Use of facial recognition technology prompts questions from Atlantic privacy commissioners

Each of the four privacy commissioners in Atlantic Canada have questioned their own provincial government regarding the use of facial recognition technology to prevent identity theft in the issuance of driver's licences in the region.

The revelation was included in a joint media release issued Tuesday — recognized as Data Privacy Day — in which the four commissioners urged Atlantic Canadians to "consider carefully" the privacy implications from the increasing usage of facial recognition technology.

New Atlantic-wide driver's licences were introduced in 2017, with officials touting their enhanced security features.

What officials didn't spell out from the beginning, at least not on P.E.I. — facial recognition software is used by all four provinces to verify the identity of the individual obtaining a licence.

It's something that can be done without any of us knowing about it.— Karen Rose, P.E.I. privacy commissioner

The privacy commissioners say the software compares a new driver's licence photo with existing photos on file in an attempt to prevent identity fraud.

'You're not always aware'

But P.E.I. commissioner Karen Rose said the provincial government didn't provide explicit information to Islanders letting them know their faces were being scanned until after the commissioner herself came forward with questions.

Rose said it's important for governments to let people know what information is being captured and why.

"Especially with facial recognition because although it's the equivalent of iris scan or fingerprint, it's something that can be done without any of us knowing about it," she said.

"Whereas if you're putting your finger on something to get a print you're very aware that someone is using your biometric information, but with facial recognition you're not always aware and that's why notification is very, very important."

In their joint media release, the four commissioners said there is an onus on governments to educate and consult with the public on the use of the technology. They also said governments should weigh the privacy implications against the potential benefits when employing the technology themselves.

On a current web page detailing the province's driver's licence system, the P.E.I. government says facial recognition software is used to "prevent suspended drivers or fraudsters" from obtaining a licence. The website refers to the technology as "powerful and proven," and says that "facial recognition data will not be shared with outside parties, except when required by court order."

But older versions of the same web page archived on the internet show that, for up to a year after the new program had been rolled out, there was no mention at all that facial recognition software was being used.

Could be used for 'other purposes'

David Fraser, a Halifax lawyer who specializes in privacy, said one concern for him is whether any of the Atlantic provinces might make its facial recognition data available for another purpose like law enforcement.

"Now they have a database with the photographs of every single driver in Atlantic Canada, and they also have the faces of everybody who's applied for a provincial ID, and that can be used for other purposes," he said. 

"That can be used in connection with surveillance cameras to determine who was in a particular place at a particular time."

They have a very high false-positive rate.— David Fraser, lawyer

It's something the four privacy commissioners refer to as "scope creep." They and Fraser point to a 2011 case where the agency that issues driver's licences in B.C. offered to share its facial recognition software to assist police in identifying vandals and rioters in Vancouver following a Stanley Cup final loss.

B.C.'s privacy commissioner ordered the Insurance Bureau of British Columbia to stop responding to requests from police to use its facial recognition database without a subpoena, warrant or court order.

"It goes against one of the principle maxims of privacy law, which is that information collected for one purpose should only be used for that purpose unless there's a legal basis for it to be used for a second purpose," Fraser said.

Fraser also said facial recognition can be unreliable. 

"They have a very high false-positive rate. So they falsely identify people regularly and they also falsely identify people much more regularly if they're people of colour ... or other minority groups because they're only as good as the data they're trained on."

Rose and the other commissioners describe facial recognition as "privacy invasive" by its very nature. They said its use by various governments in Canada "has been relatively limited," but trends in the U.S., Europe and China show its use spreading to schools and other public areas.

Rose said she's satisfied P.E.I. is properly safeguarding its data. One thing she said she wasn't able to find out though is just how many times people had obtained fraudulent driver's licences, something to show the scope of the problem that might then justify government's move to start using facial recognition software.

All four commissioners say they've committed to continue to monitor and address further expansion of facial recognition by their respective governments.

More P.E.I. news