Canada’s OPC Launches Public Consultation on Draft Guidance for Biometric Technologies

On October 11, 2023, the Office of the Privacy Commissioner of Canada (OPC) launched a call for public comments  about new draft guidance on biometric technologies. 

The public consultation launched by the OPC aims “to help ensure that the final guidance [...] will be as clear, complete, and useful as possible” and it is hoped that feedback will be provided by “a broad range of stakeholders in the privacy and biometrics communities and beyond, including members of the public,” according to the official website of the Canadian DPA. 

The draft guidance is divided into two documents, one for organizations and one for public institutions, and provides information on best practices for biometric information handling, considerations, and privacy obligations. Each of the two documents is split into eight parts as follows: 

• Identifying an Appropriate Purpose (for organizations) / Assess the Appropriateness of an Initiative (for public institutions): a biometric initiative required that you first specify the purpose and then determine whether the purpose is appropriate, bearing in mind the aspects of sensitivity, necessity, effectiveness, proportionality, and minimal intrusiveness.
• Consent: you must obtain “express, informed, and specific consent” from individuals.
• Limiting Collection: limit the collection of biometric information to that which is necessary for your purposes.
• Limiting Use, Disclosure, and Retention: Under PIPEDA, biometrics can only be used for those purposes for which you collected or obtained the information, with some exceptions. Also, there are limited purposes for which personal information can be disclosed without consent.
• Safeguards: biometrics can help your organization keep personal information secure against unauthorized access but if the biometric information itself is not protected by appropriate safeguards it can contribute to the issue of security instead. 
• Accuracy: Principle 6 of the PIPEDA mandates that “personal information shall be as accurate, complete, and up to date as is necessary for the purposes for which it is to be used.” Inaccurate biometric information can result in false positives or false negatives that can significantly affect an individual’s life and even violate their human rights. 
• Accountability: you are responsible for the personal information that is under your control. 
• Openness: you have an obligation to be transparent about the way you handle the personal information of individuals. 

The consultation period opened on October 11, 2023, and will close on January 12, 2024, and those interested in participating in the consultation can submit their feedback form directly on the website of the OPC.

To read more about Canada's data privacy landscape, consult our regulations page for overviews on the data privacy regulations in force, such as the PIPEDA.