The Office of the Privacy Commissioner of Canada recently released a preliminary report upholding a complaint that the requirement for Law School Admissions Test (LSAT) applicants to provide a thumbprint for identification purposes violates PIPEDA.
The Assistant Privacy Commissioner recommended that the Law School Admission Council (LSAC), administrator of the LSAT cease collecting thumbprints, and to respond within 30 days on how it intends to implement the recommendation.
Jurisdictional issues
The Assistant Commissioner held jurisdiction over LSAC, despite LSAC's arguments that its "non-profit" and "educational" purposes precluded it from engaging in "commercial activity" and that its extra-jurisdictional structure should preclude application of Canadian law. The preliminary findings suggest that "commercial activity" as required under s. 2 of PIPEDA, should be broadly interpreted to include "commercial transactions that non-profit, membership-based organizations might engage in." The Assistant Commissioner also rejected the assertion that LSAC's purposes are educational in nature, providing a two-part test to assess whether there was an educational component to LSAC's activities (which would place it outside PIPEDA). The Assistant Commissioner seemed to follow the reasoning of the SWIFT decision in finding that LSAC has "real and substantial connections" to Canada to justify the application of PIPEDA, notwithstanding that the organization had argued that it had no physical presence in Canada.
Substantive issues
Having established jurisdiction, the Assistant Commissioner applied the four-part test to determine whether fingerprinting of test candidates is appropriate. Is the measure demonstrably necessary to meet a specific need? Is it likely to be effective in meeting that need? Is the loss of privacy proportional to the benefit gained? Is there a less privacy-invasive way of achieving the same end? In her view, the LSAC was justifiably concerned about the use of "ringers" in its tests. However, she was unable to determine whether the method was effective (the thumbprints never having actually been used) and doubted - on "proportionality" and "minimal invasion of privacy" grounds - that the taking of thumbprints could be justified.
On the question of proportionality, the Assistant Commissioner contrasted the privacy rights in fingerprints with those of voice prints and other biometric data, finding that fingerprinting is "more invasive" than other biometric techniques because of its association with "the criminal process". While the Commission had previously found voiceprints to be non-invasive of privacy (or, at least, "does not appear to be duly invasive" in the context of PIPEDA Case Summary #281), such a finding could not be extended indiscriminately to all other proposed uses of biometrics and specifically not to the LSAT thumbprint case.
On the question of minimal invasion of privacy, in the opinion of the Assistant Commissioner, the increasingly widespread use of government-issued photo identification has reduced the necessity of resorting to thumbprint verification, which was introduced in the 1970s. She recommended that LSAC rely on photo identification or some other less intrusive measure.
While a USA PATRIOT Act issue was raised in the complaint, the Assistant Commissioner restated the Commission's view that law enforcement in both Canada and the U.S. would have access to the thumbprints regardless of whether or not they were provided in Canada or the U.S. under lawful access procedures, and proceeded to determine the complaint on other grounds.
Order
LSAC was recommended to cease collecting thumbprints in Canada, and to provide evidence of its plans to implement the recommendation within 30 days.
Assistant Privacy Commissioner's letter
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
