Act to establish a legal framework for information technology, biometric verification of identity and biometric databases
In force since .
A biometric privacy rule binding public and private bodies.
- Obligation class
- Biometric, Consent, Reporting, Retention
- Audit expectation
- none
What it requires
- Before you verify or confirm a person’s identity by a process that allows biometric characteristics or measurements to then be used, disclose the verification to the Commission d’accès à l’information and obtain the person’s express consent (s. 44).
- Use only the minimum number of characteristics or measurements needed to link the person to an act, and only characteristics or measurements that cannot be used without the person’s knowledge (s. 44).
- Do not use any other information the recorded characteristics or measurements reveal as a basis for a decision about the person or for any other purpose, and disclose it only to the person concerned, at the person’s request (s. 44).
- Destroy the record of the characteristics or measurements, and any notation relating to it, as soon as the purpose of the verification or confirmation has been met or the reason for it no longer exists (s. 44).
- Disclose the creation of a database of biometric characteristics and measurements to the Commission d’accès à l’information promptly and not later than 60 days before it is brought into service, and follow the Commission’s orders on how the database is set up, used, consulted, released and retained (s. 45).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 44 requires the person verifying identity to disclose the verification to the Commission d’accès à l’information beforehand, to obtain express consent and to destroy the record of the characteristics or measurements once the purpose is met, and section 45 requires the creation of a biometric database to be disclosed to the Commission at least 60 days before it is brought into service. Neither section names a log or register of uses, sets an audit, or says who may demand a record, so no logging duty is found.
- Kind
- None
- As of
What this law does
A person’s identity may not be verified or confirmed by means of a process that allows biometric characteristics or measurements to then be used, except where such verification or confirmation has been previously disclosed to the Commission d’accès à l’information and except with the express consent of the person concerned.
Only the minimum number of characteristics or measurements needed to link the person to an act, and only characteristics or measurements that may not then be used without the person’s knowledge, may be used for identification purposes.
No other information revealed by the characteristics or measurements recorded may be used as a basis for a decision concerning the person or for any other purpose whatsoever, and such information may only be disclosed to the person concerned, at the person’s request.
The record of the characteristics or measurements and any notation relating thereto must be destroyed as soon as the purpose of verification or confirmation of identity has been met or the reason for the verification or confirmation no longer exists. The creation of a database of biometric characteristics and measurements must be disclosed to the Commission d’accès à l’information promptly and not later than 60 days before it is brought into service.
The Commission may make orders determining how such databases are to be set up, used, consulted, released and retained, and it may suspend or prohibit the bringing into service of a database, or order its destruction, if the database is not in compliance with its orders or otherwise constitutes an invasion of privacy.
Section 80 of the Act to modernize legislative provisions as regards the protection of personal information amends section 44 of the Act to establish a legal framework for information technology. The amendments of sections 44 and 45 by sections 80 and 81 of the modernizing Act came into force on .
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .