On August 11, 2025, the Office of the Privacy Commissioner of Canada (OPC) released new guidance on the collection, use, and disclosure of biometric information for organizations governed by the Personal Information Protection and Electronic Documents Act (PIPEDA). The framework responds to growing adoption of technologies such as facial recognition, fingerprint scanning, and voice authentication across Canadian industries.
The OPC classifies biometric data—including raw samples and biometric templates—as highly sensitive. In most cases, organizations must obtain express, informed consent before collecting or processing such data. Where biometrics are not essential to delivering a service, organizations are expected to provide alternative methods of authentication or identification.
The guidance strongly encourages organizations to complete a Biometric Privacy Impact Assessment (B-PIA) before implementing any biometric system. These assessments should evaluate whether the technology is necessary, explore less intrusive options, identify privacy risks, and document mitigation strategies. The OPC also recommends ongoing reviews as technology or operational needs evolve.
Key Requirements for Biometric Data Handling
Under the framework, organizations must follow several core principles when deploying biometric systems:
- Purpose limitation and minimization: Collect only the biometric data strictly necessary for specific, documented purposes.
- Transparency: Provide privacy policies and notices in clear, accessible language before enrollment, outlining how biometric data will be collected, used, stored, and deleted.
- Security measures: Use encryption, access controls, and other safeguards to protect biometric data from unauthorized access or misuse.
- Retention limits: Delete biometric data once it is no longer required for its stated purpose.
- Accountability: Establish governance processes, train staff, and monitor third-party service providers handling biometric information.
The OPC draws a distinction between systems that process raw biometric samples and those that generate biometric templates. Templates, often used for identification or verification, can pose greater privacy risks due to their potential for re-identification and misuse. Organizations sharing biometric data with third parties must ensure they have appropriate authorization and safeguards in place.
Jurisdiction and Related Regulations
The OPC’s guidance applies to private-sector organizations under federal jurisdiction. However, Alberta, British Columbia, and Québec have their own privacy legislation for the private sector, with Québec in particular imposing more prescriptive requirements for biometric data handling.
The release of the guidance follows increased biometric adoption in both public and private sectors. For example, the Canada Border Services Agency recently expanded its use of facial recognition and mobile applications for border screening, illustrating the growing role of biometric systems in operational processes.
Organizations subject to PIPEDA are advised to review the OPC’s recommendations in detail, update internal privacy management programs, and ensure that any biometric deployment aligns with the principles of necessity, proportionality, and transparency outlined in the guidance.
Sources: JDSupra, IdentityWeek
–
By Ali Nassar-Smith
