Fingerprints, facial recognition, voice prints, and other biometric information receive heightened privacy protection under Canadian law.
TL;DR
Biometric information is treated as sensitive. Organizations must have a clear purpose, obtain express consent in most cases, and assess whether a less intrusive alternative exists. Commissioners in several provinces have investigated biometric time-clocks and facial-recognition systems.
Canadian commissioners jointly investigated Clearview AI and found its database of scraped photos violated Canadian privacy law. Clearview subsequently withdrew from the Canadian market.
Public-sector use of facial recognition in law enforcement is under active debate. Some police services have imposed moratoriums.
Quebec's Law 25 biometric registration
Quebec requires organizations to declare any biometric system to the CAI 60 days before it goes live. This is one of the strongest biometric rules in North America.
Alternatives test
Commissioners have consistently asked whether a less intrusive alternative would meet the same purpose. If a card, PIN, or password would work, biometrics are usually not reasonable.