Canada: Office of the Privacy Commissioner released guidance for processing biometrics for businesses under Personal Information Protection and Electronic Documents Act

On 11 August 2025, the Office of the Privacy Commissioner of Canada (OPC) released the Guidance for processing biometrics for businesses under the Personal Information Protection and Electronic Documents Act (PIPEDA). The guidance provides private-sector organisations with requirements for the collection, use, disclosure, retention, and safeguarding of biometric information. The guidance defines biometric technology, including physiological and behavioural biometrics, and outlines privacy obligations relating to identifying an appropriate purpose, obtaining valid consent, limiting collection, ensuring proportionality, and implementing safeguards proportionate to the sensitivity of biometric data. It specifies measures for accuracy, accountability, and openness, requiring organisations to use privacy-protective systems by design, adopt technical and organisational controls, limit retention periods, maintain audit trails, and ensure compliance by third-party service providers. The guidance emphasises the sensitivity of biometric information capable of uniquely identifying individuals, sets conditions for mandatory breach reporting under section 10.1 of PIPEDA, and mandates transparency on data handling, cross-border transfers, and automated decision-making involving biometric systems.