The Canadian Civil Liberties Association is calling on the governing Liberals to “cease and desist” using facial recognition technology to verify the identity of people voting in candidate nominations.
In a letter obtained by The Globe and Mail on Wednesday, the association urges the Liberal Party of Canada, or LPC, to stop using the controversial technology, saying it “takes unfair advantage of its exemption from Canadian privacy laws.”
Further, it “sends the wrong message to municipal, provincial and federal election officials that this technology is ready for prime time,” reads the letter signed by executive director Michael Bryant and privacy, technology and surveillance program director Brenda McPhail.
“By using it for the purposes of nominating candidates for federal election, LPC is tacitly endorsing an unreliable, racist technology.” Research has shown the technology has a higher error rate for people of colour.
The association compares facial recognition to taking someone’s fingerprint because it uses the physical characteristics of a face to create a mathematical model that is unique to each individual. “Its so private, its so unique, it works because it creates a code that identifies you, just like a fingerprint is a code that identifies you,” Mr. Bryant said in an interview.
The letter from the civil liberties association acknowledges that the type of technology that the party is likely using is “less invasive” than others because it compares one photo to a picture of an ID, rather than scraping a database to find a matching face.
The Liberal Party’s website does not mention using facial recognition technology in its privacy statement or in its explanation to nomination-race participants about how their identities in the virtual candidate elections are verified.
“In order to verify your identity, you will be asked to take a photo of the front and back of the driver’s licence as well as a selfie so we can match you against your ID,” the party’s website says.
However, when going through the identification process, the bottom of the website says, “powered by Jumio.” The California-based company’s name stands for “Just use my ID online.”
“As soon as a nomination voter is verified, associated information is deleted immediately and automatically, and not retained,” Liberal Party spokesperson Braeden Caley said in an e-mailed statement. Mr. Caley later clarified that applies to use of information by both the Liberal Party and Jumio. The company did not respond to requests for comment.
Jumio’s privacy policy posted on its website says the company is a “data processor” and not a “data controller.” It says the company “collects, uses, and discloses individual users’ information only as directed by these third parties.”
However, it goes on to say “Notwithstanding the above, Jumio may process certain individual users’ information in anonymized and/or aggregated form for its own purposes.”
Mr. Bryant said there is a lack of transparency and clarity on exactly how the information is used. “This is the problem,” he said. “There are so many unanswered questions and unknowns because this is an entirely unregulated technology.”
Representatives from the Conservatives, NDP, Bloc Québécois and Green Party all said they do not use facial recognition technology for any element of their party’s work. Federal political parties are not covered by federal privacy legislation, meaning there are no limits on their collection and use of sensitive personal information. When the parties are operating in B.C., though, they are subject to the province’s privacy laws.
The use of the facial recognition technology is another reminder of the “egregious gap” in the federal laws, B.C. Information and Privacy Commissioner Michael McEvoy said in an interview on Wednesday.
“The operations of a political party should be subject to privacy laws, just like every other organization is in this country,” he said. “There is nothing that is exceptional, unique or special about political parties that should extricate themselves from what every other organization has to abide by.”
Mr. McEvoy said without oversight it is impossible to verify the comments from the Liberals and the information on Jumio’s website because there is no complaints process or investigation option. He added that with so many datasets available for cross referencing, it is sometimes possible to re-identify data that has been anonymized.
Whether the Liberal Party’s use of the facial recognition technology is in-keeping with B.C. law is an “open question,” he said. He added that the provincial law requires consent with all data collection and that the collection and use of the data has to be reasonable.
The need for oversight is all the more important when dealing with biometric data, which unlike a credit card or password, cannot be replaced if it is hacked or stolen, Mr. McEvoy said.
“It goes right to who you are and those are things that can’t be changed,” he said.
Voters can choose between the automated verification process – which Mr. Caley said is similar to processes in the financial and hospitality sectors – or a manual ID verification process with a live official over video.
“The Liberal Party undertakes a robust privacy review before engaging with new virtual tools, and like all of our engagement with Canadians, this process has moved forward in full accordance with the party’s strict privacy policy and the Canada Elections Act,” Mr. Caley said.
He said that the party consulted the federal privacy commissioner’s public guidance on the use of the technology.
“The Liberal nominations process is moving forward in a manner that ensures people can safely vote from their homes out of respect for public-health precautions, while maintaining the integrity of our elections and protecting privacy,” he said.
A 2019 internal report from federal Privacy Commissioner Daniel Therrien, found the privacy policies of all the major federal political parties failed to ensure people gave valid consent to the collection and use of their personal information. The report was obtained by The Canadian Press.
Mr. Therrien has raised concerns about using facial-recognition technology because of its “potential to be extremely privacy invasive.”
“It can enable widespread surveillance, provide biased results and erode other human rights,” Mr. Therrien told the House of Commons ethics committee in May.
“If used responsibly and in the right circumstances, it can offer significant benefits to society,” he said. “At the same time, it involves sensitive personal information that is unique to the individual and is permanent.”
Know what is happening in the halls of power with the day’s top political headlines and commentary as selected by Globe editors (subscribers only). Sign up today.
Marieke Walsh