Ottawa expands program to collect fingerprints, photos from foreign nationals coming to Canada

Canada is expanding a program to collect biometric data — including fingerprints — from foreign nationals coming to this country, while experts are warning of the potential for heightened risks to privacy.

The expanded biometrics program will be rolled out over two years, beginning next month, with new requirements to collect biometric data from people from Europe, the Middle East and Africa coming to Canada to visit, work, study or immigrate. Previously, the program was limited to visa applicants from countries believed to pose a higher risk of immigration document fraud, as well as refugee claimants and asylum seekers.

Immigration Minister Ahmed Hussen has said the program's expansion from 30 to about 150 countries will strengthen border and immigration systems with the ability to quickly and accurately establish a traveller's identity.

Brenda McPhail, director of privacy, technology and surveillance at the Canadian Civil Liberties Association, said greater use of biometrics — physiological identifiers like fingerprints — is probably inevitable, given global trends. She said she sees both benefits and risks.

"Every time you expand a program like this, you add to the level of risk and complication and increase the chances that something could go wrong," she said.

Due to the highly sensitive nature of biometric information, McPhail said, data collected by Canada likely would be targeted by "malicious actors." She said the program's collection process is risky because the data is collected on foreign soil on Canada's behalf by private sector firms contracted to do the work — making it extremely important that those third-party employees are screened and their activities are tracked and audited.

Biometric data from the expanded collection program will be shared with Canada's international intelligence partners: the U.S., U.K., Australia and New Zealand. McPhail said that degree of information-sharing introduces its own risks.

"The more counties you start sharing information with, the more dependent we are (on) other people to also have good processes in place to make sure that the information they're sharing with us is accurate, that they're storing it properly and transmitting it safely," she said.

Hussen's spokesman Mathieu Genest said detailed privacy risk mitigation measures have been outlined in a series of privacy assessments that were shared with the Privacy Commissioner Daniel Therrien, and in turn informed the department's policy development.

"The government of Canada takes its privacy obligations very seriously, and safeguards have been built into policies, procedures and technical systems," Genest wrote in an email.

RCMP to retain data 

The privacy commissioner's office said the act of collecting fingerprints from visitors is justified by the need to verify admissibility to Canada, and cited the fact that data will be retained for 10 years and destroyed when a permanent resident is granted citizenship as a "positive feature." The office also said the RCMP will retain the data under strict safeguards.

The commissioner's office has received various privacy impact assessments on biometric data collection from Immigration, Refugees and Citizenship Canada in the past, and has advised the government on the need for strict protocols on information sharing and safeguards protecting the fingerprints, photos and documents collected by private sector employees at visa centres abroad.

"We are awaiting an update from IRCC and may have additional comments to make down the road," said privacy commissioner spokeswoman Valerie Lawton.

​Applicants from Europe, Middle East and Africa will be required to pay the $85 fee to capture their biometric data beginning July 31, 2018. As of Dec. 31, applicants from Asia, Asia Pacific and the Americas will be required to do the same.

Those exempt include:

• Canadian citizens, citizenship applicants (including passport applicants), or existing permanent residents;
• visa-exempt nationals coming to Canada as tourists who hold a valid Electronic Travel Authorization (ETA);
• American citizens on a work or study permit;
• children under 14 and seniors over 79;
• heads of state or government, cabinet ministers and accredited diplomats on official business;
• U.S. visa holders transiting through Canada.

Ann Cavoukian, a privacy expert at Ryerson University and the former privacy commissioner for Ontario, said that when used properly and stored securely, biometrics data can protect privacy because using it leaves authorities less dependent on documents that are vulnerable to theft.

There is a potential for privacy breaches, though, when data is used without strict protocols or is shared too broadly, she said.

Cavoukian said expanded collection should not proceed until an updated privacy impact assessment is submitted and adequate time given to make any changes recommended by the privacy commissioner.

"This is a major, major development. We rely on his independent oversight and comments and his independent assessment of this," she said.