Mounties messed up by using Clearview AI, says Canadian Privacy Commissioner
(2021/06/11)
- Reference: 1623394693
- News link: https://www.theregister.co.uk/2021/06/11/canadas_privacy_watchdog_said_police/
- Source link:
Canada’s Office of the Privacy Commissioner (OPC) announced yesterday that the Royal Canadian Mounted Police (RCMP) broke the law by using Clearview AI facial-recognition software.
An OPC [1]investigation launched in July 2020 [2]concluded in February this year that Clearview AI violated the country’s federal private sector privacy law when it created a three-billion-image databank by scraping social media accounts without user consent. Now the OPC has decided the RCMP’s use of the database to match images violated the country’s Privacy Act .
Federal Privacy Commissioner Daniel Therrien said in a [3]canned statement:
The use of facial recognition technology by the RCMP to search through massive repositories of Canadians who are innocent of any suspicion of crime presents a serious violation of privacy.
A government institution cannot collect personal information from a third-party agent if that third-party agent collected the information unlawfully.
The RCMP initially denied using the software, both publicly and to Therrien, who is also an independent officer of Parliament. However, journalists from Toronto Star and BuzzFeed found that the RCMP had purchased the software, forcing it to reconsider that denial.
The RCMP then claimed it was only using Clearview AI to rescue children who were victims of online sexual exploitation — a story the organisation is [4]still using .
[5]
The OPC said the vast majority of the RCMP’s hundreds of searches could not be explained. RCMP credits this discrepancy to a difference in how the two parties tracked searches — RCMP by investigative file and the OPC by the number of searches made in the software platform. The RCMP admits that other units used Clearview AI on a “test basis”.
[6]
[7]
The RCMP was Clearview AI's last remaining client in Canada, and ceased use of the software when it was removed from the country during an investigation.
[8]US Homeland Security sued for 'stonewalling' over use of Clearview facial recognition
[9]Los Angeles police ban facial recognition software and launch review after officers accused of unauthorized use
[10]ICE to see you: Homeland Security's immigration cops tap up Clearview AI to probe child exploitation, cyber-crime
[11]AWS won't sell facial-recog tool to police for a year – other law enforcement agencies are in the clear
Meanwhile, Clearview AI claims Canadian privacy law shouldn’t apply to US-based companies. The RCMP said it can’t be held accountable for the behind-the-scenes way its tools were engineered, as that creates an unreasonable obligation and is not explicitly required by law.
Nonetheless, the RCMP said it has “accepted all of the recommendations of the OPC and [has] already begun effort towards their implementation."
These recommendations include the RCMP undertaking privacy assessments of third-party data collection practices to determine legality, and creating a new technology privacy-focused oversight function.
[12]
The OPC will issue draft guidance for law enforcement use of facial recognition technology to aid police in compliance and respect of privacy.
The OPC would also like to see formal law in place. Therrien said:
We encourage Parliament to amend the Privacy Act to clarify that federal institutions have an obligation to ensure that third-party agents it collects personal information from have acted lawfully.
Last month, Clearview AI received [13]complaints from data rights groups in the UK, France, Austria, Greece and Italy that the software violates EU and UK General Data Protection Regulation (GDPR). In response, Clearview AI told The Register that it does not have contracts with, nor provide access to, customers in the European Union.
Clearview AI is used by some law enforcement agencies in the USA. In April, four civil and immigration rights non-profits [14]sued The US Department of Homeland Security and its law enforcement agencies, Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP) for failing to respond to a Freedom of Information Act request regarding their use of the technology. ®
Get our [15]Tech Resources
[1] https://www.theregister.com/2020/07/09/clearview_privacy_stop/
[2] https://www.theregister.com/2021/02/08/in_brief_ai/
[3] https://priv.gc.ca/en/opc-news/news-and-announcements/2021/nr-c_210610
[4] https://www.rcmp-grc.gc.ca/en/news/2021/response-the-report-the-office-the-privacy-commissioner-the-rcmps-use-clearview-ai
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YMM0QjpJpT44MRbPx8ilSgAAAEU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMM0QjpJpT44MRbPx8ilSgAAAEU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YMM0QjpJpT44MRbPx8ilSgAAAEU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2021/04/14/clearview_us_lawsuit/
[9] https://www.theregister.com/2020/11/19/lapd_facial_recogntion/
[10] https://www.theregister.com/2020/08/15/clearview_ice_contract/
[11] https://www.theregister.com/2020/06/11/aws_stops_facial_recognition_sales_to_police/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMM0QjpJpT44MRbPx8ilSgAAAEU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2021/05/27/clearview_europe/
[14] https://www.theregister.com/2021/04/14/clearview_us_lawsuit/
[15] https://whitepapers.theregister.com/
An OPC [1]investigation launched in July 2020 [2]concluded in February this year that Clearview AI violated the country’s federal private sector privacy law when it created a three-billion-image databank by scraping social media accounts without user consent. Now the OPC has decided the RCMP’s use of the database to match images violated the country’s Privacy Act .
Federal Privacy Commissioner Daniel Therrien said in a [3]canned statement:
The use of facial recognition technology by the RCMP to search through massive repositories of Canadians who are innocent of any suspicion of crime presents a serious violation of privacy.
A government institution cannot collect personal information from a third-party agent if that third-party agent collected the information unlawfully.
The RCMP initially denied using the software, both publicly and to Therrien, who is also an independent officer of Parliament. However, journalists from Toronto Star and BuzzFeed found that the RCMP had purchased the software, forcing it to reconsider that denial.
The RCMP then claimed it was only using Clearview AI to rescue children who were victims of online sexual exploitation — a story the organisation is [4]still using .
[5]
The OPC said the vast majority of the RCMP’s hundreds of searches could not be explained. RCMP credits this discrepancy to a difference in how the two parties tracked searches — RCMP by investigative file and the OPC by the number of searches made in the software platform. The RCMP admits that other units used Clearview AI on a “test basis”.
[6]
[7]
The RCMP was Clearview AI's last remaining client in Canada, and ceased use of the software when it was removed from the country during an investigation.
[8]US Homeland Security sued for 'stonewalling' over use of Clearview facial recognition
[9]Los Angeles police ban facial recognition software and launch review after officers accused of unauthorized use
[10]ICE to see you: Homeland Security's immigration cops tap up Clearview AI to probe child exploitation, cyber-crime
[11]AWS won't sell facial-recog tool to police for a year – other law enforcement agencies are in the clear
Meanwhile, Clearview AI claims Canadian privacy law shouldn’t apply to US-based companies. The RCMP said it can’t be held accountable for the behind-the-scenes way its tools were engineered, as that creates an unreasonable obligation and is not explicitly required by law.
Nonetheless, the RCMP said it has “accepted all of the recommendations of the OPC and [has] already begun effort towards their implementation."
These recommendations include the RCMP undertaking privacy assessments of third-party data collection practices to determine legality, and creating a new technology privacy-focused oversight function.
[12]
The OPC will issue draft guidance for law enforcement use of facial recognition technology to aid police in compliance and respect of privacy.
The OPC would also like to see formal law in place. Therrien said:
We encourage Parliament to amend the Privacy Act to clarify that federal institutions have an obligation to ensure that third-party agents it collects personal information from have acted lawfully.
Last month, Clearview AI received [13]complaints from data rights groups in the UK, France, Austria, Greece and Italy that the software violates EU and UK General Data Protection Regulation (GDPR). In response, Clearview AI told The Register that it does not have contracts with, nor provide access to, customers in the European Union.
Clearview AI is used by some law enforcement agencies in the USA. In April, four civil and immigration rights non-profits [14]sued The US Department of Homeland Security and its law enforcement agencies, Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP) for failing to respond to a Freedom of Information Act request regarding their use of the technology. ®
Get our [15]Tech Resources
[1] https://www.theregister.com/2020/07/09/clearview_privacy_stop/
[2] https://www.theregister.com/2021/02/08/in_brief_ai/
[3] https://priv.gc.ca/en/opc-news/news-and-announcements/2021/nr-c_210610
[4] https://www.rcmp-grc.gc.ca/en/news/2021/response-the-report-the-office-the-privacy-commissioner-the-rcmps-use-clearview-ai
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YMM0QjpJpT44MRbPx8ilSgAAAEU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMM0QjpJpT44MRbPx8ilSgAAAEU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YMM0QjpJpT44MRbPx8ilSgAAAEU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2021/04/14/clearview_us_lawsuit/
[9] https://www.theregister.com/2020/11/19/lapd_facial_recogntion/
[10] https://www.theregister.com/2020/08/15/clearview_ice_contract/
[11] https://www.theregister.com/2020/06/11/aws_stops_facial_recognition_sales_to_police/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMM0QjpJpT44MRbPx8ilSgAAAEU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2021/05/27/clearview_europe/
[14] https://www.theregister.com/2021/04/14/clearview_us_lawsuit/
[15] https://whitepapers.theregister.com/
Some hope!
Mike 137
" These recommendations include the RCMP undertaking privacy assessments of third-party data collection practices to determine legality "
In my many years' experience as a data protection consultant, I've never found an organisation that examines the T&Cs of the third party services they subcontract to in terms of their effect on data subject rights.
Under EU and UK law at least, it's a statutory requirement. Nevertheless, if any "due" diligence is performed at all (and that's rare), it stops at the contractual terms between the principal and the third party. Unfortunately, because data protection law in these jurisdictions is not policed, everyone gets away with it, and unlike in the reported case, in the UK at least a single complainant is pretty unlikely to gain the attention of the regulator.
"Clearview AI claims Canadian privacy law shouldn’t apply to US-based companies"
It does not apply to US-based companies. As far as Canada is concerned, Clearview AI is free to leech anything they want.
It applies to Canadian companies and organizations.
Idiots.