Canadian regulators on collecting faces without consent
On 2 February 2021 the Privacy Commissioner of Canada, together with the commissions of Quebec, British Columbia and Alberta, published the findings of a joint investigation into Clearview AI. The regulators found that scraping over three billion images from the web without consent does not fall under the publicly available exception and has no appropriate purpose, and described it as continual mass surveillance of everyone whose face ended up in the database.
Why it matters
This is the first decision by a public authority in the atlas about where data for training and search came from rather than about how a system performs. One sentence carries it: information collected from public pages and then used for an unrelated purpose does not fall under the publicly available exception. That sentence is what separates lying in the open from being there for the taking.
What was found. Biometric information is sensitive in almost all circumstances and facial recognition data particularly so; people who posted their own images, or whose images others posted, had no reasonable expectation that Clearview would collect and use them for identification, so express consent would generally be required. In Quebec express consent is required by the law on biometric data. What was collected includes the mass indiscriminate collection of information about minors. On Canada: Clearview created 48 accounts, trial or otherwise, for law enforcement agencies and organisations in the country, through which thousands of searches were run; one became a paying customer, the Royal Canadian Mounted Police. In March 2020 the company suspended access for all users in Canada except that one, and in July 2020 it voluntarily left the Canadian market. The record does not claim that the regulators prohibited or ordered anything. The document carries recommendations: cease offering the tool to clients in Canada, cease collecting and using images and biometric facial arrays from individuals in Canada, and delete those held. Clearview expressly disagreed with the findings and made no commitment to follow the recommendations; the matter was found well-founded. Separately, the Offices did not carry out a technical assessment of the system's accuracy. And one detail from the document: Clearview's crawler is configured to respect the instructions in robots.txt.