Commission d'acces a l'information du Quebec (CAI) — Societe Metro Inc.
The CAI prohibited Metro Inc. from putting into service a biometric database and facial-recognition system to detect shoplifting/fraud, finding the project required express consent it could not obtain and constituted an invasion of privacy under Quebec's IT Act.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the decision on 2026-09-06. Every holding carries a short verbatim quote from that text (in FR, the document's language).
- Decided by
- Commission d’accès à l’information du Québec
- Parties
- Commission d’accès à l’information du Québec v. METRO INC.
- Decision date
- February 18, 2025
- Remedy
- The Commission prohibited Metro Inc. from launching its proposed biometric database intended to identify individuals previously involved in shoplifting or fraud using facial recognition.
- Appeal
- Appeal status not stated
Key holdings
The proposed facial recognition system constitutes an identity verification process that requires express consent under section 44 of the LCCJTI.
“le consentement exprès des personnes concernées par le processus de vérification de l’identité projeté est requis.” — paragraph 41
Collecting and verifying biometric data without obtaining required express consent constitutes a significant infringement on privacy.
“sans obtenir le consentement exprès des personnes concernées alors que ce consentement est requis par la Loi, porte atteinte de manière importante à la vie privée de ces personnes.” — paragraph 127
The Commission issued an order prohibiting the launch of the proposed biometric database for facial recognition shoplifting detection.
“INTERDIT la mise en service de la banque de caractéristiques ou de mesures biométriques projetée par l’Entreprise aux fins d’identifier, au moyen de la reconnaissance faciale, les personnes” — paragraph 130
In plain English
Metro Inc. declared its intention on September 6, 2024, to create a biometric database for a pilot project testing two facial recognition systems across its retail locations, including Metro, Super C, and Jean Coutu banners. The system aimed to combat shoplifting and fraud by scanning entering customers' faces using surveillance cameras and matching them against reference images collected during past incidents involving police intervention. On October 2, 2024, the Commission d'accès à l'information du Québec initiated an investigation into the project. Following the investigation's first phase, the Commission issued an order notice on November 1, 2024, raising concerns under provincial technology and privacy laws. Metro Inc. submitted observations arguing that section 44 of the Act establishing a legal framework for information technology did not apply to its identification process and that consent was not required. In its decision dated February 18, 2025, the Commission rejected Metro Inc.'s arguments. The authority held that collecting and comparing facial biometric characteristics to verify customer identity without express consent violates statutory privacy protections. Consequently, the Commission prohibited Metro Inc. from bringing into service the proposed biometric database intended to identify individuals previously involved in shoplifting or fraud using facial recognition.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.