From the office to the checkout line, biometric tools are everywhere: logging employees through fingerprint time clocks, authenticating customers by their voice, and monitoring retail floors with facial recognition. Yet, one question looms large: what rules guide their use?
On Aug. 11, 2025, the Office of the Privacy Commissioner of Canada (OPC) issued its final Guidance for processing biometrics – for businesses (Guidance) for private-sector organizations deploying biometric initiatives. It addresses key considerations for organizations on their privacy obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA) and best practices for handling biometric information.
New Guidance basics
The Guidance was developed for both the public and private sectors, and follows a public consultation by the OPC held from Nov. 2023 to Feb. 2024, during which the OPC received 34 written submissions and met with 31 organizations to discuss various stakeholders’ views on the draft guidance (Draft).
The motive behind creating the new Guidance was that the previous one, published in 2011, did not reflect the growing number of organizations currently using biometric technologies such as facial recognition and fingerprint scanning. The OPC opined that, while biometrics can enhance security and help with service delivery, they can also raise privacy issues since biometric information is intimately linked to an individual’s body, potentially revealing sensitive information. As such, the OPC felt the need to offer updated insight in helping organizations ensure that they use such technologies in a privacy-protective way.
Interestingly, although the Guidance is not by nature a legally binding document, its deliberate use of must and should throughout the document highlight its practical weight. In fact, even sections that contain the word should often imply a requirement which, if not followed, could result in a PIPEDA report. For instance, the fact that the OPC uses appropriateness criteria when conducting investigations implies that organizations must rather than should follow the Guidance’s criteria.
Comparison with the Draft Guidance
The OPC’s Guidance goes into considerably more depth than the Draft in explaining how biometric systems operate. It breaks down key terms, distinguishes between recognition and classification, and further clarifies what constitutes biometric information. We go over these definitions and distinctions in more detail below.
The updated Guidance also provides a more nuanced treatment of sensitivity: biometric information that uniquely identifies an individual is always considered sensitive, while non-identifying information may or may not be sensitive depending on the risks it poses, or what it reveals about that individual. In fact, in the Draft, sensitivity was embedded within the appropriateness test, effectively treating sensitivity as part of that threshold. The OPC’s Guidance now treats sensitivity as an independent factor, while appropriateness is assessed through its own structured test, as delineated below.
The OPC’s Guidance also reworks the approach to consent. Whereas the Draft stated that the use of biometrics would “almost always” require express consent, the OPC’s Guidance instead speaks of requiring an “appropriate form of consent.” This means that while express consent remains the general rule for biometric information, there may be limited contexts where implied consent could be sufficient for biometric information that is not deemed sensitive.
At the same time, the updated Guidance softens some of the categorical “musts” in the Draft while hardening others.
For example, the Draft required that organizations “must” use verification before identification, keep disclosure to a “tight circle,” and always inform individuals about transfers to service providers. In the final version, these have been reframed as “should” obligations, leaving room for a risk-based application.
Conversely, other expectations have been strengthened: organizations “must” now use biometric systems that are privacy-protective by design, and they “must” ensure both technical accuracy and fairness, including minimizing performance discrepancies across socio-demographic groups.
The OPC’s Guidance also reshapes how safeguards are framed. The Draft went into technical detail about specific attack types such as spoofing or hill climbing. The final Guidance removes much of this taxonomy and instead presents a more outcomes-based, operational checklist. It emphasizes requirements such as using cancellable templates, applying end-to-end encryption, and conducting regular vulnerability testing. This shift reflects the OPC’s intent to guide organizations toward practical, measurable security outcomes, making the sections more accessible and implementation-focused for businesses.
Interplay with Québec
The OPC’s updated Guidance generally aligns with Québec’s Commission d’accès à l’information (CAI)’s guide on biometrics (available in French only), and follows recent decisions from the CAI considering organizations’ processing of biometric information for the purposes of loss prevention and access control to business premises. These decisions highlight an increase in regulatory scrutiny regarding the use of biometrics, particularly in respect of the necessity and proportionality of these more privacy-invasive tools.
Note that while the OPC’s Guidance is advisory, Québec has established more prescriptive requirements. Although the Act respecting the protection of personal information in the private sector (Québec Privacy Act) only regulates biometric information through the notion of sensitive personal information, the Act to establish a legal framework for information technology (Québec IT Act) specifically addresses organizations’ obligations with respect to the collection and processing of biometric information.
For instance, Québec organizations must, in addition to obtaining the express consent of individuals for the collection of their biometric data, previously declare to the CAI the use of a biometric system for the verification or confirmation of a person’s identity, even if no biometric data is stored in a database. Note that the notice must be made at least 60 days prior to the use of a database of biometric characteristics. The CAI also mandates organizations to conduct a privacy impact assessment (PIA) before deploying any biometric system, whereas it is not required — but strongly recommended — by the OPC.
Key concepts
“Biometrics” is generally understood as the quantification of human characteristics into measurable terms. In the context of the OPC’s Guidance, it typically refers to systems used to identify or verify the identity of individuals by using their biometric information, such as fingerprints, iris and retina prints, hand and face geometry, or voiceprints (that is, biometric recognition), but it can also encompass newer systems that analyze biometric information to predict attributes like age or gender (also known as biometric classification).
This is an important point given that biometric information — which is information about biometric characteristics that has been extracted from a biometric sample — is typically considered sensitive personal information and is, therefore, subject to private-sector data protection laws regardless of the purpose of its use. It is interesting to note that the OPC’s definition of biometrics is broader than the CAI’s, which allows for greater regulatory scope and a more flexible, risk-based approach to security.
Verification and identification are the two main functions of biometrics (also known as identification and authentication, respectively, in Québec). Their technical operation is different, which may lead to distinct legal implications and risks. While the notion of “verification” consists of verifying or confirming the identity of an individual (one-to-one matching), the notion of “identification” instead means to find an identity in a database to determine who the person is (one-to-many matching).
For example, verification allows someone to verify or confirm if an individual is who they claim to be, whereas identification may be used to authorize or deny access (that is, the captured biometric information was found in a database). The identification function will generally trigger more risks since a reference database must be implemented, which is not necessarily the case for the verification function.
