The Office of the Privacy Commissioner of Canada ('OPC') announced, on 14 December 2021, that the Information and Privacy Commissioner of Alberta, the Information and Privacy Commissioner for British Columbia, and the Quebec Commission on Access to Information (jointly 'the Commissioners') had issued their orders against Clearview AI, Inc., following a joint investigation on Clearview AI's facial recognition activities. In particular, Alberta's Order No. P2021-12 found violations of Sections 7, 11, 16, and 19 of the Alberta's Personal Information Protection Act, SA 2003 c P-6.5 ('AB PIPA'), British Columbia's Order No. P21-08 found violations of Sections 7, 8, 11, 14, and 17 of the British Columbia's Personal Information Protection Act, SBC 2003 c 63 ('BC PIPA'), and Quebec's Case No. 1023158-S found violations of Articles 2, 6, 13, and 14 of the Quebec's Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1 ('the Act').

Background to the orders

The orders follow the conclusion of a joint investigation by the Commissioners on 3 February 2021, which was initiated in February 2020 to investigate Clearview AI over its alleged use of facial recognition technology to collect images and make facial recognition available to law enforcement for the purposes of identifying individuals, without obtaining their consent. Following the conclusion of the joint investigation, the Commissioners recommended that Clearview AI ceases offering the facial recognition services that were the subject of the investigation, ceases collecting, using, and disclosing images and biometric facial arrays collected from individuals in Canada, and deletes such images and biometric facial arrays in its possession. The Commissioners also jointly sent a letter to Clearview AI, requesting a response to several questions regarding the recommendations, but stated that Clearview AI did not take appropriate action to comply with the recommendations.

Findings of the Commissioners

The Commissioners noted that they had jointly sent a letter to Clearview AI on 26 April 2021, requesting a response to questions regarding the issued recommendations following the conclusion of the joint investigation. In this regard, the Commissioners stated that Clearview AI did not take appropriate measures with respect to the violations of the AB PIPA, BC PIPA, or the Act. Specifically, the Commissioners detailed that Clearview AI had addressed some of the recommendations, but stated that Clearview AI had already gone beyond its obligations and was willing to meet some of the requests of the Commissioners. However, Clearview AI could not commit to complying with the recommendations issued by the Commissioners. As a result, the Commissioners stated that this action necessitated the issuance of binding orders.

Outcomes

The Alberta Commissioner ordered Clearview AI to cease offering all of the facial recognition services that have been the subject of this investigation to clients in Alberta, cease collecting, using, and disclosing images and biometric facial arrays collected from individuals in Alberta, and delete such images and biometric facial arrays in its possession. In addition, the Alberta Commissioner ordered Clearview AI to report to it, within 50 days of the date of Order No. P2021-12, on the good faith steps that it has taken to comply with Order No. P2021-12.

The British Columbia Commissioner ordered Clearview AI to cease offering its facial recognition services that have been the subject of the investigation, and which use the collection, use, and disclosure of images and biometric facial arrays collected from individuals in British Columbia without their consent, to clients in British Columbia. In addition, the British Columbia Commissioner ordered Clearview AI to make best efforts to cease the collection, use, and disclosure of images and biometric facial arrays collected from individuals in British Columbia without their consent, and to make best efforts to delete such images and biometric facial arrays in its possession, which were collected without individuals' consent. The British Columbia Commissioner required compliance with these orders by 25 January 2022 and to provide the Commissioner's Registrar with written evidence of compliance by the same date.

The Quebec Commissioner ordered Clearview AI to cease compiling files on individuals on the occasion of the operation of a business in Quebec, to cease collecting images, without the consent of individuals concerned, during the operation of a business in Quebec, to cease using these images to create biometric identifiers without the consent of individuals concerned, and to destroy, within 90 days of receipt of the decision, images and biometric identifiers collected and created without the consent of individuals concerned during the operation of a business in Quebec.

You can read the press release and access the orders here.