Québec Privacy Commissioner Continues To Set High Bar For Biometric Data Processing: Lessons For Businesses

At the end of last year, the oversight division of the Québec privacy commissioner, the Commission d'accès à l'information (the CAI), published its first decision since sweeping changes under Law 25 came into force. The decision (dated September 2024) resulted from a self-initiated investigation by the CAI into the biometric practices of a printing company that had made the CAI aware of its practices as required under Québec law. The CAI ordered the company to cease using facial recognition technology to control employee access to its premises and determined that the collection of facial biometric data was not sufficiently necessary or proportionate under the circumstances to justify the significant intrusion into employees' privacy that the practice allegedly constituted.