Canada’s Privacy Commissioner says federal legislation updating private-sector privacy laws does not go far enough to protect the public from facial-recognition technology, and requires “significant amendments.”
“We must ensure that our laws are up to par, and that they impose limits to ensure respect for fundamental rights when the technology is used,” Daniel Therrien told the House of Commons standing committee on access to information, privacy and ethics on Monday.
But he said Bill C-11, in the midst of the parliamentary process at the same time as Bill C-10 – which outlines changes to the Broadcasting Act, aimed at streaming platforms – is problematic.
“I think very, very significant amendments should be made to C-11 in order to protect privacy,” he said.
Mr. Therrien also noted his organization is investigating whether online site Pornhub and its Montreal-based parent MindGeek breached the privacy rights of Canadians, but added he was unable to say anything further about the probe.
Women have come forward to say that Pornhub brushed off their pleas to have degrading videos taken down from the site. More than 100 victims of exploitive content and many lawmakers have also called for a full criminal investigation into MindGeek, alleging the company regularly shared child pornography and sexual-assault videos as well as content shot or posted without the consent of subjects.
MindGeek has denied all accusations of wrongdoing, saying it is a global leader in preventing distribution of exploitive videos and images and has zero tolerance for non-consensual content or material featuring the sexual abuse of children.
The proposed Digital Charter Implementation Act, introduced last November, was billed as modernizing the framework for the protection of personal information in the private sector.
It aims to provide greater control and transparency when Canadians’ personal information is handled by companies, allow for the secure movement of information from one organization to another and provide the privacy commissioner with more capacity to compel organizations to comply with directives from the commissioner’s office.
For the most serious offences, fines could reach up to 5 per cent of revenue or $25-million – whichever is greatest – billed by Innovation, Science and Economic Development Canada in a statement “as the strongest fines among G7 privacy laws.”
Mr. Therrien said the new law gives more weight to commercial interests without considering 20 years of lessons on how technology can disrupt privacy rights.
“I urge you to make clear in Bill C-11 that where there is conflict between commercial objectives and privacy protection, Canadians’ privacy rights should prevail,” Mr. Therrien told the committee.
Throughout his testimony, Mr. Therrien referenced the U.S. technology company Clearview AI. In February, his office, along with three provincial privacy commissioners, concluded that the company had broken laws intended to safeguard Canadians’ privacy by providing its facial-recognition software to police. Police forces in Canada, including the RCMP, admitted to acquiring Clearview technology largely through trial accounts the company had offered to officers.
Of concern was the fact that the New York-based company’s software works by comparing photos against an enormous trove the company has amassed of billions of images of faces gathered from popular social-media sites – without the individuals’ consent.
”Despite our findings that Clearview’s activities violated Canadian privacy laws, the company refused to follow our recommendations, such as to delete Canadians’ photos,” Mr. Therrien said.
Mr. Therrien noted his team’s investigation found Clearview collected, used and disclosed biometric information without consent and for inappropriate purposes.
“Remarkably – and shockingly – the new administrative penalty regime created by Bill C-11 would not apply to these and other important violations of the legislation. Such a penalty regime renders meaningless laws that are supposed to protect citizens.”
He urged the committee to emend the bill “to fix this fundamental flaw.”
He said his office is nearing the end of an investigation into the RCMP’s use of Clearview AI, and is working with provincial and territorial colleagues to develop guidance for law enforcement agencies on the use of facial-recognition technologies.
John Power, spokesperson for federal Innovation Minister François-Philippe Champagne, said the act is necessary to provide Canadians with the privacy and data protection they need amid today’s digital reality.
“Privacy issues are now at play in nearly every commercial transaction by businesses both large and small,” he said.
Mr. Power did not directly address Mr. Therrien’s concerns, but said the act’s passage through the parliamentary process will allow for “expert discussion” on its measures.
With a report from The Canadian Press
Know what is happening in the halls of power with the day’s top political headlines and commentary as selected by Globe editors (subscribers only). Sign up today.