Last week, La Ronde installed a biometric fingerprint reading system for season passes. Although La Ronde’s objectives may be entirely legitimate, the process was not validated as such by the Commission d’accès à l’information before being put in place, as prescribed by the Act to establish a legal framework for information technology (“LCCJTI”) [1]. The CAI therefore, in all likelihood, had no time to check whether everything had been implemented in a way that respects the rules of the LCCJTI and the right to privacy.
It appears that more and more businesses want to put biometrics in place as a means of recognizing identity. These technologies are attractive in several respects, economically in particular, but they do raise questions. As my master’s thesis was on this subject, I think it worth setting out here some of the legal aspects of the practice.
First, the risks arising from the processing of biometric data are significant. They concern, among others, the diversion of the data to other uses, identity theft, surveillance and the international movement of information. For example, the USA Patriot Act grants the American government, under certain conditions, generous powers of access to our personal information. So as soon as an American company collects Canadian fingerprints, those fingerprints become subject to American law.
Second, biometrics is a technique that has already been held almost always to infringe, to some degree, the right to privacy[2]. To assess whether the use of a biometric system is justified, therefore, one has to consider the objectives the business is pursuing in putting the system in place. Those objectives, however advantageous they may be for the business, must be important, and in most cases must relate to security. We set out here, for guidance, a list of questions an organization should be able to answer in order to assess whether putting a biometric system in place is justified [3]:
1. Has it been shown that the system is necessary to meet a specific need? This is the necessity test, which consists in demonstrating that the measure chosen is necessary in the light of the organization’s purposes.
2. Does the measure taken (here, the fingerprint) meet that need effectively? The organization has to show that putting the biometric recognition system in place will be effective, given the need in question and the degree of certainty the capture of the biometric characteristic provides. The system’s failure rate will be an important criterion[4].
3. Is the loss of privacy proportionate to the benefit gained? The principle of proportionality requires organizations to assess the loss to privacy and to fundamental rights in order to determine precisely which biometric technologies are appropriate and which measures are to be taken. The degree of intrusion into privacy must be proportionate to the benefit obtained by putting the system in place: the more serious the harmful effects of a measure, the more important the objective must be[5]. Furthermore, the measures chosen “must be fair and not arbitrary, carefully designed to achieve the objective in question and rationally connected to that objective”[6].
4. Is there a less intrusive means of achieving the same end? The organization should be able to show that putting a biometric system in place is the only means necessary to achieve its objective, and that no other, less intrusive system exists for reaching the goal set.
It is also worth noting that the fingerprint has already been held by the Office of the Privacy Commissioner of Canada to be more privacy-invasive than certain other characteristics, such as the voiceprint[7]. The fingerprint does not command consensus, in that it carries a fairly negative connotation, being intimately tied to the penal system. The fingerprint is also a characteristic that, like DNA, leaves traces in everyday life, which makes it easier to lift.
For more information, contact us at (450) 681-1681.
[2] OPCC, “PIPEDA Case Summary #2008-389, Investigation into the Law School Admission Council”, 29 May 2008, para. 54.
[3] The Supreme Court, in R. v. Oakes, [1986] 1 SCR 103, provided this test for determining whether an infringement of a fundamental right is justified in a free and democratic society.
[4] OPCC, “Data at Your Fingertips: Biometrics and the Challenges to Privacy”, OPCC guidance documents, p. 7, online: https://www.priv.gc.ca/information/pub/gd_bio_201102_e.asp.
[5] R. v. Oakes, [1986] 1 SCR 103.
[7] OPCC, “PIPEDA Case Summary #2008-389, Investigation into the Law School Admission Council”, cited above, note 2.