The Digital Governance Standards Institute (DGSI) has opened a public review for CAN/DGSI 120, a Canadian standard focused on the use of biometrics for authentication.
The standard is being presented as a baseline for remote identity verification using biometrics. According to the Digital Governance Council, CAN/DGSI 120 describes attack types that can subvert biometric verification and outlines methods intended to detect or invalidate those attacks so that biometric verification can be authenticated remotely.
In practical terms, standards that focus on “authentication” tend to be used in scenarios where an individual is already enrolled and needs to prove they are the rightful account holder – rather than establishing identity for the first time. For public-sector services and regulated industries, that distinction matters because authentication requirements are often written into access control, fraud prevention, and audit programs.
For vendors and relying parties, national standards can quickly become procurement language, especially in public-sector implementations. A defined set of requirements and threat considerations can influence how organizations specify biometric authentication controls, what testing or assurance evidence is expected, and how deployments are assessed over time.
DGSI’s standards work sits alongside broader efforts to formalize governance and trust frameworks in Canada, including work that formalizes the CAN/DGSI 103-0 digital trust standard. Implementers also have to navigate privacy expectations for biometric authentication, including privacy watchdog guidance on biometrics as an authentication method that can affect consent, retention, and proportionality decisions.
At the provincial level, policy work has continued to develop in parallel with standards and technical guidance. A recent example is Quebec’s consultation on biometrics and digital identity, which highlights how governance requirements can vary even within a national context. Canada’s broader credential ecosystem is also evolving through initiatives like a government-linked digital credential platform, creating additional demand for consistent authentication and trust assumptions across services.
Public review periods are typically where implementers, privacy experts and vendors can flag gaps, whether that involves how threat models are defined, what controls are practical for different deployment environments, or how security expectations map to existing compliance obligations. Comments on CAN/DGSI 120 are due by March 9, 2026.
Sources: Digital Governance Council
–
By the ID Tech Editorial Team
