Québec privacy commissioner continues to set high bar for biometric data processing: lessons for businesses

At the end of last year, the oversight division of the Québec privacy commissioner, the Commission d’accès à l’information (the CAI), published its first decision since sweeping changes under Law 25 came into force. The decision (dated September 2024) resulted from a self-initiated investigation by the CAI into the biometric practices of a printing company that had made the CAI aware of its practices as required under Québec law. The CAI ordered the company to cease using facial recognition technology to control employee access to its premises and determined that the collection of facial biometric data was not sufficiently necessary or proportionate under the circumstances to justify the significant intrusion into employees’ privacy that the practice allegedly constituted.

While consistent with the CAI’s past orders and guidance, the decision highlights the high legal threshold for using facial recognition and other biometric identification technologies in Québec under the Act respecting the protection of personal information in the private sector (the Québec Privacy Act) and related provisions of the Act to establish a legal framework for information technology (the Québec IT Act).

The decision also reflects a trend in Québec over recent years where the CAI — empowered by the province’s unique biometric filing requirements — has taken enforcement action against companies that use these technologies and expressed skepticism about the necessity and proportionality of such tools. This trend is evident not only in the CAI’s recent decision, but also in recent regulatory guidance, as well as the CAI’s interactions with organizations that declare biometric systems.

The CAI’s position on the use of biometrics is particularly noteworthy for organizations, considering the significant financial penalties for non-compliance with Québec privacy laws. Under the Québec Privacy Act, administrative monetary penalties can reach up to $10 million or 2% of worldwide turnover, whichever is greater.

My Osler colleagues have prepared an article in which they set out the key legal requirements for biometric identity verification systems in Québec, the CAI’s application of these requirements to the facts in this decision, and key takeaways for businesses.

You can read the article available on Osler’s website.

This content has been updated on January 27, 2025 at 13 h 13 min.