Biometric Information and Privacy Considerations: Guidance for Canadian Businesses

Biometric identification and related privacy concerns were first discussed by Aird & Berlis in the World Data Protection Report in 2009. Since then, biometric technologies and their uses have advanced exponentially, enabling not only identity verification (one-to-one comparison) and recognition (one-to-many) but also health and behavioural analysis through app interactions, among others.

Despite the passage of time and these escalating developments, a core challenge persists: efforts to update Canadian privacy legislation have been repeatedly sidelined (with few exceptions), leaving businesses and governments to grapple with laws and principles that were not drafted with biometric and other new technologies in mind. Thus, regulators are left to express their views on the interpretation of existing laws through non-binding guidance documents.

This article outlines the latest recommendations from the Office of the Privacy Commissioner of Canada (“OPC”) for private sector use of biometric technologies. Although guidance documents are not binding, they remain important for businesses as they reflect the lens through which the OPC will investigate and assess an organization’s compliance.