News release

Privacy Commissioner of Canada publishes guidance on biometrics

August 11, 2025 – Gatineau, QC

As a growing number of organizations are using biometric technologies such as facial recognition and fingerprint scanning to verify identity and provide services, the Privacy Commissioner of Canada has issued new guidance on protecting privacy in biometric initiatives.

This guidance has been developed for both the public and private sectors and follows a consultation by the Office of the Privacy Commissioner of Canada.

In today’s digital environment, organizations are looking to provide efficient access to goods and services while also adapting to evolving security risks. For example, a fingerprint may be used to gain access to a building, or a facial image can unlock a phone.

While biometrics can enhance security and help in service delivery, they can also raise privacy issues. Biometric information is intimately linked to an individual’s body and is often unique, and unlikely to vary significantly over time. It can reveal sensitive information such as health information or information about race and gender characteristics.

The guidance addresses key considerations for organizations when planning and implementing initiatives involving biometric technology. It emphasizes the importance of ensuring that there is an appropriate purpose for collecting, using, and disclosing biometric information, and of carefully assessing the risks involved, including the proportionality of potential privacy impacts. The guidance also clarifies consent requirements for biometric initiatives, as well as considerations around transparency, safeguarding data, and accuracy, including testing for biometric systems.

Key changes following stakeholder consultation

The OPC held a public consultation on draft versions of the guidance between November 2023 and February 2024. The OPC received 34 written submissions and met with 31 organizations to discuss stakeholders’ views on the guidance. A broad range of groups and organizations participated in the consultation, including representatives from academia, civil society, business, legal associations, public institutions, and individual members of the public.

Following the consultation, the draft guidance documents were revised to reflect stakeholder input. Key changes include:

• Clarified definitions and use of key terms, including discussion of the definition of sensitive information;
• Closer alignment between guidance and legal requirements;
• Added nuance and specificity to discussion of technical explanations, requirements, and best practices;
• Adjusted guidance on consent and criteria for assessing appropriate purposes for the private sector; and
• Added emphasis on lawful authority and re-organized guidance on impact and risk assessment for the public sector.

Quote

“Organizations need to approach the use of biometric information in a privacy-protective way, building privacy considerations at the beginning of any new program or initiative. Prioritizing privacy in this way supports innovation and helps create conditions for a more secure and enriching digital society.”

Philippe Dufresne
Privacy Commissioner of Canada

Related links

• Guidance for processing biometrics – for federal institutions
• Guidance for processing biometrics – for businesses

Media contact

Office of the Privacy Commissioner of Canada
communications@priv.gc.ca