OTTAWA – The RCMP has violated the law by using the latest facial recognition software to collect personal information, the federal watchdog has found.
Privacy Commissioner Daniel Therrien said in a report on Thursday that there were serious and systemic shortcomings by the RCMP to ensure compliance with the Privacy Act before gathering information from the US firm Clearview AI.
Clearview AI’s technology allows for the collection of large numbers of images from various sources that can help police forces, financial institutions and other clients identify people.
In a related investigation, Therrien and three provincial counterparts said in February that Clearview AI’s technology had led to mass surveillance of Canadians and that federal and provincial laws on personal information had been violated.
They said the abolition of billions of images of people from all over the internet in New York was a clear violation of Canadian privacy.
Therrien announced last year that Clearview AI will no longer offer its facial recognition response services in Canada.
The move includes the suspension of the company’s contract with the RCMP, its last remaining client in Canada.
The commissioner’s office said on Thursday it remains concerned that the RCMP does not agree with the conclusion that it violates the Privacy Act.
While the commissioner claims that the RCMP was obliged to ensure that the Clearview AI database was compiled legally, the police force argued that it would create an unreasonable obligation.
Therrien said this is the latest example of how public-private partnerships and contracting relationships with digital technologies create new complexities and risks to privacy.
He urged parliament to amend the Privacy Act to clarify that federal institutions have an obligation to ensure that the organizations from which they collect personal information act lawfully.
Eventually, the RCMP agreed to implement the privacy commissioner’s recommendations to improve its policies, systems and training, the watchdog said.
The measures include complete privacy assessments of the data collection practices of outside parties to ensure that personal information is collected in accordance with Canadian Privacy Act.
The RCMP is also creating a oversight function to ensure that new technologies are implemented in a way that respects privacy, the commissioner said.
Therrien’s report states that the implementation of the changes requires broad and active efforts across the entire national police force.
“We strongly encourage the RCMP to devote the sustained resources and campaigners at senior level needed for the successful implementation of its commitment to the recommendations.”