British Columbia Privacy Commissioner Michael McEvoy speaks during a news conference in Ottawa on April 25, 2019. McEvoy says he's considering launching an investigation into the use of facial recognition technology by the federal Liberals.Adrian Wyld/The Canadian Press
Facial recognition technology used by the governing Liberals to verify the identities of people voting in the party’s candidate nomination elections may be investigated by privacy commissioners at the federal and provincial levels.
After The Globe and Mail reported on Wednesday that the Liberal Party of Canada is using the technology, the federal NDP asked Canada’s Privacy Commissioner, Daniel Therrien, to launch a probe. Meanwhile, B.C.’s Information and Privacy Commissioner, Michael McEvoy, said his office is now reviewing the Liberal Party’s practices.
“We are going to look into the matter ourselves and review it before drawing any conclusions,” Mr. McEvoy told the Globe and Mail on Thursday. The main questions, he said, are whether the data has been “appropriately collected, whether it’s been appropriately used,” and whether the process was compliant with B.C. law.
Federal political parties are exempt from federal privacy laws, which put safeguards on the collection and use of personal information. But their operations in British Columbia fall under provincial privacy laws.
The Liberal party said it is using the technology to verify identities in B.C. nomination races and in other races across the country.
The technology is controversial because it is seen as invasive. The Canadian Civil Liberties Association (CCLA) sent the Liberals a letter on Wednesday asking the party to “cease and desist” from using it. The association refers to facial recognition as facial fingerprinting, because its use is comparable to obtaining a fingerprint – a biological pattern unique to every individual.
Civil liberties group urges Liberal Party to stop using facial recognition technology
The Liberal Party is using a version of the technology built by Jumio, a California-based company. Voters in Liberal nomination races are directed to a website, operated by Jumio. The website uses facial recognition to verify a picture of the front and back of each voter’s driver’s licence against a selfie.
NDP MP Charlie Angus wrote a letter to Mr. Therrien on Thursday asking him to review the matter. The letter raises concerns that the Liberal Party did not adequately disclose that it is using facial recognition to verify identities. The party’s website does not mention the technology by name. Instead, it refers to a “secure automated ID verification portal.”
Mr. Angus asked Mr. Therrien to address whether “commercial third parties who are contracted by political parties enjoy blanket immunity from Canada’s privacy laws.”
“It is troubling that Canadians may be unwillingly turning over facial data to an American-based company that may not be following Canadian laws,” Mr. Angus wrote in the letter.
The Liberal Party has said that “verification information is deleted automatically and immediately, and not retained or stored.” On Wednesday, Mr. McEvoy said the problem is that there is no way to verify if this is the case.
In an interview, Mr. Angus described using facial recognition to verify identities in a local nomination race as the “nuclear option.”
He said the federal political parties should not be exempt from privacy laws. As it stands, he said, all they have to do is “pinky swear that they’re doing the right thing.”
In an emailed statement on Thursday, Liberal spokesperson Matteo Rossi said the nomination process is in line with the party’s privacy policy and public guidance from Mr. Therrien’s office.
“Privacy commissions across Canada do vital work to help ensure that Canadians’ personal information is appropriately safeguarded, and we will always be pleased to engage with them about our commitment to doing the same,” Mr. Rossi said.
Jumio did not provide a response to The Globe’s requests for information on Wednesday or Thursday. Its privacy policy describes the company as a “data processor” and not a “data controller” and says the company makes its services available “to third parties for integration into those third parties’ websites, applications, and online services.” The policy says that Jumio “collects, uses, and discloses individual users’ information only as directed by these third parties.”
But the same policy says that “Jumio may process certain individual users’ information in anonymized and/or aggregated form for its own purposes.”
Representatives from the other major political parties have told The Globe they do not use facial recognition technology for any element of their party’s work.
In its letter, the CCLA acknowledged that the type of technology the Liberal Party is using is likely “less invasive” than other forms of facial recognition because it compares one photo to a picture of an ID, rather than searching a database to find a matching face.
Mr. Rossi stressed on Thursday that voters who prefer not to submit to facial recognition can have their identities verified by other means. “It’s important to note that the party makes it clear that manual ID verification is always possible as an option for anyone who wants it,” he said.
Know what is happening in the halls of power with the day’s top political headlines and commentary as selected by Globe editors (subscribers only). Sign up today.
Marieke Walsh