Unregulated Biometric Surveillance Technology Deployment in Canada
Three confirmed incidents of biometric surveillance deployment without governance — plus one active hazard (SPVM) — demonstrate that Canada's institutional pathways for deploying surveillance technology have no capacity to evaluate or constrain biometric systems before they are operational.
Description
Canada has no federal legislation specifically governing biometric surveillance technology. This governance gap has been repeatedly demonstrated: the RCMP deployed Clearview AI’s facial recognition without a privacy impact assessment, Cadillac Fairview captured over 5 million facial images covertly in Canadian shopping malls, Canadian Tire deployed facial recognition across 12 British Columbia stores without customer notification, and the SPVM acquired an AI surveillance platform with undisclosed biometric capabilities including facial recognition, ethnicity detection, and emotion analysis.
In each case, the Office of the Privacy Commissioner investigated after the fact and issued findings. In no case was the deployment prevented, evaluated, or authorized before it occurred. The OPC lacks order-making power — it can recommend but not compel compliance. The Privacy Act and PIPEDA provide some framework but were not designed for mass biometric collection.
The structural pattern is consistent across law enforcement and commercial sectors: biometric surveillance capability is acquired through standard procurement and vendor relationships that have no mechanism to evaluate or constrain the technology before deployment. This pattern is escalating because surveillance technology capability is increasing (the SPVM’s platform includes built-in ethnicity detection and emotion analysis) while the governance framework remains unchanged.
Risk Pathway
Law enforcement agencies and commercial operators deploy biometric surveillance technology — facial recognition, biometric tracking, ethnicity detection — without a legislative framework governing its use, without mandatory pre-deployment privacy impact assessments, and in several cases without public disclosure. Canada has no federal legislation specifically addressing biometric surveillance. The Privacy Act and PIPEDA provide some constraints but were not designed for mass biometric collection. The result is that surveillance capability acquisition consistently outpaces governance across sectors, creating a growing inventory of deployed biometric systems with no independent oversight of how they are used or expanded.
Assessment History
Three confirmed incidents spanning law enforcement (RCMP/Clearview AI) and commercial (Cadillac Fairview, Canadian Tire) biometric surveillance, plus one active hazard (SPVM). The OPC has investigated all three incidents and issued findings, but lacks order-making power. No federal legislation governing biometric surveillance has been introduced. The SPVM case demonstrates ongoing acquisition: a platform with undisclosed biometric capabilities activatable through configuration. The pattern is escalating because surveillance technology capability is increasing while governance remains static.
Initial assessment. Status set to escalating based on continued deployments despite regulatory findings.
Triggers
- Declining cost and increasing capability of biometric surveillance technology
- Availability of surveillance platforms with configurable biometric features
- Police procurement processes that do not require AI-specific assessment
- Absence of federal biometric surveillance legislation
Mitigating Factors
- OPC investigations creating public record and some deterrent effect
- Civil society scrutiny from organizations like Pivot and CCLA
- Municipal discussions about facial recognition moratoriums
- Growing public awareness of biometric surveillance risks
Risk Controls
- Federal or provincial legislation specifically governing biometric surveillance technology deployment
- Mandatory privacy impact assessment before any biometric data collection, with public disclosure of results
- Independent oversight body for law enforcement use of AI and biometric surveillance
- Consent requirements and disclosure obligations for commercial biometric collection
- Prohibition on covert biometric data collection in commercial settings
- Municipal or provincial moratorium on facial recognition by police pending legislative framework
Materialized Incidents
- Canada Investigates X and xAI After Grok Generates Millions of Non-Consensual Sexualized Deepfakes
- Facial Detection Cameras in Digital Ads Near Toronto's Union Station Scanned Commuters Without Consent for Three Years
Affected Populations
- Canadian residents subject to mass biometric surveillance
- Racialized communities disproportionately affected by facial recognition error rates
- Mall shoppers and retail customers whose biometric data was collected without consent
- Participants in public protests and demonstrations
Entities Involved
Investigated Clearview AI, Cadillac Fairview, and Canadian Tire biometric deployments; issued findings but lacks order-making power to enforce compliance
Deployed Clearview AI without privacy impact assessment
Developed facial recognition platform based on mass-scraped biometric data
Deployed covert facial recognition in Canadian shopping malls
Deployed facial recognition in British Columbia stores without customer notification
AI Systems Involved
Facial recognition system matching against database of billions of scraped images; deployed by RCMP without privacy assessment
Responses
Issued joint investigation report finding RCMP use of Clearview AI contravened Privacy Act
Issued investigation report finding Cadillac Fairview's use of facial recognition violated PIPEDA
Related Records
- spvm-ai-video-surveillance related
Taxonomy
Sources
- RCMP's use of Clearview AI facial recognition technology
- Investigation into Cadillac Fairview's use of facial recognition technology
- Investigation into Canadian Tire's use of facial recognition
Changelog
| Version | Date | Change |
|---|---|---|
| v1 | Mar 8, 2026 | Initial publication |