Canada's New Children's Privacy Code

 

This shouldn’t be a radical idea. A seventeen-year-old young person is different from a seven-year-old child, who are both different from a three year old toddler. When we're talking about children's privacy, online safety, and their ability to make decisions about their own personal information, we should recognize those differences.

And that’s baked into Privacy Commissioner of Canada’s new Children's Privacy Code, released on October 20, 2026.

It's a substantial document setting out the OPC’s views on how businesses should collect, use, and disclose the personal information of children and young people.

And I think there's a lot to like about it.

It emphasizes that children have privacy rights of their own. It recognizes that children develop greater independence and decision-making capacity as they mature. And it says that online services should be designed to protect children's privacy without preventing them from participating in the digital world.

This is particularly interesting at a time when governments are proposing increasingly blunt measures to “protect” young people online, including outright restrictions on access to social media.

And there's another interesting wrinkle. The Commissioner's recognition that meaningful consent needs to account for an individual's capacity seems to sit a little awkwardly alongside the arguments his office has been making before the Supreme Court of Canada in the Facebook privacy case. I'll get to that.

In this episode, I'm going to explain where this new Code came from, what it says, what it means for businesses and young people, and why I think its underlying philosophy is particularly important.

And I'll point out some legal questions and a few inconsistencies along the way.

What exactly is a Children's Privacy Code?

This is not a new law. Parliament hasn't passed a Children's Privacy Act. And the Commissioner hasn't suddenly acquired the authority to impose new legal obligations simply by publishing a document.

What we're looking at is regulatory guidance. The Code sets out the Privacy Commissioner's interpretation of how Canada's existing private-sector privacy law, PIPEDA, applies when businesses collect, use, and disclose children's personal information.

PIPEDA is the Personal Information Protection and Electronic Documents Act. It has been Canada's federal private-sector privacy law since 2001.

It establishes broad principles covering consent, appropriate purposes, limits on collection, safeguards, access to personal information, and accountability. But PIPEDA doesn't really distinguish between adults and children. And it doesn't contain a special set of children's privacy rights.

The Commissioner has therefore taken existing legal requirements and developed guidance for applying them to young people. This is significant, but we need to understand its limitations.

For example, the Code repeatedly says organizations must do certain things.

Sometimes that's a fair reflection of obligations already imposed by PIPEDA. Other times, the Code is setting out the Commissioner's interpretation of what compliance requires. Those are not necessarily the same thing.

A regulator's interpretation of the law can be persuasive, and it can tell businesses what to expect during investigations. But it doesn't have the same legal force as legislation, and ultimately the courts determine what PIPEDA requires. So it's important not to confuse the Privacy Commissioner's expectations with new statutory requirements. In short, if you follow the code, you’re likely to stay on the Commissioner’s good side.

Where did this come from?

The Children's Privacy Code didn't appear out of nowhere. For several years, privacy regulators around the world have been paying increasing attention to the particular challenges children face online.

The United Kingdom has its Age Appropriate Design Code, which is probably one of the best-known examples. Ireland has developed children's data protection guidance, and jurisdictions including California have adopted or proposed additional requirements for online services used by children.

There's also an international human rights dimension. Canada ratified the United Nations Convention on the Rights of the Child in 1991. That Convention recognizes that children have rights of their own, including a right to privacy. It also emphasizes their best interests, their right to participate in decisions affecting them, and their evolving capacities.

In 2021, the UN Committee on the Rights of the Child published guidance explaining how those rights apply in digital environments.

Canadian courts have also repeatedly recognized that young people deserve particular privacy protections.

In A.B. v. Bragg Communications, the Supreme Court recognized the inherent vulnerability of children and the importance of their privacy.

And in R. v. Jarvis, the Court recognized that Canadian law often provides children with greater privacy protections than adults.

Against that background, the Privacy Commissioner launched a consultation process to develop a Canadian Children's Privacy Code. That exploratory consultation concluded in August 2025.

The Commissioner also sought input from young people, including through a Youth Council consisting of students aged fourteen to seventeen.

And I think that deserves some credit. If you're going to develop rules that affect how young people use technology, you really should talk to young people.

According to the Commissioner, some of their biggest concerns were the lack of control over their information, the lack of meaningful choice, and the difficulty understanding what companies were doing with their data. 

Young people definitely weren't asking to be excluded from the internet. They wanted greater control over how they participated in it. And that takes us to what I consider the most important part of the Code.

Children are not all the same

The Code expressly recognizes that children under eighteen are not a homogeneous group.

That's an important point.

A five-year-old, a twelve-year-old, and a seventeen-year-old can have radically different abilities to understand information, assess risks, and make decisions.

And children don't suddenly acquire the ability to exercise privacy rights at midnight on their eighteenth birthday. They develop that ability over time. The Code calls this evolving capacity.

Younger children generally require greater protection and more involvement from parents or guardians.

As they grow older, they should be given increasing autonomy over their personal information.

The Code actually provides a table dividing childhood into five developmental stages.

For children from birth to age five, it contemplates parental consent.

For children aged six to nine, parental consent remains necessary, but they should also receive simple written or visual explanations.

For children ten to twelve, the expectation is parental consent along with information directed to the child.

At thirteen to fifteen, the Code contemplates consent from the young person themselves.

And for sixteen- and seventeen-year-olds, again, the young person generally provides their own consent.

But these categories aren't supposed to be a mechanical substitute for considering capacity.

The Code says that, for children thirteen and older, organizations should consider whether the young person can understand the particular decision they're being asked to make. And that assessment should account for the sensitivity of the personal information and the potential consequences.

That makes sense. Consider a fourteen-year-old signing up for an online chess club.

Maybe the service needs a username, an email address, and a password. That's one thing.

Now consider the same fourteen-year-old being asked to consent to the continuous collection of precise location information, detailed behavioural profiling, and disclosure of that information to advertising companies. Those are very different privacy decisions.

A young person might be perfectly capable of understanding one while struggling to appreciate all the implications of the other. And importantly, greater maturity should mean greater autonomy, not simply fewer rights.

The Code recognizes that privacy protections and parental involvement should be adjusted as children become more capable of making their own decisions.

I particularly like the idea of guided autonomy.

Parents have an important role, but they shouldn't necessarily be able to control every aspect of their teenager's digital life. And businesses shouldn't outsource responsibility for privacy protection to parents by assuming that parental controls solve everything.

Children are rights-holders in their own right. That includes the right to some privacy from their parents.

That's a more sophisticated approach than simply saying everybody under eighteen needs adult supervision at all times.

What businesses are expected to do

Now let's look at the practical requirements.

The Code contains seven main expectations, along with a discussion of practices the Commissioner considers unacceptable. And some of these expectations probably should inform how online services are designed.

First: meaningful consent.

Consent mechanisms have to be understandable to the children who are using them.

You can't simply take a twenty-page privacy policy written by lawyers for lawyers, put an "I agree" button at the bottom, and assume a twelve-year-old has meaningfully consented. Actually, you probably shouldn't be doing that to adults either.

The Code says optional uses of personal information should require express, opt-in consent. If an app wants to collect information to deliver its essential service, that's one question. If it also wants to collect additional information for personalization, analytics, or other optional features, those choices should be presented separately. And businesses shouldn't penalize children for declining optional data collection.

They also have to make it easy to withdraw consent.

Second: privacy impact assessments.

The Commissioner encourages organizations to assess the privacy risks of their services, especially when those services involve higher-risk activities.

This means looking at what information is collected, why it's needed, how it could be misused, and what consequences that misuse could have for young people. It's a privacy-by-design approach.

Ideally, those questions are asked before the product launches, not after something goes wrong.

Third: high privacy settings by default.

This is a particularly important recommendation. Children shouldn't have to go hunting through complicated settings menus to turn on privacy protections.

The protections should already be enabled. For example, precise location sharing should be turned off by default. Profiles shouldn't automatically be visible to the entire internet. Third-party sharing should be off unless appropriate consent is obtained. And profiling should also be off by default.

The underlying philosophy is simple: a child shouldn't have to understand every possible privacy risk before the service becomes reasonably safe to use.

Fourth: data minimization.

Businesses should only collect the personal information they actually need to provide the service.

Not everything that might be useful someday. Not everything that might be commercially valuable. And not everything that might help the marketing department develop a more detailed profile.

If an online game works perfectly well with a username, it probably doesn't need a child's real name, home address, precise location, and complete contact list. The Code also emphasizes that information shouldn't be retained longer than necessary.

And because children develop and change so quickly, companies should consider what happens to information collected during childhood as those children mature and become adults.

Fifth: transparency.

Privacy notices have to be understandable to their intended audience. And that means more than simply making them shorter. Information should be presented at appropriate times, in language and formats suitable for the young people using the service.

A thirteen-year-old might understand a relatively straightforward explanation of how recommendations are generated. A seven-year-old might need something much simpler, perhaps with illustrations. 

The important thing is that the explanation is genuinely understandable. 

The Commissioner’s report has some interesting examples of how to communicate privacy related choices to kids. 

Sixth: correction and deletion.

The Code says young people should have practical ways to correct inaccurate personal information and request its deletion. This is especially important when we're talking about things that people shared when they were children. Something that seemed funny or important when someone was eleven may be embarrassing, misleading, or completely irrelevant by the time they're seventeen.

And young people should have some meaningful ability to move beyond their digital history.

The Commissioner wants businesses to make correction and deletion processes easy to find and use.

There are legal questions about the extent to which PIPEDA creates an enforceable deletion right, but the underlying policy objective makes sense.

Seventh: avoiding profiling.

This is one of the most consequential parts of the Code.

The Commissioner says businesses should not use children's personal information for behavioural advertising or other forms of commercial profiling that exploit their vulnerabilities.

That means collecting information about what a child clicks on, watches, searches for, and interacts with, then using that information to infer their interests and target them with advertising.

The Code is particularly concerned about profiling through artificial intelligence.

AI systems can identify patterns and infer things about people that they haven't explicitly disclosed.

And when those systems are used to influence the behaviour of young people, there are significant privacy concerns.

The Code isn't saying that all personalization is prohibited.

There may be legitimate reasons to adapt a service to a child's needs.

But the question has to be whether the practice is genuinely in the child's best interests, not simply whether it increases engagement or advertising revenue.

Some things the Commissioner says consent cannot fix

The Code goes further than simply asking businesses to improve their consent processes.

It identifies certain practices that the Commissioner considers fundamentally incompatible with children's privacy and best interests. These include deceptive design patterns, sometimes called dark patterns.

For example, an interface might make the option to share information bright, colourful, and easy to select, while burying the privacy-protective option behind several additional screens.

Or a service might pressure a child into disclosing information by suggesting they'll lose access, miss out on rewards, or disappoint their friends.

The Code also addresses engagement mechanisms, including points, streaks, and social pressure, when they're deliberately used to generate additional opportunities to collect personal information.

And it takes aim at emotional profiling. The Commissioner uses the following example: Imagine a platform inferring that a child is feeling lonely, insecure, or anxious and then using that information to persuade them to disclose more personal information.

The Commissioner considers that to be exploitative and unacceptable.

The Facebook consent problem

Now, I want to return to something I mentioned at the beginning.

There's an interesting tension between this Code and the position that the Privacy Commissioner has taken in the Facebook litigation. (Canadian Privacy Law Blog: Appeal court reverses Facebook’s Canadian privacy win)

You probably remember the Cambridge Analytica scandal.

Facebook allowed third-party applications to access personal information through its platform, and information relating to hundreds of thousands of Canadians was potentially disclosed through the application at the centre of that scandal.

The Privacy Commissioner concluded that Facebook had failed to obtain meaningful consent and had failed to provide adequate safeguards.

The case eventually made its way to the Supreme Court of Canada.

One of the central issues is how courts should determine whether meaningful consent has actually been obtained.

Under section 6.1 of PIPEDA, consent is only valid if it is reasonable to expect that the individual would understand the nature, purpose, and consequences of the collection, use, or disclosure.

The court below noted that the Commissioner didn’t lead any evidence on what a Facebook user would have understood at the time. The Commissioner said that wasn’t relevant. It’s an objective standard and doesn't have to do with what an actual Facebook user would have understood. 

I get that you don't want compliance with privacy law to depend entirely on the subjective recollections or knowledge of millions of individual users. But the new Children's Privacy Code says that meaningful consent needs to be calibrated to the age, maturity, and developing capacity of the person providing it.

It expressly recognizes that children are not all capable of understanding the same things.

And it says that a particular child may have sufficient capacity to consent to one data practice, but not necessarily another. So clearly you need to understand the actual characteristics and capacities of the people providing consent..

Now, to be fair, those positions aren't necessarily irreconcilable.

An objective test can be contextual.

We can ask what a reasonable thirteen-year-old would understand, rather than what a reasonable adult would understand.

And we can recognize that certain categories of people have particular characteristics without requiring proof of what every individual actually knew.

I wouldn't go so far as to say the Commissioner has contradicted himself.

And I'll be interested to see how the Supreme Court ultimately addresses meaningful consent.

A better alternative to banning young people from the internet?

There's another reason I find this Code interesting.

At the same time the Privacy Commissioner is emphasizing children's autonomy and their right to participate in digital life, governments have been considering restrictions that would prevent young people below a certain age from accessing social media services. 

I've talked about Canada's proposed Safe Social Media Act, Bill C-34, in previous episodes.

One of my fundamental objections to broad social media bans is that they treat young people as a homogeneous group.

They assume that everyone below a particular age should be excluded, regardless of maturity, circumstances, or the benefits they might obtain from participating.

And those benefits can be substantial.

Young people use online services to learn, communicate, develop friendships, participate in communities, express themselves, and access information.

For some young people, particularly those who are isolated or marginalized, those opportunities can be especially important.

The Privacy Commissioner's Code recognizes that participation in digital life isn't some optional luxury. It's just part of ordinary life.

And the Code's stated objective isn't to prevent children from participating.

It's to make participation more privacy-protective and appropriate to their developing capacities.

I think that's a good starting point.

Instead of asking how we can exclude young people from portions of the internet, we should be asking how we can make online services safer while respecting their rights.

Of course, privacy is only one part of online safety.

This Code doesn't try to solve all the other problems.

And perhaps that should inform the broader debate about online safety legislation.

What happens next?

So where does this leave us? The Children's Privacy Code was released on October 20, 2026.

Although the document has been published as the Code, the Privacy Commissioner's office is still accepting feedback until January 20, 2027.

It may be updated in response to that feedback.

The Commissioner has also indicated that additional, more specific guidance may follow.

For businesses, the practical message is that children's privacy is clearly an enforcement priority for the Commissioner.

Conclusion

Overall, I think the Privacy Commissioner's Children's Privacy Code is a welcome development.

It's not legislation, and much of it goes beyond what’s written in and required by PIPEDA.

But I support its underlying philosophy.

Children have privacy rights.

Those rights don't belong exclusively to their parents.

Young people develop greater capacity and autonomy as they mature.

And protecting their privacy should be about empowering them to participate safely in digital life, rather than excluding them from it.

That's a more thoughtful approach than treating every person under eighteen as incapable of making decisions for themselves.

And perhaps, when we're debating children's online safety more broadly, we could use a little more of that nuance.

Would a Flock-type surveillance network fly under Canadian privacy laws?

INTRODUCTION

The system operated by Flock Safety in the United States has been in the news A LOT recently.  I’m going to break down why this would not fly in Canada, thanks to our federal and provincial privacy laws.

This hasn’t been tested by any Canadian courts yet, but my views are based on some pretty strong authorities.

I am not a US lawyer, so I’ll assume that what Flock Safety does in the US is consistent with American laws. What I plan to do in this episode is to apply a Canadian legal and privacy lens to examine whether such a system is consistent with Canadian laws.

In the YouTube version of this episode, I’ll have bookmarks so you can jump to different parts of this discussion in case there are aspects of this discussion you’re most interested in.

So could a company like Flock operate the same kind of surveillance network in Canada?

My conclusion is that the business model would run into some very serious problems with Canadian privacy law. And that's not because automated licence plate recognition is illegal in Canada. It isn't.

It's because our privacy laws place fundamental limits on the collection, retention, use, and disclosure of personal information. And those limits don't disappear just because the information was collected in a public place.

Let's get into it.

HOW ALPR SYSTEMS AND FLOCK SAFETY WORK

First, a little background.

Automated licence plate recognition, or ALPR, isn't particularly new.

It's been used by Canadian police departments for years.

The technology uses cameras and software to recognize licence plate numbers. In traditional police applications, those numbers are compared against a list of vehicles that police are interested in.

For example, a stolen vehicle, a vehicle associated with a missing person, or a vehicle registered to someone whose licence has been suspended.

If the system finds a match, that's called a hit.

If there's no match, that's called a non-hit.

The distinction between hits and non-hits is going to be very important in a few minutes.

Flock takes this technology and builds a much bigger business around it.

It sells subscriptions to its camera systems, cloud software, data storage, and investigative tools.

The customers aren't exclusively police departments.

A shopping mall might put cameras at the entrances to its parking lots. A business park might install them on its property. A residential community might put them at neighbourhood entrances.

And police departments can install them at intersections and along public roads.

The cameras photograph vehicles and produce searchable records including their licence plates, the time, the location, and other information about the vehicle.

All of this is managed through Flock's cloud platform.

Flock says that each customer owns its information and controls whether that information is shared with other organizations. It also says there isn't one single national database containing everything collected by its customers.

So a company that owns shopping centres can install cameras at its dozens of shopping centres and can use the data to investigate organized shoplifting rings. That company can choose whether the data from their cameras, located on their private property is shared only within the company or is shared more widely with local or national law enforcement.

That's an important distinction, but it doesn't change the privacy law implications overall, at least in Canada.

Customers making their information available to police agencies through a common searchable network is a disclosure of personal information for privacy law purposes.

In the United States, that can mean a police department searching information collected by cameras belonging to another police department thousands of kilometres away. Or information originally collected by a private organization.

One value of Flock's network is that it allows police to search historical information about where vehicles have been. Instead of asking whether a particular vehicle is wanted right now, police can potentially ask where that vehicle was yesterday, last week, or on some particular date. I don’t doubt that this has investigative utility.

But it does bring us to one of the big problems, at least in Canada.

PUBLIC INFORMATION IS STILL PERSONAL INFORMATION

There's a very common misconception about privacy law.

Some people assume that if something happens in public, it's fair game.

If I can see your licence plate when you drive past me, why shouldn't I photograph it?

And if I can photograph it, why shouldn't I put it in a database?

And if I can put it in a database, why shouldn't I share that database with the police?

Well, Canadian privacy law doesn't work that way.

The starting point is the definition of personal information.

Under the federal Personal Information Protection and Electronic Documents Act, or PIPEDA, personal information is information about an identifiable individual.

We have similar definitions under provincial private-sector and public-sector privacy laws.

Now, the definition doesn't say that the information has to be secret. It doesn't say the information has to be confidential. It doesn't say that it has to have been collected inside someone's home.

Information about an identifiable individual can be personal information whether it was collected in public or in private.

Take a photograph of me walking down the street.

That's personal information about me, even though I was standing on a public sidewalk.

If you record my name, that's personal information, even though my name might be publicly available.

And if you record my licence plate together with a time and location, and that information can reasonably be linked to me, that's personal information too.

I’ve done a number of episodes on photography and videography in public places.I’ll link to them below. If you’re an individual, in your personal capacity, you are free to take photos or record videos in public places to your heart’s content. But businesses and the state are subject to specific privacy laws.

There is some nuance in the case law concerning licence plates by themselves.

In a case called Leon’s Furniture Limited v. Alberta, the Alberta Court of Appeal concluded that a licence plate number collected by a furniture store wasn't personal information in the particular circumstances of that case.

But that doesn't mean licence plate information is categorically outside privacy law.

What matters is the context.

Is the information about an identifiable individual? Can it be linked to that person? What information is being collected along with the plate number?

A surveillance system deliberately designed to create searchable records of vehicle movements presents a very different situation from an isolated plate number written down by a store employee.

And that's precisely the distinction that the British Columbia Information and Privacy Commissioner made in an important investigation that we'll come to shortly.

There's another important distinction here.

Under section 8 of the Canadian Charter of Rights and Freedoms, whether someone has a reasonable expectation of privacy is fundamental to determining whether government conduct constitutes a search.

Information being exposed to public view is relevant to that analysis but it doesn't automatically settle the question.

The Supreme Court of Canada has repeatedly recognized that privacy is contextual and that technology can reveal information about people that goes far beyond what an ordinary observer might learn.

A single observation of your car on the street is one thing.

A detailed, searchable history of your movements is something else.

And under Canadian privacy legislation, the analysis doesn't even begin with the question of whether you had a reasonable expectation of privacy under section 8.

It begins with the statutory definition of personal information and the legal requirements for collecting, using, and disclosing it.

Publicly visible does not mean publicly available for every purpose. And publicly available does not mean unregulated.

PRIVATE BUSINESSES CANNOT CROWDSOURCE SURVEILLANCE

Let's begin with the private-sector side of Flock's business model.

Imagine a shopping mall in Canada installs Flock cameras at every entrance to their parking lots.

The cameras automatically collect licence plate numbers and information about vehicles entering and leaving the parking lot. Maybe the mall wants to deter theft. Maybe it's concerned about vehicle break-ins.

I’ll concede these are legitimate security concerns.

But now imagine that the mall contributes all of those records to a system that makes them searchable by police departments across Canada.

That's where Canadian private-sector privacy law becomes a major obstacle.

Under PIPEDA, and similar privacy legislation in provinces such as British Columbia, Alberta, and Quebec, organizations are generally required to obtain consent for the collection, use, and disclosure of personal information, unless a statutory exception applies.

Consent is not simply a one-time permission to do whatever the organization wants.

The individual has to understand the purposes for which their information is being collected, used, and disclosed.

And there are limits on what an organization can do, even with consent.

So let's return to our shopping mall.

When someone drives into the parking lot, have they consented to having their licence plate and movements recorded?

That depends on the circumstances, and there would have to be adequate signage letting everyone know what’s going on.

There may be situations where appropriate, limited video surveillance is justified for a legitimate security purpose.

But have they consented to having that information contributed to a national law enforcement surveillance network?

I would suggest that the answer is almost certainly no.

And simply putting up a sign saying that the property is under video surveillance doesn't necessarily solve that problem. All collection of personal information has to be limited and proportionate to the specific purposes for the collection, use and disclosure of personal information.

A reasonable person might understand that a security camera is recording activity in a parking lot.

That doesn't mean they understand that the information will be available for retrospective searches by police departments in other cities or provinces. Nor does the fact that an individual voluntarily drove into a parking lot mean that they consented to an unlimited range of secondary uses.

There are exceptions to the consent requirements, including certain disclosures for investigations and law enforcement purposes. But these are limited statutory exceptions. They are not a general licence for a private company to collect information about everyone who drives past and make that information continually available to government agencies.

Providing information in response to a properly authorized police investigation is one thing but creating a standing arrangement to supply police with access to information about everyone is another.

And there's a second legal obstacle.

A REASONABLE PURPOSE IS REQUIRED, EVEN WITH CONSENT

Section 5, subsection 3 of PIPEDA contains one of the most important provisions in Canadian privacy law.

It says that an organization may collect, use, or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.

Think about that for a moment.

Even if an organization obtains consent, it still has to demonstrate that the purpose is appropriate.

The Office of the Privacy Commissioner of Canada has published guidance explaining how this test works.

Among other things, regulators consider whether the organization has a legitimate need for the information, whether the collection is effective in meeting that need, whether less privacy-invasive alternatives are available, and whether the loss of privacy is proportionate to the benefits.

Now apply that test to a networked, multi-user surveillance system.

Is preventing theft from a shopping mall a legitimate purpose?

Yup.

Could security cameras contribute to that purpose?

Yup.

But is it necessary to retain a searchable record of every vehicle that enters the mall?

Is it necessary to contribute those records to an interconnected surveillance network?

Is it proportionate to make information about thousands of innocent customers available to law enforcement agencies for investigations having nothing to do with the shopping mall?

I think Canadian privacy regulators would have some serious concerns.

And I would go further.

I don't think routine, indiscriminate collection of vehicle movement information for contribution to a nationwide surveillance network would satisfy the reasonable-purpose requirement.

The fact that some of that information might someday be useful in an investigation doesn't make collecting all of it reasonable today.

And that's really the problem with the crowdsourcing model.

Each individual business can reasonably collect information for its own security.

But the system creates an additional purpose: accumulating surveillance information for use by other organizations. That is a fundamentally different purpose.

And it's one that needs its own legal justification.

THE B.C. PRIVACY COMMISSIONER ALREADY CONSIDERED THIS

Now, we don't have to speculate entirely about how Canadian privacy regulators might approach this.

In 2012, the Information and Privacy Commissioner for British Columbia, Elizabeth Denham, published an investigation into the Victoria Police Department's use of automated licence plate recognition.

It's Investigation Report F12-04. I’ll link to it below.

And even though the report is more than a decade old, its reasoning is relevant to today's debate about Flock.

At the time, Victoria Police were using ALPR cameras mounted on patrol vehicles.

The cameras scanned passing vehicles and compared licence plates against information identifying vehicles of interest to police. The system operated in partnership with the RCMP.

The RCMP maintained the underlying alert database, and Victoria Police supplied information generated by its ALPR system. (In British Columbia, many municipalities like Victoria have their own police departments, and the RCMP acts as the provincial police department and is the police agency of jurisdiction where there is not a municipal force.)

One of the first questions the Commissioner considered was whether the information collected by the cameras was personal information.

The Victoria Police Department had suggested that it wasn't.

The Commissioner disagreed.

She concluded that licence plate numbers, associated photographs, and information about the time and place where a vehicle was observed constituted personal information.

The reason was straightforward.

Police could connect licence plate numbers to identifiable individuals through motor vehicle and other law enforcement databases. That’s one factor that distinguishes this from the Alberta Court of Appeal decision in Leon’s: a retailer can’t connect a license plate to its owner. The police can.

The information collected by the ALPR system could reveal where someone's vehicle had been at a particular time.

And that made it information about an identifiable individual, because cops can make that connection.

So the Commissioner concluded that ALPR was collecting personal information.

But that didn't mean the police were prohibited from using the technology. In fact, she recognized that police could lawfully collect information to compare licence plates against a list of vehicles of legitimate law enforcement interest.

And here's where the distinction between “hits” and “non-hits” becomes crucial.

When the system scanned a licence plate and found a match with a legitimate police alert, that was a hit.

Police could investigate the hit and retain relevant information for an authorized law enforcement purpose.

But when the system scanned a licence plate and found no match, that was a non-hit.

And the Commissioner concluded that the police no longer had a lawful purpose for using that information once the comparison had been completed.

The police had collected the information to determine whether the vehicle was of interest. The comparison was complete. The vehicle was not of interest. End of story.

The Commissioner recommended that information relating to non-hits be deleted immediately after the system determined there was no match.

She also considered the disclosure of non-hit information by Victoria Police to the RCMP.

And her conclusion was that this disclosure was not authorized under British Columbia's Freedom of Information and Protection of Privacy Act.

This is especially important.

The fact that the recipient was another police agency did not automatically make the disclosure lawful.

The Commissioner distinguished between sharing information associated with legitimate law enforcement hits and sharing information about vehicles that were not of interest to police.

The first could be authorized. The second, in the circumstances she investigated, was not.

And that is about as direct a challenge to the Flock model as you could imagine.

Because what makes the Flock network valuable is precisely its ability to retain and search historical observations, including observations that were not connected to any identified law enforcement concern when they were collected.

The B.C. Commissioner was saying that police couldn't simply hold on to those non-hits for speculative future use.

And they couldn't send the information to the RCMP merely because the RCMP operated the central system. That’s a disclosure of personal information that has to be justified under BC’s privacy law.

WHAT ABOUT THE REST OF CANADA?

Now, this was a British Columbia investigation, and we need to be careful about that.

Canada doesn't have one uniform privacy statute that applies to every police department.

Municipal and provincial police are generally subject to the applicable provincial public-sector privacy legislation. The RCMP is subject to federal privacy law, including the federal Privacy Act.

The precise statutory wording and permitted disclosures vary.

So it would be too simple to say that one B.C. investigation is binding on every police department in the country. But the underlying principles are not unique to British Columbia.

All of our public sector privacy laws have provisions that limit collecting information to an authorized purpose, limiting its subsequent use, protecting it from unauthorized disclosure, and not retaining personal information indefinitely just because it might be useful someday.

And we have support for those principles from Ontario. In December 2024, the Information and Privacy Commissioner of Ontario updated its guidance on the use of ALPR systems by police services.

The guidance makes the same fundamental distinction between hits and non-hits.

It says non-hit information should only be collected or used briefly, to determine whether the plate matches a legitimate alert.

And once the system determines that the information is a non-hit, it should be deleted as soon as technologically feasible.

The Ontario guidance recognizes narrow circumstances in which police may need to preserve particular information while establishing whether they have lawful authority to use it.

But that's very different from indiscriminately retaining everyone's movements.

It's also worth acknowledging that some Canadian police services have adopted more permissive retention practices, which may not align with legal requirements.

For example, Toronto Police publicly report retaining non-hit records for seven days.

That illustrates an important point: Canadian police practices are not entirely uniform, and there are unresolved questions about whether every deployment complies with the applicable privacy rules.

But the approach taken by the B.C. Commissioner and reflected in Ontario's guidance is clear.

A legitimate police need to identify particular vehicles does not create a general authority to accumulate information about every vehicle.

If a police agency wants to create a historical database of everyone's movements, it needs to establish a lawful basis for that collection, retention, and subsequent use.

It cannot simply assume that because a licence plate was visible on a public road, everything about the vehicle's movements is available for unrestricted police use.

A MULTI-USER, NETWORKED SYSTEM IS THE BIG PROBLEM

There's another important issue with the Flock model.

Even if a Canadian police agency could lawfully collect particular ALPR information, that doesn't mean it can freely disclose that information to everyone else.

Suppose a police department in Halifax collects information about vehicles on Halifax streets.

The records are stored using software supplied by a private company. That alone isn't necessarily unlawful.

Police and other public bodies routinely use private contractors and cloud service providers to process and store information without any issues.

The question is whether the contractor is processing information on behalf of the police, subject to appropriate contractual and statutory safeguards, or whether the information is being made available to other organizations for their own purposes.

Those are two very different situations.

Now imagine the Halifax police department enables searches by police agencies in Toronto, Vancouver, Calgary, and hundreds of smaller communities.

And perhaps those agencies make their own information searchable in return. That is not simply outsourcing data storage. That is an arrangement for cross-agency access to personal information.

And Canadian public-sector privacy legislation regulates disclosures of personal information.

Police departments may disclose personal information for legitimate law enforcement purposes where legislation authorizes them to do so. There are provisions permitting police information sharing and cooperation. But those provisions are not unlimited.

The original collecting agency must have lawful authority for the disclosure, and the recipient must have lawful authority for its own collection and use.

Having a common commercial software provider doesn't create that authority. Neither does a data-sharing agreement. And neither does the assertion that the information might someday help solve a crime.

Remember the B.C. investigation. The Commissioner specifically found that Victoria Police were not authorized to disclose non-hit information to the RCMP under the arrangements she investigated.

And that's especially important because the RCMP was an actual law enforcement agency involved in operating the ALPR program. If that disclosure was not permitted, imagine the difficulty of justifying routine access to non-hit information by thousands of other organizations.

And don't forget the private-sector contributors.

Police receiving information from a shopping mall or a residential community need to consider the legal basis on which that information was obtained and disclosed. The Supreme Court of Canada in Bykovets said that the police needed a court order to collect an IP address from a private company. A license plate number and a specific location is more sensitive and more “biographical” than an IP address, and would inherently have a higher expectation of privacy than an IP address for Charter purposes.

An organization can't make an otherwise unlawful surveillance arrangement lawful merely by inviting the police to participate.

IT DOESN'T MATTER WHETHER THERE IS ONE DATABASE

Now, Flock makes an important point about its architecture. It says it doesn't simply combine everybody's information into one national database. It says its customers own their data and control who can access it.

That may be an important contractual and technical distinction.

But for Canadian privacy law purposes, it isn't the end of the analysis.

If police department A can search records collected by police department B, there has to be a lawful basis for that access.

The same applies if the records are held by one company on two different servers.

Or in two different customer accounts.

Or through a federated search system where the information stays in separate databases.

The issue isn't where the database sits. It's what information is collected, who can access it, and what they're allowed to do with it.

If you create a system that permits thousands of different organizations to search records of people's movements, calling it a network rather than a database doesn't change the underlying privacy issues.

Nor does saying that every participating organization owns its own records.

Privacy law doesn't stop applying when information is shared between organizations that have signed contracts with each other.

Again, that may be entirely consistent with US laws, but Canadian privacy laws are significantly different and present a real barrier to the adoption of a system like this.

DOES THIS MEAN CANADA CANNOT USE ALPR?

Absolutely not. ALPR can be a legitimate and useful law enforcement technology. That kind of system can be designed to comply with Canadian privacy requirements. The Information and Privacy Commissioners of British Columbia and Ontario said as much.

Police may also be able to retain and disclose information relating to legitimate investigations, subject to the applicable laws.

And there may be narrowly tailored investigative uses of historical information where police have specific legal authority, including judicial authorization where required. None of this means police have to abandon modern technology.

The question is whether the technology has been designed around a legitimate and authorized purpose.

What I don't think fits within our existing legal framework is the idea that a range of private businesses, shopping centres, residential communities, and police departments can contribute collected vehicle observations to a searchable surveillance system.

This is particularly the case where the records concern people who are not suspected of any wrongdoing.

There's an enormous difference between using technology to identify a stolen car and using technology to create a retrospective history of everyone's movements just in case that information might someday be interesting. That distinction is fundamental to Canadian privacy law.

CONCLUSION — THE DIFFERENCE BETWEEN SEEING AND SURVEILLING

Here's where I think the Flock debate reveals something important about privacy.

We often hear the argument that if you have nothing to hide, you have nothing to fear.

And that if you're driving on a public road, you can't really expect privacy.

But privacy isn't just about hiding things.

It's also about limiting the ability of others, including governments and private companies, to collect and assemble information about our lives. It’s about the right to be left alone to live your life without constant surveillance.

You might reasonably expect that someone could see your car parked outside a restaurant.

That doesn't mean you should expect a private company to maintain a searchable history of every restaurant you've visited.

You might expect that a police officer could observe your vehicle on a public street.

That doesn't mean the police should be able to reconstruct months of your movements without an appropriate legal justification.

Canadian privacy law recognizes that distinction.

Information about identifiable individuals remains personal information even when it is collected in public.

The fact that it is publicly visible may affect the level of privacy protection that applies, particularly under the Charter. But it doesn't turn that information into something that can be collected, used, retained, and disclosed without limits.

Our private-sector privacy laws impose requirements for consent, lawful purposes, and proportionality. Our public-sector privacy laws impose requirements for authorized collection, use, retention, and disclosure.

And the B.C. Information and Privacy Commissioner's investigation into ALPR shows that these principles aren't just theoretical.

I think those principles create formidable barriers to importing a Flock-type surveillance network model into Canada.

Just because you can see it doesn't mean you can surveil it.