Would a Flock-type surveillance network fly under Canadian privacy laws?

INTRODUCTION

The system operated by Flock Safety in the United States has been in the news A LOT recently.  I’m going to break down why this would not fly in Canada, thanks to our federal and provincial privacy laws.

This hasn’t been tested by any Canadian courts yet, but my views are based on some pretty strong authorities.

I am not a US lawyer, so I’ll assume that what Flock Safety does in the US is consistent with American laws. What I plan to do in this episode is to apply a Canadian legal and privacy lens to examine whether such a system is consistent with Canadian laws.

In the YouTube version of this episode, I’ll have bookmarks so you can jump to different parts of this discussion in case there are aspects of this discussion you’re most interested in.

So could a company like Flock operate the same kind of surveillance network in Canada?

My conclusion is that the business model would run into some very serious problems with Canadian privacy law. And that's not because automated licence plate recognition is illegal in Canada. It isn't.

It's because our privacy laws place fundamental limits on the collection, retention, use, and disclosure of personal information. And those limits don't disappear just because the information was collected in a public place.

Let's get into it.

HOW ALPR SYSTEMS AND FLOCK SAFETY WORK

First, a little background.

Automated licence plate recognition, or ALPR, isn't particularly new.

It's been used by Canadian police departments for years.

The technology uses cameras and software to recognize licence plate numbers. In traditional police applications, those numbers are compared against a list of vehicles that police are interested in.

For example, a stolen vehicle, a vehicle associated with a missing person, or a vehicle registered to someone whose licence has been suspended.

If the system finds a match, that's called a hit.

If there's no match, that's called a non-hit.

The distinction between hits and non-hits is going to be very important in a few minutes.

Flock takes this technology and builds a much bigger business around it.

It sells subscriptions to its camera systems, cloud software, data storage, and investigative tools.

The customers aren't exclusively police departments.

A shopping mall might put cameras at the entrances to its parking lots. A business park might install them on its property. A residential community might put them at neighbourhood entrances.

And police departments can install them at intersections and along public roads.

The cameras photograph vehicles and produce searchable records including their licence plates, the time, the location, and other information about the vehicle.

All of this is managed through Flock's cloud platform.

Flock says that each customer owns its information and controls whether that information is shared with other organizations. It also says there isn't one single national database containing everything collected by its customers.

So a company that owns shopping centres can install cameras at its dozens of shopping centres and can use the data to investigate organized shoplifting rings. That company can choose whether the data from their cameras, located on their private property is shared only within the company or is shared more widely with local or national law enforcement.

That's an important distinction, but it doesn't change the privacy law implications overall, at least in Canada.

Customers making their information available to police agencies through a common searchable network is a disclosure of personal information for privacy law purposes.

In the United States, that can mean a police department searching information collected by cameras belonging to another police department thousands of kilometres away. Or information originally collected by a private organization.

One value of Flock's network is that it allows police to search historical information about where vehicles have been. Instead of asking whether a particular vehicle is wanted right now, police can potentially ask where that vehicle was yesterday, last week, or on some particular date. I don’t doubt that this has investigative utility.

But it does bring us to one of the big problems, at least in Canada.

PUBLIC INFORMATION IS STILL PERSONAL INFORMATION

There's a very common misconception about privacy law.

Some people assume that if something happens in public, it's fair game.

If I can see your licence plate when you drive past me, why shouldn't I photograph it?

And if I can photograph it, why shouldn't I put it in a database?

And if I can put it in a database, why shouldn't I share that database with the police?

Well, Canadian privacy law doesn't work that way.

The starting point is the definition of personal information.

Under the federal Personal Information Protection and Electronic Documents Act, or PIPEDA, personal information is information about an identifiable individual.

We have similar definitions under provincial private-sector and public-sector privacy laws.

Now, the definition doesn't say that the information has to be secret. It doesn't say the information has to be confidential. It doesn't say that it has to have been collected inside someone's home.

Information about an identifiable individual can be personal information whether it was collected in public or in private.

Take a photograph of me walking down the street.

That's personal information about me, even though I was standing on a public sidewalk.

If you record my name, that's personal information, even though my name might be publicly available.

And if you record my licence plate together with a time and location, and that information can reasonably be linked to me, that's personal information too.

I’ve done a number of episodes on photography and videography in public places.I’ll link to them below. If you’re an individual, in your personal capacity, you are free to take photos or record videos in public places to your heart’s content. But businesses and the state are subject to specific privacy laws.

There is some nuance in the case law concerning licence plates by themselves.

In a case called Leon’s Furniture Limited v. Alberta, the Alberta Court of Appeal concluded that a licence plate number collected by a furniture store wasn't personal information in the particular circumstances of that case.

But that doesn't mean licence plate information is categorically outside privacy law.

What matters is the context.

Is the information about an identifiable individual? Can it be linked to that person? What information is being collected along with the plate number?

A surveillance system deliberately designed to create searchable records of vehicle movements presents a very different situation from an isolated plate number written down by a store employee.

And that's precisely the distinction that the British Columbia Information and Privacy Commissioner made in an important investigation that we'll come to shortly.

There's another important distinction here.

Under section 8 of the Canadian Charter of Rights and Freedoms, whether someone has a reasonable expectation of privacy is fundamental to determining whether government conduct constitutes a search.

Information being exposed to public view is relevant to that analysis but it doesn't automatically settle the question.

The Supreme Court of Canada has repeatedly recognized that privacy is contextual and that technology can reveal information about people that goes far beyond what an ordinary observer might learn.

A single observation of your car on the street is one thing.

A detailed, searchable history of your movements is something else.

And under Canadian privacy legislation, the analysis doesn't even begin with the question of whether you had a reasonable expectation of privacy under section 8.

It begins with the statutory definition of personal information and the legal requirements for collecting, using, and disclosing it.

Publicly visible does not mean publicly available for every purpose. And publicly available does not mean unregulated.

PRIVATE BUSINESSES CANNOT CROWDSOURCE SURVEILLANCE

Let's begin with the private-sector side of Flock's business model.

Imagine a shopping mall in Canada installs Flock cameras at every entrance to their parking lots.

The cameras automatically collect licence plate numbers and information about vehicles entering and leaving the parking lot. Maybe the mall wants to deter theft. Maybe it's concerned about vehicle break-ins.

I’ll concede these are legitimate security concerns.

But now imagine that the mall contributes all of those records to a system that makes them searchable by police departments across Canada.

That's where Canadian private-sector privacy law becomes a major obstacle.

Under PIPEDA, and similar privacy legislation in provinces such as British Columbia, Alberta, and Quebec, organizations are generally required to obtain consent for the collection, use, and disclosure of personal information, unless a statutory exception applies.

Consent is not simply a one-time permission to do whatever the organization wants.

The individual has to understand the purposes for which their information is being collected, used, and disclosed.

And there are limits on what an organization can do, even with consent.

So let's return to our shopping mall.

When someone drives into the parking lot, have they consented to having their licence plate and movements recorded?

That depends on the circumstances, and there would have to be adequate signage letting everyone know what’s going on.

There may be situations where appropriate, limited video surveillance is justified for a legitimate security purpose.

But have they consented to having that information contributed to a national law enforcement surveillance network?

I would suggest that the answer is almost certainly no.

And simply putting up a sign saying that the property is under video surveillance doesn't necessarily solve that problem. All collection of personal information has to be limited and proportionate to the specific purposes for the collection, use and disclosure of personal information.

A reasonable person might understand that a security camera is recording activity in a parking lot.

That doesn't mean they understand that the information will be available for retrospective searches by police departments in other cities or provinces. Nor does the fact that an individual voluntarily drove into a parking lot mean that they consented to an unlimited range of secondary uses.

There are exceptions to the consent requirements, including certain disclosures for investigations and law enforcement purposes. But these are limited statutory exceptions. They are not a general licence for a private company to collect information about everyone who drives past and make that information continually available to government agencies.

Providing information in response to a properly authorized police investigation is one thing but creating a standing arrangement to supply police with access to information about everyone is another.

And there's a second legal obstacle.

A REASONABLE PURPOSE IS REQUIRED, EVEN WITH CONSENT

Section 5, subsection 3 of PIPEDA contains one of the most important provisions in Canadian privacy law.

It says that an organization may collect, use, or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.

Think about that for a moment.

Even if an organization obtains consent, it still has to demonstrate that the purpose is appropriate.

The Office of the Privacy Commissioner of Canada has published guidance explaining how this test works.

Among other things, regulators consider whether the organization has a legitimate need for the information, whether the collection is effective in meeting that need, whether less privacy-invasive alternatives are available, and whether the loss of privacy is proportionate to the benefits.

Now apply that test to a networked, multi-user surveillance system.

Is preventing theft from a shopping mall a legitimate purpose?

Yup.

Could security cameras contribute to that purpose?

Yup.

But is it necessary to retain a searchable record of every vehicle that enters the mall?

Is it necessary to contribute those records to an interconnected surveillance network?

Is it proportionate to make information about thousands of innocent customers available to law enforcement agencies for investigations having nothing to do with the shopping mall?

I think Canadian privacy regulators would have some serious concerns.

And I would go further.

I don't think routine, indiscriminate collection of vehicle movement information for contribution to a nationwide surveillance network would satisfy the reasonable-purpose requirement.

The fact that some of that information might someday be useful in an investigation doesn't make collecting all of it reasonable today.

And that's really the problem with the crowdsourcing model.

Each individual business can reasonably collect information for its own security.

But the system creates an additional purpose: accumulating surveillance information for use by other organizations. That is a fundamentally different purpose.

And it's one that needs its own legal justification.

THE B.C. PRIVACY COMMISSIONER ALREADY CONSIDERED THIS

Now, we don't have to speculate entirely about how Canadian privacy regulators might approach this.

In 2012, the Information and Privacy Commissioner for British Columbia, Elizabeth Denham, published an investigation into the Victoria Police Department's use of automated licence plate recognition.

It's Investigation Report F12-04. I’ll link to it below.

And even though the report is more than a decade old, its reasoning is relevant to today's debate about Flock.

At the time, Victoria Police were using ALPR cameras mounted on patrol vehicles.

The cameras scanned passing vehicles and compared licence plates against information identifying vehicles of interest to police. The system operated in partnership with the RCMP.

The RCMP maintained the underlying alert database, and Victoria Police supplied information generated by its ALPR system. (In British Columbia, many municipalities like Victoria have their own police departments, and the RCMP acts as the provincial police department and is the police agency of jurisdiction where there is not a municipal force.)

One of the first questions the Commissioner considered was whether the information collected by the cameras was personal information.

The Victoria Police Department had suggested that it wasn't.

The Commissioner disagreed.

She concluded that licence plate numbers, associated photographs, and information about the time and place where a vehicle was observed constituted personal information.

The reason was straightforward.

Police could connect licence plate numbers to identifiable individuals through motor vehicle and other law enforcement databases. That’s one factor that distinguishes this from the Alberta Court of Appeal decision in Leon’s: a retailer can’t connect a license plate to its owner. The police can.

The information collected by the ALPR system could reveal where someone's vehicle had been at a particular time.

And that made it information about an identifiable individual, because cops can make that connection.

So the Commissioner concluded that ALPR was collecting personal information.

But that didn't mean the police were prohibited from using the technology. In fact, she recognized that police could lawfully collect information to compare licence plates against a list of vehicles of legitimate law enforcement interest.

And here's where the distinction between “hits” and “non-hits” becomes crucial.

When the system scanned a licence plate and found a match with a legitimate police alert, that was a hit.

Police could investigate the hit and retain relevant information for an authorized law enforcement purpose.

But when the system scanned a licence plate and found no match, that was a non-hit.

And the Commissioner concluded that the police no longer had a lawful purpose for using that information once the comparison had been completed.

The police had collected the information to determine whether the vehicle was of interest. The comparison was complete. The vehicle was not of interest. End of story.

The Commissioner recommended that information relating to non-hits be deleted immediately after the system determined there was no match.

She also considered the disclosure of non-hit information by Victoria Police to the RCMP.

And her conclusion was that this disclosure was not authorized under British Columbia's Freedom of Information and Protection of Privacy Act.

This is especially important.

The fact that the recipient was another police agency did not automatically make the disclosure lawful.

The Commissioner distinguished between sharing information associated with legitimate law enforcement hits and sharing information about vehicles that were not of interest to police.

The first could be authorized. The second, in the circumstances she investigated, was not.

And that is about as direct a challenge to the Flock model as you could imagine.

Because what makes the Flock network valuable is precisely its ability to retain and search historical observations, including observations that were not connected to any identified law enforcement concern when they were collected.

The B.C. Commissioner was saying that police couldn't simply hold on to those non-hits for speculative future use.

And they couldn't send the information to the RCMP merely because the RCMP operated the central system. That’s a disclosure of personal information that has to be justified under BC’s privacy law.

WHAT ABOUT THE REST OF CANADA?

Now, this was a British Columbia investigation, and we need to be careful about that.

Canada doesn't have one uniform privacy statute that applies to every police department.

Municipal and provincial police are generally subject to the applicable provincial public-sector privacy legislation. The RCMP is subject to federal privacy law, including the federal Privacy Act.

The precise statutory wording and permitted disclosures vary.

So it would be too simple to say that one B.C. investigation is binding on every police department in the country. But the underlying principles are not unique to British Columbia.

All of our public sector privacy laws have provisions that limit collecting information to an authorized purpose, limiting its subsequent use, protecting it from unauthorized disclosure, and not retaining personal information indefinitely just because it might be useful someday.

And we have support for those principles from Ontario. In December 2024, the Information and Privacy Commissioner of Ontario updated its guidance on the use of ALPR systems by police services.

The guidance makes the same fundamental distinction between hits and non-hits.

It says non-hit information should only be collected or used briefly, to determine whether the plate matches a legitimate alert.

And once the system determines that the information is a non-hit, it should be deleted as soon as technologically feasible.

The Ontario guidance recognizes narrow circumstances in which police may need to preserve particular information while establishing whether they have lawful authority to use it.

But that's very different from indiscriminately retaining everyone's movements.

It's also worth acknowledging that some Canadian police services have adopted more permissive retention practices, which may not align with legal requirements.

For example, Toronto Police publicly report retaining non-hit records for seven days.

That illustrates an important point: Canadian police practices are not entirely uniform, and there are unresolved questions about whether every deployment complies with the applicable privacy rules.

But the approach taken by the B.C. Commissioner and reflected in Ontario's guidance is clear.

A legitimate police need to identify particular vehicles does not create a general authority to accumulate information about every vehicle.

If a police agency wants to create a historical database of everyone's movements, it needs to establish a lawful basis for that collection, retention, and subsequent use.

It cannot simply assume that because a licence plate was visible on a public road, everything about the vehicle's movements is available for unrestricted police use.

A MULTI-USER, NETWORKED SYSTEM IS THE BIG PROBLEM

There's another important issue with the Flock model.

Even if a Canadian police agency could lawfully collect particular ALPR information, that doesn't mean it can freely disclose that information to everyone else.

Suppose a police department in Halifax collects information about vehicles on Halifax streets.

The records are stored using software supplied by a private company. That alone isn't necessarily unlawful.

Police and other public bodies routinely use private contractors and cloud service providers to process and store information without any issues.

The question is whether the contractor is processing information on behalf of the police, subject to appropriate contractual and statutory safeguards, or whether the information is being made available to other organizations for their own purposes.

Those are two very different situations.

Now imagine the Halifax police department enables searches by police agencies in Toronto, Vancouver, Calgary, and hundreds of smaller communities.

And perhaps those agencies make their own information searchable in return. That is not simply outsourcing data storage. That is an arrangement for cross-agency access to personal information.

And Canadian public-sector privacy legislation regulates disclosures of personal information.

Police departments may disclose personal information for legitimate law enforcement purposes where legislation authorizes them to do so. There are provisions permitting police information sharing and cooperation. But those provisions are not unlimited.

The original collecting agency must have lawful authority for the disclosure, and the recipient must have lawful authority for its own collection and use.

Having a common commercial software provider doesn't create that authority. Neither does a data-sharing agreement. And neither does the assertion that the information might someday help solve a crime.

Remember the B.C. investigation. The Commissioner specifically found that Victoria Police were not authorized to disclose non-hit information to the RCMP under the arrangements she investigated.

And that's especially important because the RCMP was an actual law enforcement agency involved in operating the ALPR program. If that disclosure was not permitted, imagine the difficulty of justifying routine access to non-hit information by thousands of other organizations.

And don't forget the private-sector contributors.

Police receiving information from a shopping mall or a residential community need to consider the legal basis on which that information was obtained and disclosed. The Supreme Court of Canada in Bykovets said that the police needed a court order to collect an IP address from a private company. A license plate number and a specific location is more sensitive and more “biographical” than an IP address, and would inherently have a higher expectation of privacy than an IP address for Charter purposes.

An organization can't make an otherwise unlawful surveillance arrangement lawful merely by inviting the police to participate.

IT DOESN'T MATTER WHETHER THERE IS ONE DATABASE

Now, Flock makes an important point about its architecture. It says it doesn't simply combine everybody's information into one national database. It says its customers own their data and control who can access it.

That may be an important contractual and technical distinction.

But for Canadian privacy law purposes, it isn't the end of the analysis.

If police department A can search records collected by police department B, there has to be a lawful basis for that access.

The same applies if the records are held by one company on two different servers.

Or in two different customer accounts.

Or through a federated search system where the information stays in separate databases.

The issue isn't where the database sits. It's what information is collected, who can access it, and what they're allowed to do with it.

If you create a system that permits thousands of different organizations to search records of people's movements, calling it a network rather than a database doesn't change the underlying privacy issues.

Nor does saying that every participating organization owns its own records.

Privacy law doesn't stop applying when information is shared between organizations that have signed contracts with each other.

Again, that may be entirely consistent with US laws, but Canadian privacy laws are significantly different and present a real barrier to the adoption of a system like this.

DOES THIS MEAN CANADA CANNOT USE ALPR?

Absolutely not. ALPR can be a legitimate and useful law enforcement technology. That kind of system can be designed to comply with Canadian privacy requirements. The Information and Privacy Commissioners of British Columbia and Ontario said as much.

Police may also be able to retain and disclose information relating to legitimate investigations, subject to the applicable laws.

And there may be narrowly tailored investigative uses of historical information where police have specific legal authority, including judicial authorization where required. None of this means police have to abandon modern technology.

The question is whether the technology has been designed around a legitimate and authorized purpose.

What I don't think fits within our existing legal framework is the idea that a range of private businesses, shopping centres, residential communities, and police departments can contribute collected vehicle observations to a searchable surveillance system.

This is particularly the case where the records concern people who are not suspected of any wrongdoing.

There's an enormous difference between using technology to identify a stolen car and using technology to create a retrospective history of everyone's movements just in case that information might someday be interesting. That distinction is fundamental to Canadian privacy law.

CONCLUSION — THE DIFFERENCE BETWEEN SEEING AND SURVEILLING

Here's where I think the Flock debate reveals something important about privacy.

We often hear the argument that if you have nothing to hide, you have nothing to fear.

And that if you're driving on a public road, you can't really expect privacy.

But privacy isn't just about hiding things.

It's also about limiting the ability of others, including governments and private companies, to collect and assemble information about our lives. It’s about the right to be left alone to live your life without constant surveillance.

You might reasonably expect that someone could see your car parked outside a restaurant.

That doesn't mean you should expect a private company to maintain a searchable history of every restaurant you've visited.

You might expect that a police officer could observe your vehicle on a public street.

That doesn't mean the police should be able to reconstruct months of your movements without an appropriate legal justification.

Canadian privacy law recognizes that distinction.

Information about identifiable individuals remains personal information even when it is collected in public.

The fact that it is publicly visible may affect the level of privacy protection that applies, particularly under the Charter. But it doesn't turn that information into something that can be collected, used, retained, and disclosed without limits.

Our private-sector privacy laws impose requirements for consent, lawful purposes, and proportionality. Our public-sector privacy laws impose requirements for authorized collection, use, retention, and disclosure.

And the B.C. Information and Privacy Commissioner's investigation into ALPR shows that these principles aren't just theoretical.

I think those principles create formidable barriers to importing a Flock-type surveillance network model into Canada.

Just because you can see it doesn't mean you can surveil it.