Québec Sets a High Bar for Biometrics: What Businesses Need to Know
)
On January 22, 2025, the Commission d’accès à l’information (CAI), Québec’s privacy commissioner, issued its first major decision since Law 25 came into force, targeting the use of facial recognition in the workplace. The ruling is a clear signal: organizations in Québec face some of the strictest biometric data standards in North America—and businesses across Canada should take note.
Why This Is Relevant
Biometric technologies are becoming increasingly common for security, access control, and workforce management. Yet, unlike passwords or key cards, biometric identifiers—like facial templates, fingerprints, or voiceprints—are immutable. Once compromised, they cannot be replaced.
Québec’s ruling reinforces that organizations cannot adopt biometric systems simply because they are convenient or cutting-edge. Instead, they must prove that:
-
The objective is real, important, and legitimate.
-
The privacy invasion is proportionate to the benefits.
-
Alternatives have been considered and ruled out with evidence.
In the case at hand, a printing company used facial recognition to control employee access to its building, initially introduced during the COVID-19 pandemic. The CAI found the system failed the necessity test, ruling the privacy risks outweighed the benefits. Even though employees had consented, the CAI held that consent alone was not enough to justify the intrusion.
The company was ordered to stop using the system and to destroy all collected biometric data.
Why This Matters Beyond Québec
Québec’s decision reflects a growing skepticism toward biometrics globally, particularly for routine functions like workplace access. With penalties of up to $10 million or 2% of global turnover under Law 25, the stakes for non-compliance are high. But the implications extend beyond Québec:
-
Canada’s federal Privacy Commissioner is consulting on biometrics, suggesting similar restrictions could spread nationwide.
-
Québec’s decision echoes European regulators’ approach, hinting at future convergence with international standards.
-
Businesses that operate nationally or across borders will need uniform, privacy-by-design approaches to biometrics, not patchwork compliance strategies.
What We Foresee as Important
-
Necessity Will Be Rigorously Tested
Organizations must document clear, evidence-based justifications for biometric use. Convenience or speculative risks (like “buddy punching”) won’t pass muster. -
Consent Alone Is Not Enough
Regulators are making it clear: even if employees or customers agree, intrusive technologies still require proof of proportionality and necessity. -
Alternatives Must Be Seriously Evaluated
Cards, badges, or other access systems will need to be considered and documented. Regulators expect organizations to show why non-biometric options are inadequate. -
Privacy Impact Assessments (PIAs) Will Be Critical
Under Québec’s law, PIAs are mandatory before deploying biometric systems. Beyond compliance, they provide a defensible record that an organization weighed risks responsibly. -
The Enforcement Climate Is Changing
The CAI is increasingly proactive, often questioning biometric filings and issuing warnings. Businesses should expect more investigations, fines, and orders in the near future.
The Bigger Picture
Québec is sending a clear message: biometrics are exceptional tools that require exceptional justification. Businesses cannot treat them as just another upgrade in workplace technology.
For Canadian companies—and especially for national and multinational organizations—the lesson is unmistakable: adopt a privacy-first, necessity-driven approach to biometrics now, or risk costly enforcement later.