banConcluded
Commission d'acces a l'information du Quebec (CAI) — Societe Metro Inc.
February 18, 2025 · Canada
The CAI prohibited Metro Inc. from putting into service a biometric database and facial-recognition system to detect shoplifting/fraud, finding the project required express consent it could not obtain and constituted an invasion of privacy under Quebec's IT Act.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.