Federal (Canada) privacy & access decisions

The Office of the Privacy Commissioner of Canada (OPC) investigated the Royal Canadian Mounted Police (RCMP)'s use of facial recognition technology from Clearview AI. The OPC found that the RCMP contravened Section 4 of the Privacy Act by collecting personal information from Clearview AI, as Clearview AI itself had collected this information unlawfully under PIPEDA and provincial privacy laws. The investigation revealed serious and systemic gaps in the RCMP's policies and systems for tracking, identifying, assessing, and controlling novel collections of personal information. Although the RCMP disagreed with the finding of contravention, it committed to implementing the OPC's recommendations for systemic changes, improved training, and robust controls. The OPC concluded that the matter was well-founded and conditionally resolved, pending the full implementation of these recommendations.

• Whether the RCMP's collection of personal information from Clearview AI was directly related to an operating program or activity under Section 4 of the Privacy Act.
• Whether a government institution can collect personal information from a third party that collected the information unlawfully.
• Whether the RCMP had adequate controls to prevent future similar contraventions when collecting novel personal information.
• Whether the RCMP had sufficient knowledge of its obligations under the Privacy Act and common law regarding personal information collection.
• Whether the RCMP had adequate awareness and tracking systems for novel personal information collections.
• Whether the RCMP had processes to identify potential compliance issues before undertaking novel collections.
• Whether the RCMP had processes to complete timely assessments (like PIAs) when warranted.
• Whether the RCMP had effective controls on collection, including policies and monitoring for unauthorized collections.
• Whether the RCMP's use of Clearview AI constituted a justifiable exercise of police powers under common law (Waterfield test).

This report is a compliance monitoring review by the Office of the Privacy Commissioner (OPC) of Statistics Canada's (StatCan) redesigned Financial Transactions Project and Credit Agency Data Project. It follows an earlier OPC investigation that found no contraventions of the Privacy Act but identified significant privacy concerns, leading to recommendations for StatCan to incorporate necessity and proportionality principles. The OPC assessed StatCan's progress, noting reductions in data collection and the implementation of privacy-enhancing measures like a data ethics secretariat and an external ethics body. However, the OPC found that the redesigned project plans still lacked sufficient specificity in describing public goals, failed to demonstrate effectiveness, and did not adequately analyze privacy impacts in context. The OPC concluded that while progress was made, "more work needs to be done" to fully meet its assessment criteria for necessity and proportionality. Consequently, the OPC issued four new recommendations, including describing public goals with greater precision, revisiting effectiveness, analyzing privacy in context, and resubmitting the plans for further review before final implementation. The outcome is classified as well-founded-conditionally-resolved, reflecting partial implementation and the need for further action.

• Whether the redesigned Financial Transactions Project and Credit Agency Data Project met the principles of necessity and proportionality.
• Whether the public goals of the projects were described with a level of specificity and precision commensurate with privacy impacts.
• Whether the effectiveness of the projects was demonstrated.
• Whether privacy impacts were given sufficient analysis in context, considering risk of harm to individuals and broad-based harms.
• Whether StatCan's Necessity and Proportionality Framework aligned with OPC's assessment criteria.
• Whether less privacy-intrusive alternatives were adequately considered and compared.