U.S. technology company Clearview AI violated Canadian privacy law: report

Four Canadian privacy commissioners are calling on governments to beef up federal and provincial privacy laws after they foundAmerican technology firm Clearview AI violated Canadian privacy laws by collecting photos of Canadians without their knowledge or consent.

The report found that Clearview AI's technology created a significant risk to individuals by allowing law enforcement and companies to match photos against its database of more than three billion images, including Canadians and children.

"What Clearview does, is mass surveillance and it is illegal," federal privacy commissioner Daniel Therrientold reporters Wednesday. "It is an affront to individuals' privacy rights and inflicts broad based harm on all members of society whofind themselves continually in a police lineup."

"This is completely unacceptable."

Therrien said the company continues to claim what it was doing wasappropriate, citing the requirement under federal privacy law that its business needs to be balanced against privacy rights."

British Columbia privacy commissioner Michael McEvoy said he was struck by the "vast amount" of information that was collected without consent.

"I find it unacceptable, to be frank, deeply troubling, that a company would create a giant database of our biometric data and sell it for profit without regard to recognizing or acknowledging how invasive it really is."

McEvoy said the case also highlights the need to strengthen privacy laws in Canada.

"In this case we are left without the ability to consider financial sanctions. This lack of enforcement power combined with Clearview's blatant disregard of privacy laws leaves Canadians vulnerable."

Delete photos of Canadians in database, commissioners say

The commissioners called for ClearviewAI to stop offering its technology in Canada, stop collecting images of Canadians and to delete the photos of Canadians it had already collected in its database.

If the company refuses to follow the recommendations, the four privacy commissioners will "pursue other actions available under their respective acts to bring Clearviewinto compliance with Canadian laws," the statement said.

However, the four acknowledged that under current laws, and even under proposed changes to federal privacy laws, their ability to penalize the company or force it to comply with Canadian orders islimited.

WATCH |Clearview AI violated Canadian privacy law with facial recognition: report

Clearview AI violated Canadian privacy law with facial recognition: report

4 years ago

Duration 1:55

Canadian privacy commissioners have found that American technology company Clearview AI violated Canadian law when it collected images of people without their knowledge or consent.

UK Information Commissioner Elizabeth Denham's office confirmed Wednesday that their office is still investigating ClearviewAI in conjunction with the Office of the AustralianInformation Commissioner.

Doug Mitchell, lawyer for Clearview AI, said the company simply collects public data in the same way ascompanies like Google.

"Clearview AI's technology is not available in Canada and it does not operate in Canada. In any event, Clearview AI only collects public information from the Internet which is explicitly permitted under PIPEDA," Mitchell wrote in a statement, issued minutes after the report was made public.

PIPEDA, Canada's Personal Information Protection and Electronic Documents Act, governs companies.

"The Federal Court of Appeal has previously ruled in the privacy context that publicly available information means exactly what it says: 'available or accessible by the citizenry at large.'" Mitchell wrote. "There is no reason to apply a different standard here."

Privacy experts say technology could be misused

The report by Therrien, McEvoy, Alberta privacy commissioner Jill Clayton and Diane Poitras, president of Quebec's Commission d'accs l'information,comes nearly seven months after ClearviewAI agreed to no longer make its controversial facial recognition software available in Canada. A number of Canadian law enforcement agencies, including the RCMP, Toronto and Calgary police, had been using the advanced technology to help identify perpetrators and victims of crimes.

With the technology, police could input the picture of a victim or suspected criminal and compare it with billions of photos it had collected from the internet and social media accounts.

However, privacy experts warnedthat the technology could be misused.

While police forces said last summer that they stopped using Clearview AI, questions remained about what would happen to the personal information of Canadians that the company had already collected and whether the company would stop collecting personal information belonging to Canadians.

'Proud of our record in assisting Canadian law enforcement'

In July, company CEO Hoan Ton-That said the company had ceased its operations in Canada. He said Canadians would be able to opt out of Clearview AI's search results.

"We are proud of our record in assisting Canadian law enforcement to solve some of the most heinous crimes, including crimes against children," Ton-That said in a statement at the time. "We will continue to co-operate with the (Office of the Privacy Commissioner) on other related issues."

The investigation foundthat ClearviewAIcollected images in Canada and actively marketed its services to Canadian police forces. The RCMPpaid for its services, and there were 48 accounts created for law enforcement agencies and other organizations across Canada.

In a separate investigation, the federal privacy commissioner's office is probingthe way the RCMP used Clearview AI's technology.

In a news conference, Therrien said a small number of private companies in Canada, which he did not name, had also used Clearview AI's technology, but have since stopped.

While the company is no longer allowing its technology to be used in Canada. Therrien said it has refused to delete the photos of Canadians in its database. While it allows individuals to apply to them to be deleted, it requires them to send a photo, he said.

The case raises the thorny issue of the use of facial recognition technology by police and shines a light on the lack of rules and regulations surrounding it in Canada.

Therrien said the privacy commissioners plan to provide guidance this spring to law enforcement agencies concerning the technology but he said Canada's laws have to be updated. While proposed updates to Canada's privacy laws currently before Parliament (Bill C-11) would give him order making powers he currently does not possess, he would like to see the law amended to make it clearer that business concerns should not outweigh privacy.

Therrien said the company has likely collected the images of millions of Canadians in its 3 billion image database.

Therrien said he would also like to seemore types of violations subject to penalties than are currently called for in Bill C-11.

NDP MP Charlie Angus, who had called for an investigation into ClearviewAI, praised the report,

Angus said he plans to call Therriento present his findings to the House of Commons ethics committee and wants the head of the RCMP to appear before the committee as well.

"I will be requesting the head of the RCMPto testify as to why the RCMPused a technology that was illegal and why they misrepresented their use of this illegal technology," he said in an e-mail to CBC News.

However, Angus said he doesn't plan to call on Clearview AI to testify since they are not currently operating in Canada.

Catherine Fortin, spokeswoman for the RCMP, said the force used Clearview AI's technology in a "limited capacity" for its investigations into online sexual exploitation of children and stopped using the technology in July 2020 when the company stopped offering it in Canada.

"With the nature of crime constantly evolving, law enforcement agencies, including the RCMP, must continuously monitor emerging and evolving technologies," Fortinsaid in an email to CBC News. "We also recognize that privacy is paramount and a reasonable expectation of Canadians, which must be balanced with the ability of law enforcement to conduct investigations and protect the safety and security of Canadians."

Fortin said the RCMPis working with Therrien's office on its investigation into how the force used the technology and will review the report made public Wednesday.

Meanwhile, Conservative MP Michael Barrett said in a statement that he was "deeply concerned" by the findings of the investigation into Clearview AI and called for the House of Commons ethics committee to hold hearings into the company.

"Clearview AI's rejection of the Privacy Commissioner's findings and its disregard for Canadian privacy laws raises serious concerns and deserves further scrutiny by parliamentarians."

Elizabeth Thompson can be reached at elizabeth.thompson@cbc.ca