RCMP's use of private-sector surveillance services worries federal privacy watchdog

A federal watchdog is urging the RCMP to do a better job of assessing the privacy implications of commercial surveillance and monitoring services before using them.

In a report released Thursday, Privacy Commissioner Philippe Dufresne also recommends the Mounties be more transparent with Canadians about their collection of personal information from open-source intelligence gathering.

Dufresne investigated the RCMP's Project Wide Awake, which uses third-party services to collect personal information from sources that include social media, the darker reaches of the internet, location-based applications and fee-for-access databases.

The RCMP uses the data to probe possible crimes, locate missing persons, identify suspects, detect threats at public events and ensure awareness during an unfolding scenario, the report says.

Dufresne expressed particular concerns about the RCMP's contract with U.S. company Babel Street for its Babel X service.

The report says the Mounties did not properly verify that the personal information given to the RCMP by Babel X and its data providers was collected in compliance with Canadian privacy laws.

"Policing is important and complex work that requires effective tools designed for today's digital environment," the report says.

"Rigorous vetting of privacy impactful third-party services is essential to ensuring that the fundamental right to privacy is respected."

The report says the RCMP "was unwilling to commit" to implementing the commissioner's recommendations.

Those recommendations included a call for the RCMP to stop collecting personal information via Babel X from sources that require logins or authentication for access until it has completed a thorough review of each one for compliance with the law.

"Therefore, this matter is unresolved, and continuing contraventions and violations of Canadians' privacy rights may be occurring," the report says.

Dufresne's office maintains that thorough vetting of services and more transparency "will support public trust in our national police force and will allow the RCMP to fulfil its important public interest mandate in a privacy protective way."

It's not the first time the RCMP's use of new technology has run afoul of federal privacy law.

In June 2021, Dufresne's predecessor, Daniel Therrien, found the RCMP broke the law by using cutting-edge facial-recognition software to collect personal information.

Therrien said there were serious and systemic failings by the RCMP to ensure compliance with the Privacy Act before it gathered information from U.S. firm Clearview AI.

Clearview AI's technology allows for the collection of huge numbers of images from various sources that can help police forces, financial institutions and other clients identify people.

Amid concern over Clearview AI, the RCMP created an internal program intended to evaluate compliance of collection techniques with privacy legislation.

But the program's review of Babel X did not include comprehensive assessments of all the services included in the RCMP's contract with Babel Street, "despite indicators and red flags in its own materials of potential non-compliance," the privacy commissioner's report says.

The commissioner was "therefore unable to conclude that the RCMP's ongoing collection of personal information from the wide range of data sources available via Babel X is compliant" with the Privacy Act.

The RCMP had no immediate comment on the commissioner's report.