RCMP Use of Clearview AI Facial Recognition Without Privacy Assessment

The RCMP used Clearview AI's facial recognition technology beginning in approximately October 2019 (Office of the Privacy Commissioner of Canada, 2021). Clearview AI's system works by scraping billions of images from the open internet — including social media platforms — without consent, then building a searchable biometric database that allows law enforcement to upload a photo and find matches (New York Times, 2020; Office of the Privacy Commissioner of Canada, 2021).

The OPC's investigation found that the RCMP used Clearview AI without conducting a Privacy Impact Assessment, without establishing that it had legal authority to collect personal information through the tool, and without adequate internal governance over the technology's adoption (Office of the Privacy Commissioner of Canada, 2021). Individual RCMP members began using the tool after Clearview AI provided trial access. The RCMP did not conduct a formal assessment of the tool's privacy implications before operational use (Office of the Privacy Commissioner of Canada, 2021).

The OPC's joint investigation into Clearview AI (with provincial counterparts in Quebec, Alberta, and British Columbia) found that Clearview AI's scraping of images constituted collection of biometric information without meaningful consent, violating PIPEDA (Office of the Privacy Commissioner of Canada, 2021). The investigation into the RCMP specifically found that the RCMP's use of Clearview AI contravened the Privacy Act, as the force collected personal information through a third party that had itself collected it unlawfully (Office of the Privacy Commissioner of Canada, 2021).

Clearview AI voluntarily ceased offering its services in Canada on July 3, 2020, during the ongoing investigation. Following the investigation, the RCMP agreed to implement the OPC's recommendations, including implementing a governance framework for new technology adoption — though the RCMP disagreed with the OPC's finding that it had contravened the Privacy Act, arguing the law does not expressly impose a duty to confirm the legal basis for third-party collection (Office of the Privacy Commissioner of Canada, 2021).