Biometrics under Quebec law: consent, alternative and Commission filing

The law prohibits requiring that a person's identity be verified or confirmed by a process that captures biometric characteristics or measurements. Consent is express, free, informed, given for a specific purpose and limited in time. If the person refuses, or withdraws consent, another way to confirm identity is available. Capture without the person's knowledge is out.

What has to be filed

Use of a biometric system to identify a person is filed with the Commission d'accès à l'information. Creation of a bank of biometric characteristics or measurements is filed at least 60 days before it is brought into service. The form is the Commission's. The filing is not an authorization: the Commission can look at whether the measure is necessary and proportionate.

What the information is used for

• It is used for the purpose that justified the system. Another purpose needs new express consent, or an exception set out in the law.
• Information discovered from the biometrics, for example a health indication, is not used to make a decision about the person.
• Biometrics are sensitive. Express consent is still required even if a general policy already talks about building security.
• The incident register also receives a loss or an exposure of this data. The notice threshold is judged with the sensitivity of the file.

An employee access control based on facial recognition has already been ordered stopped when the measure was neither necessary nor proportionate. Document why a badge or a code is not enough before you start the project.

The filing form and the consent model are published by the Commission. Start from those texts, then describe your actual process.