TC Transcontinental used facial recognition illegally in one of its printing plants, the Access to Information Commission has ruled. This is a rare decision on the use of biometrics, the first since legislative strengthening in 2022.
Published at 5:00 a.m.
“This is a wake-up call for businesses,” notes Antoine Guilmain, co-director of the national Cybersecurity and Data Protection practice group at Gowling WLG. “It’s only the 10e decision and the 5e Commission order on biometrics since 2000.”
In 2020, in the context of the COVID-19 pandemic, Imprimeries Transcontinental established, in its Beauceville factory, in Chaudière-Appalaches, an authentication system with two functionalities, one facial recognition and the other temperature measurement. All this to “limit the risks of spreading the virus”.
After the health crisis, only the facial recognition tool was used to control comings and goings. In a decision rendered in December, although it went unnoticed, the Commission for Access to Information (CAI) judged that the company “has not demonstrated the necessity” of collecting this personal information to achieve its health and safety objective. .
According to the Act respecting the protection of personal information in the private sector (or Privacy Act), public bodies and private companies that collect “sensitive personal information” must ensure that this collection is “necessary”.
Me Guilmain emphasizes that the employer had obtained the employees’ consent to collect their biometric data.
This is another reminder from the Commission: obtaining consent does not change the necessity criterion.
Me Antoine Guilmain, co-director of the national Cybersecurity and data protection practice group at Gowling WLG
Since September 2022, any creation of a bank of biometric characteristics or measurements in Quebec must “be disclosed no later than 60 days before it is put into service”. This new deadline has been the subject of a modification to the Law concerning the legal framework for information technologies.
TC Transcontinental says it turned its back on facial recognition in August 2024, a few weeks before the decision requiring the destruction of the data collected. From now on, “none of our 15 Canadian factories use this form of identification,” assures François Taschereau, vice-president of corporate communications and public affairs.
Terrorist threats?
In addition to health reasons, TC Transcontinental expressed its desire to respect the requirements of the “Customs-Trade Partnership Against Terrorism” (CTPAT) certification, which governs the security of private sector supply chains with regard to terrorist threats. .
The Commission responds that the use of facial recognition is one means among others to adhere to certification, and not an obligation. “The CTPAT standard provides for other less intrusive means in terms of privacy that would achieve the objective of controlling access to company premises,” we can read in the decision.
Why not opt for simple “identification cards”? These “include[nt] risks of sharing or copying cards, in addition to leading to more internal management in cases of loss and exchange of these cards,” argued Imprimeries Transcontinental in a response to the Commission for Access to Information .
These disadvantages are a common problem in running a business, according to the Commission. As for the risks invoked, they do not constitute “a real situation and sufficient justification”, she maintains.
The decision of the supervisory committee is consistent with the positions of principle of the CAI, according to lawyer Antoine Guilmain, who carefully follows biometrics files. “We have a scenario where we want to use biometrics in a printing context, for all employees and in all premises. It’s quite special,” he says.
Strong growth
Biometric information “has an immutable nature which makes it particularly sensitive information in the event of a confidentiality incident and the malicious use of this information can have serious consequences for the people concerned”, recalls the CAI in its decision against Imprimeries Transcontinental .
This comes at a time when the use of biometric measurement banks is growing strongly in Quebec. During the 2023-2024 financial year, 124 entities declared the collection of such sensitive data, up 60% compared to the previous year (78), show Commission data revealed by The Press last October.
Since 2022, the government body has been concerned about a “certain trivialization” of the implications of biometrics in terms of the protection of personal information.
The CAI’s last decision on the matter dates back to 2022, when the Auberge du lac Sacacomie was forced to stop collecting the shape of its employees’ faces, in addition to having to destroy the data it had collected.
