Commission d'acces a l'information du Quebec (CAI) — Imprimeries Transcontinental Inc.
The CAI ordered Imprimeries Transcontinental to cease using facial-recognition biometric technology to control employee access and destroy the biometric templates it had collected, for non-compliance with Quebec biometric privacy law.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the decision on 2026-09-18. Every holding carries a short verbatim quote from that text (in FR, the document's language).
- Decided by
- Commission d’accès à l’information du Québec
- Parties
- Commission d’accès à l’information du Québec v. Imprimeries Transcontinental inc.
- Decision date
- September 4, 2024
- Remedy
- Imprimeries Transcontinental inc. was ordered to cease collecting facial recognition biometric data, stop using its facial recognition access control system, and destroy all generated facial templates and codes within 90 days.
- Appeal
- Appeal status not stated
Key holdings
Facial photographs and their converted mathematical representations constitute sensitive personal biometric information under privacy legislation.
“Par leur nature biométrique, ces renseignements personnels sont considérés de nature sensible” — page 5, paragraph 28
The company failed to establish the necessity and proportionality of collecting sensitive biometric data for premises access control.
“la Commission conclut que l’Entreprise n’a pas démontré la nécessité de la collecte des renseignements personnels pour atteindre l’objectif poursuivi.” — page 14, CONCLUSION
The regulator ordered the business to immediately stop collecting facial biometrics for access control.
“CESSER de collecter des renseignements biométriques permettant la reconnaissance faciale;” — page 14
In plain English
On October 2, 2020, Imprimeries Transcontinental inc. declared to the Commission d'accès à l'information du Québec (CAI) the creation of a biometric database to manage premises access control during the COVID-19 pandemic. The system originally combined facial recognition with temperature checks. By June 2023, the temperature checks were discontinued and the associated data destroyed, leaving only facial recognition active. The company enrolled employees by taking facial photographs and converting them into mathematical codes to unlock doors upon scanning. Following an investigation, the CAI concluded that facial photos and mathematical codifications are sensitive biometric personal data. Under Quebec private sector privacy law, collecting sensitive personal data requires a serious, legitimate, real, and important objective, as well as strict proportionality. While building security is legitimate, the CAI found that the company failed to prove a real, specific security problem justifying biometric collection. Concerns over card sharing or badge loss were purely hypothetical and represented routine business management issues. Furthermore, less intrusive physical access alternatives existed. The CAI determined that the intrusion into employee privacy outweighed the benefits to the business. Consequently, the regulator ordered Imprimeries Transcontinental inc. to stop collecting facial biometrics, cease using facial recognition access control, and destroy all collected facial templates and codes within 90 days.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.