Overview of the Report:
An investigation by the Office of the Information and Privacy Commissioner for British Columbia (OIPC) found that four Canadian Tire stores in the province broke provincial privacy laws. The investigation was initiated following numerous reports of commercial entities using FRT in Canada. The OIPC surveyed several large retail corporations in British Columbia to determine whether they were using facial recognition analysis at their locations. Based on these responses, the Commissioner exercised his authority under s. 36(1)(a) Personal Information Protection Act (PIPA) to investigate several respondents, including Canadian Tire.
The investigation revealed that, since 2019, the four Canadian Tire locations, had been using FRT systems including computer servers, software, and several motion-activated, high-definition FRT cameras throughout their stores. The FRT systems were supplied by several vendors including: FaceFirst installed by SilverPoint Systems and AxxonSoft by SEQ Security Surveillance Services Inc.
The FRT worked by first capturing images of images or videos of any person entering the Canadian Tire stores, including customers, staff, delivery personnel, and minors. Then the software mapped the facial coordinates of each individual’s face to create a biometric template. Subsequently, newly captured images were compared to a stored database of previously identified “Persons of Interest,” who had been identified as being involved in possible instances of theft, vandalism, harassment, or assault. When the FRT system identified a positive match to a Person of Interest, then an automatic alert was sent to store management and security staff.
In 2022, in Winnipeg, Manitoba, a First Nations man, Josh Soika, claimed that he was incorrectly identified by a Canadian Tire store’s FRT camera for allegedly stealing months earlier. Mr. Soika maintains that he never engaged in any theft and was asked to leave the store’s premises. This is just one example of the exclusionary effects that malfunctioning FRT can have on individuals’ civil liberties.
Findings:
In its report, the OIPC found that the Canadian Tire stores in British Columbia:
- Were required to obtain consent prior to, or at the time of, collecting individuals’ images and creating facial biometrics.
- Did not meet the notification requirements of s. 10 of PIPA.
- Did not obtain implicit, or explicit, consent for the collection or use of biometric information via FRT, contrary to ss. 7 and 8 of PIPA.
- The stores did not demonstrate a reasonable purpose, as required by ss. 11 and 14 of PIPA to collect or use personal information through FRT.
Following its investigation, the OIPC made three recommendations for industry and government, including:
- The stores should create and maintain robust privacy management programs that guide internal practices and contracted services.
- The BC Government should amend the Security Services Act or similar enactment to explicitly regulate the sale or installation of technologies that capture biometric information.
- The BC Government should amend the Personal Information Protection Act to create additional obligations for organizations that collect, use, or disclose biometric information, including requiring notification to the OIPC.
Significance:
This report joins a series of recent investigations conducted by federal and provincial privacy commissioners that have examined the use of facial recognition technology by entities in violation of Canadian privacy legislation. In 2021, Office of the Privacy Commissioner of Canada found that the Royal Canadian Mounted Police (RCMP) had violated the Privacy Act through its use of Clearview AI’s FRT software.
These growing number of investigations and findings of violations demonstrate the pressing need for a clear legislative framework to regulate the use of FRT in Canada.