Facial recognition technology (FRT) is increasingly used across the globe and in Canada, offering benefits in security, law enforcement, and convenience. Yet these gains come with serious legal and ethical questions—especially when it comes to privacy, human rights, and government accountability.
Current Legal Framework
Federal Laws
Privacy Act (1983): This Act governs how federal government institutions collect, use, and disclose personal information. It grants individuals the right to access and correct personal information held by federal bodies. However, the Act does not apply to private businesses or provincial/municipal governments (Privacy Act – Justice Canada).
Personal Information Protection and Electronic Documents Act (PIPEDA): PIPEDA applies to private-sector organizations engaged in commercial activities across most of Canada. It establishes rules for the collection, use, and disclosure of personal information, including biometric data, and requires meaningful consent from individuals (PIPEDA Summary – OPC).
Provincial Laws
Some provinces have their own privacy legislation that supersedes PIPEDA in the private sector. British Columbia, Alberta, and Quebec are notable examples. In particular, Quebec’s Law 25 (formerly Bill 64) includes strict rules around the use of biometric information, including mandatory privacy impact assessments and opt-in consent for facial recognition use.
Proposed Legislation: Bill C-27
Introduced in 2022, Bill C-27—The Digital Charter Implementation Act—sought to overhaul Canada’s privacy framework. It included three key components:
1. Consumer Privacy Protection Act (CPPA): Intended to replace parts of PIPEDA and give individuals greater control over their data.
2. Personal Information and Data Protection Tribunal Act: Proposed the creation of a tribunal to enforce data protection laws and issue penalties.
3. Artificial Intelligence and Data Act (AIDA): Proposed oversight for high-impact AI systems, including facial recognition, requiring transparency and risk management practices.
Although Bill C-27 had the potential to fill legal gaps in regulating FRT, it was not passed before the prorogation of Parliament in early 2025, leaving these proposals in limbo.
Clearview AI and the RCMP
In 2020, it was revealed that the RCMP had used facial recognition software provided by Clearview AI, a U.S.-based company that scraped billions of publicly available images from the internet. This sparked major controversy. The Office of the Privacy Commissioner of Canada concluded that Clearview’s practices constituted mass surveillance and violated Canadian privacy laws. Following the investigation, Clearview ceased its operations in Canada, and the RCMP suspended use of the tool.
Despite the findings, the RCMP has since disclosed its use of other facial recognition tools, including Traffic Jam and Spotlight, in specialized investigations such as child exploitation and human trafficking.
Some Questions About Facial Recognition in Canada
1. Is facial recognition technology legal in Canada? There is no single federal law regulating FRT. Its use is governed under general privacy legislation like the Privacy Act and PIPEDA. Legality depends on the context, proper authority, and whether informed consent is obtained.
2. Can businesses use facial recognition on customers? Yes, but they must comply with privacy laws requiring notice and meaningful consent. Unauthorized or undisclosed use can breach PIPEDA or provincial laws and result in complaints or legal consequences.
3. What are the privacy concerns associated with FRT? Concerns include mass surveillance, data misuse, lack of transparency, and disproportionate errors affecting marginalized communities. Accuracy varies across demographic groups, raising potential for discriminatory impacts.
4. What steps are being taken to regulate FRT in Canada? Privacy commissioners and civil society groups have called for robust oversight and legislation. Bill C-27 was a promising start but failed to pass, leaving FRT largely unregulated under outdated laws.
Final Thoughts
As facial recognition becomes more common across sectors, Canadians should stay informed about how their biometric data is being used and protected. Until Canada enacts modern legislation to regulate facial recognition, protecting your privacy will depend on staying aware of your rights, asking questions about consent and data use, and making thoughtful decisions about your digital footprint.
If you need a strong criminal defence team, Collett Read is here for you 24/7. Give us a call at (905) 541-2228 or fill out a free consultation form to get connected today.
