The Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the Office of the Information and Privacy Commissioner for British Columbia, and the Office of the Information and Privacy Commissioner of Alberta (collectively “Privacy Commissioners”) have issued a statement on February 3, 2021, condemning the practices of New York-based Clearview AI and concluding that the company violated federal and provincial privacy laws of Canada. Clearview AI is a technology company that provides facial recognition technology to law enforcement authorities and commercial entities. Clearview AI’s technology is used to match pictures of potential suspects with a databank of app. 3 billion images that are scraped from the internet. The Privacy Commissioner of Canada in this regard notes that a majority of such persons who are associated with the processing of facial recognition have never been implicated in any crime and will probably be never implicated in a crime. Hence, characterising the practises of Clearview AI as mass surveillance which is, in turn, illegal and violative of individual’s privacy rights.
The 4 (four) Privacy Commissioners had initiated a joint investigation to determine whether Clearview AI’s practises of collection and disclosure of personal information through facial recognition was in compliance with Canada’s privacy laws applicable to the private sector. More specifically, the task of the Privacy Commissioners was to determine whether Clearview AI had obtained requisite consent and whether the collection and disclosure of personal information were for an appropriate purpose under Alberta’s Personal Information Protection Act, British Columbia’s Personal Information Protection Act, and Quebec’s Privacy Sector Act. During the investigation, the Privacy Commissioners found that Clearview AI collected sensitive biometric and personal information of people without explicit consent and further disclosed the data of Canadian nationals for inappropriate purposes. In this regard, Clearview AI also marketed the data to law enforcement officials such as the Royal Canadian Mounted Police. Further, the investigation also noted that there were potential harms associated with storing the biometric data with Clearview AI such as data breaches and the risk of misidentification.
Disagreeing with the findings presented by the Privacy Commissioners, Clearview AI argued that (a) Canadian laws would not be applicable to Clearview AI’s business practises as they do not have any ‘real and substantial connection to Canada’; (b) there was no requirement of consent as the information was publicly available; (c) the balance of privacy rights was favoured upon Clearview AI’s appropriate purposes as there was a significant benefit to law enforcement authorities and harm to individuals was unlikely to occur; (d) individuals whose images were being processed did not pose any question of privacy concerns; and (e) Clearview AI should not be held responsible for any errors that may be made by law enforcement authorities in either processing of information or assessment of suspects.
Rejecting the above arguments of Clearview AI, the Privacy Commissioners held that by a mass collection of biometric information without obtaining express consent, the company had violated the reasonable expectation of privacy of individuals, and hence the business interests outweighed the privacy rights. Privacy Commissioners also recommended that Clearview AI restrict from offering any services to Canadian clients and delete all previously collected data.
BlockSuits Comments
Canadian Parliament is currently discussing Bill C-11, which is an act to enact the Consumer Privacy Protection Act (“CPPA”) and the Personal Information and Data Protection Tribunal Act. Bill C-11, when enacted would repeal the Personal Information Protection and Electronic Documents Act. While currently, the Privacy Commissioners have not brought about any penalties against Clearview AI, the Privacy Commissioner of Canada has appealed to Parliament that the Clearview AI case should be taken into consideration while reviewing Bill C-11. The Commissioner of Canada further stated that if there is any conflict between commercial objectives and privacy protection of Canadian individuals then the privacy rights of Canadians should prevail. Bill C-11 will bring a significant change in the privacy regime of Canada, by providing more enforcement powers to the Privacy Commissioner of Canada. Through the enactment of the CPPA, the Privacy Commissioner of Canada would also be able to recommend to the newly formed Data Protection Tribunal to impose comprehensive financial penalties on companies that are violating the CPPA or other parts of Bill C-11. The Clearview AI case is certainly expected to form a substantial discussion point for Parliamentarians who considering the merits of Bill C-11.
Authored by Shivani Agarwal, Founder, and Samaksh Khanna, Co-Founder.
Yorumlar