Biometric information (privacy)

The Privacy Commissioner describes biometrics as the quantification of human characteristics into measurable terms, whether physiological, such as fingerprints or facial geometry, or behavioural, such as movements, gestures or motor skills. A buyer of a gym, clinic or software firm meets it when the business uses scans for entry, check-in or login. Ask what is collected and why. See what cybersecurity and privacy checks to do before buying.

Federal guidance

The Office of the Privacy Commissioner of Canada says biometric information that can uniquely identify an individual is sensitive, regardless of context. It adds that, as a general rule, express consent would be the appropriate form of consent where sensitive information is involved. It also says biometric information is, in general, personal information. See PIPEDA.

Quebec

Quebec’s Act to establish a legal framework for information technology, s. 44, says a person’s identity may not be verified or confirmed by a process that allows biometric characteristics or measurements to be used except where that verification has been disclosed beforehand to the Commission d’accès à l’information and with the person’s express consent. Section 45 requires the creation of a database of biometric characteristics and measurements to be disclosed to the Commission promptly and not later than 60 days before it is brought into service. This entry covers the federal guidance and Quebec only; check the rules where you are.