Clearview AI broke Canadian privacy laws by selling software to police, watchdogs say

Open this photo in gallery:

Canadian privacy commissioners say that U.S. technology company Clearview AI has broken laws intended to safeguard Canadians’ privacy by providing its powerful facial-recognition software to police.

“What Clearview does is mass surveillance and it is illegal,” Canadian Privacy Commissioner Daniel Therrien said Wednesday. He urged Parliament to strengthen data-privacy laws after a year-long investigation his office undertook with counterpart commissioners in Quebec, Alberta and British Columbia.

Most facial-recognition software works by comparing photos of unknown people to relatively small databases of identifiable people. But the software of New York-based Clearview AI works by comparing such photos against an enormous trove the company has amassed of billons of images of faces gathered, without people’s consent, from popular social-media sites.

In January, 2020, Clearview AI found itself at the centre of a global controversy after its technology was revealed through a New York Times investigation.

Police forces in Canada, including the RCMP, the Ontario Provincial Police and the Toronto Police Service, admitted they had acquired the technology, largely through trial accounts that the company had offered to detectives and officers. Privacy investigations helped put an end to this practice. Clearview AI “discontinued its services to its only remaining Canadian subscriber, the RCMP, in July, 2020,” said Vito Pilieci, a spokesman for the federal commissioner.

The investigation by the four Canadian privacy commissioners is one of the first to declare that Clearview AI’s data gathering is illegal. The company is facing lawsuits and privacy-law investigations around the world.

The privacy commissioners in Canada have not pursued any penalties yet against Clearview AI. But they are demanding that the company stop collecting data about Canadians and delete files based on their faces.

Mr. Therrien said that he will go to court, or form alliances with other privacy commissioners, to compel the company to follow through on this. “We are working, in this case with, provincial colleagues who have order-making authority and we know there are also foreign data-protection authorities of other jurisdictions outside of Canada who are also investigating Clearview.”

The four privacy commissioners say that their investigation left no question that the use of Clearview AI software “represented mass surveillance and was a clear violation of the privacy rights of Canadians.”

Their statement added that “the company’s databank of more than three billion images, including of Canadians and children” exposed people to police searches that created “the risk of significant harm to individuals, the vast majority of whom have never been and will never be implicated in a crime.”

The four privacy commissioners said that their investigation found that 48 entities in Canada had gotten user accounts with Clearview starting in 2019.

Most often these organizations were police forces, some of which conducted facial-recognition searches using these accounts thousands of times. But the privacy commissioners say that “commercial entities” in Canada have used the software too – though they declined to name companies because their use of the software was said to be “extremely infrequent.”

Mr. Therrien said Wednesday he would later consider naming those companies, but that “we should be focusing on Clearview, which is clearly at the centre of privacy violations here.”

Clearview AI has defended its technology by saying that it usually only sells its software to law-enforcement bodies. On Wednesday, it issued a statement saying it has never broken Canadian laws or undermined Canadians’ collective privacy.

“Clearview AI is a search engine that collects public data just as much larger companies do, including Google,” said Doug Mitchell, a Montreal lawyer acting for the company.

The federal privacy commissioner says there are legal limits to what he can do against any company given his lack of legislated powers. “Currently I have no order-making powers nor the authority to impose financial penalties,” Mr. Therrien said.

New legislation before Parliament is intended to address this, but Mr. Therrien said that the proposed fixes would not correct the enforcement gaps.

“The violations of privacy law that we found in relation to Clearview would not lead to financial penalties according to Bill C-11,” Mr. Therrien said. He said that he hopes parliamentarians will amend the bill to grant his office greater powers.

Our Morning Update and Evening Update newsletters are written by Globe editors, giving you a concise summary of the day’s most important headlines. Sign up today.