners found Clearview AI created a significant risk to individuals by allowing law enforcement and companies to match photos against its database of more than three billion images, including Canadians and children.

It called on governments to beef up federal and provincial privacy laws after itfoundClearview AI violated Canadian privacy laws by collecting photos of Canadians without their knowledge or consent.

A lawyer for Clearview AIsaid the company disagrees with the privacy commissioner'sassertion that their actions are not fully in accordance with Canadian law.

"Clearview AI respects the RCMP and was honoured to deploy its groundbreaking, lawful technology to help the agency solve crimes, especially crimes against children," saidDoug Mitchell, of IMK Advocates.

"Clearview AI has gone beyond its obligations and is willing to consider further accommodations in order to meet some of the Privacy Commission's concerns within the bounds of the law and feasibility. Clearview AI hopes to continue the dialogue in order to find common ground."