Final guidance on the processing of biometric information in the private sector and the federal public sector was published by the Office of the Privacy Commissioner of Canada (OPC) on August 11, 2025. The OPC had previously held a public consultation to consider draft guidance, which was the subject of an AccessPrivacy Policy Consultation Workshop in February 2024.
The updated guidance sets out key factors and principles for organizations to consider when developing and deploying biometric initiatives, including:
-
The need to establish that the purpose for the biometric initiative is legitimate and appropriate, and to evaluate proportionality with associated privacy risks;
-
Requirements for obtaining valid consent with regards to biometric initiatives, including contemplation of consent as a condition of service; and
-
The importance of data minimization, transparency, robust data protection measures, and maintaining the accuracy of biometric systems, including through testing by an individual or entity with appropriate expertise.
The OPC’s updated biometric guidance follows recent decisions from Quebec's CAI considering organizations' processing of biometric information for the purposes of loss prevention and controlling access to business premises.
A more detailed analysis of the guidance will follow, along with practical considerations for Canadian organizations using biometric technologies. Please reach out to the Osler Privacy and Data Management Team if you have any questions.