Stop 'mass surveillance' of British Columbians, U.S. company told

B.C.'s information and privacy commissioner has ratcheted up his language in ordering a non-compliant U.S. company to stop collecting and storing facial images of British Columbians

B.C. privacy commissioner Michael McEvoy and federal counterpart Daniel Therrien.

The province's privacy watchdog has ordered a U.S.-based facial recognition company to stop collecting, using and disclosing images of British Columbians without consent.

The order to Clearview AI — made by B.C.'s Information and Privacy Commissioner Michael McEvoy on Dec. 14 — was initially a set of February recommendations that the company has refused to comply with, McEvoy’s office said.

The recommendations followed a joint investigation report by the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the Information and Privacy Commissioner for British Columbia, and the Information and Privacy Commissioner of Alberta.

Similar orders were issued by the Quebec and Alberta commissioners.

They found the New York-based company violated federal and provincial privacy laws.

“What Clearview does is mass surveillance and it is illegal,” Privacy Commissioner of Canada Daniel Therrien said at the time. “It is completely unacceptable for millions of people who will never be implicated in any crime to find themselves continually in a police lineup.”

The commissioners found that Clearview had used facial recognition tool functions in four steps:

• First, it scraped images of faces and associated data from publicly accessible online sources (including social media), and stored that information in its database;
• Second, it created biometric identifiers in the form of numerical representations for each image;
• Third, it allowed users to upload an image through its app, which was then assessed against those biometric identifiers and matched to images in its database, and;
• Fourth, it provided a list of results, containing all matching images and metadata. If a user clicks on any of these results, they are directed to the original source page of the image.

As a result, the order said, Clearview amassed a database of over three billion images of faces and corresponding biometric identifiers, including those of a vast number of individuals in Canada, including children.

That tool was offered to namely law enforcement agencies, although other organizations and private sector entities also accessed it via a free-trial service, the order said.

The commissioners found Clearview did not obtain the requisite consent to collect, use and disclose the personal information of Canadians. The personal information, they concluded, was for an improper purpose.

The commissioners recommended to Clearview that it:

1. cease offering the facial recognition services that were the subject of the investigation to clients in Canada;
2. cease collection, use and disclosure of images and biometric facial arrays collected from individuals in Canada, and;
3. delete images and biometric facial arrays collected from individuals in Canada in its possession.

The order noted that, in May, Clearview responded to the recommendations. It said it had not been providing any services to any clients in Canada since the summer 2020 and would offer an audit trail of services it had offered.

On recommendations two and three, though, Clearview said it was not possible to tell if people in the photos were in Canada at the time the photo was taken, or if they were Canadian citizens.

"'Not only does Clearview not view Canadian law as applying, but to the extent it did, the use of the photographs would be permissible as being publicly available,'" the order quotes Clearview as responding.

The company said it had gone beyond its obligations but "'cannot commit itself to anything that is impossible and or [sic] required by law.'"

Now, McEvoy has issued the following orders to be complied with by Jan. 25, 2022:

• Clearview is prohibited from offering its facial recognition services that have been the subject of the investigation, and which utilize the collection, use and disclosure of images and biometric facial arrays collected from individuals in British Columbia without their consent, to clients in British Columbia;
• Clearview shall make best efforts to cease the collection, use and disclosure of images and biometric facial arrays collected from individuals in B.C. without their consent, and;
• Clearview shall make best efforts to delete the images and biometric facial arrays in its possession, which were collected from individuals in B.C. without their consent.

“We welcome these important actions taken by our provincial counterparts," Therrien said. "While Clearview stopped offering its services in Canada during the investigation, it had refused to cease the collection and use of Canadians’ data or delete images already collected."

“These orders also highlight once again significant shortcomings with the federal private sector privacy law," Therrien continued. "The Office of the Privacy Commissioner of Canada does not have order-making powers under the Personal Information Protection and Electronic Documents Act.”

jhainsworth@glaciermedia.ca

twitter.com/jhainswo