Most small businesses that collect biometric data did not decide to. It arrived as a convenience feature: a fingerprint time clock that stops staff clocking each other in, face unlock on the shared tablet, voice authentication in the phone system so callers skip security questions. Each is a small operational improvement, and each puts you in the highest-sensitivity category of personal information Canadian privacy law recognises.
What makes biometrics different
A password is a secret you chose, and you can choose another one. A biometric is a measurement of a person's body. If a database of templates derived from fingerprints or voices is stolen, the affected people cannot reissue their fingerprints, and the exposure follows them for life. That permanence is why regulators treat biometric information as sensitive, and why Canada's privacy commissioner recently confirmed that voiceprints are sensitive biometric information when it updated its guidance on recording customer calls.
One useful clarification, because it trips people up. A photograph of a face and a recording of a voice are personal information. A mathematical template derived from them for the purpose of identifying or verifying someone is biometric information, and that is the thing carrying the higher standard. A security camera recording the door is not the same as a system that recognises who walked through it.
The consent problem nobody wants to name
Canadian privacy law expects consent to be meaningful and freely given. Now consider an employee being told the new time clock uses fingerprints. They can technically object. In practice they are being asked to refuse a system their employer has bought, in front of their manager, with their shift about to start. Consent obtained in that position is weak, and a regulator looking at it later will see the power imbalance clearly.
The practical answer is to make refusal genuinely costless. Offer a real alternative, a PIN, a card, a manual sign-in, and make sure choosing it carries no penalty, no extra steps that mark the person out and no comment from a supervisor. If you cannot offer an alternative, you need a stronger justification for why biometrics are necessary rather than convenient.
Quebec has a specific requirement
If you operate in Quebec, there is a concrete obligation beyond general principles. Under Quebec law, creating a database of biometric characteristics must be disclosed to the Commission d'accès à l'information, and the disclosure is required promptly, before the database is brought into service. Verification of a person's identity using biometrics also requires express consent. If you have staff in Quebec and a fingerprint time clock, that filing is not optional, and it is the sort of thing that surfaces during an investigation about something else entirely. The wider Quebec regime is covered in our Law 25 guide.
Ask whether you need it at all
This is the question to answer first, because it dissolves most of the compliance work. Biometrics are usually deployed to solve a problem that has a duller solution.
Buddy punching on time clocks is real, and so is a PIN plus a supervisor review of anomalies. Shared-device security is real, and so are individual accounts with passkeys. Caller verification is real, and so is a knowledge check plus callback on a number you hold. If the duller option is 90 percent as effective and carries none of the permanence risk, it is usually the better business decision, not just the safer compliance one.
Where biometrics genuinely win, say controlling access to a room holding regulated material, make that justification explicit and write it down. That record is what demonstrates you decided rather than drifted.
If you are going to use it, do these things
- Write down the purpose in one sentence, and collect nothing beyond it. Purpose creep is what turns a time clock into a surveillance complaint.
- Prefer templates to images, and prefer on-device matching to a central database. A system that stores a non-reversible template locally is a far smaller problem than a server holding fingerprint images.
- Ask the vendor three questions in writing: what exactly is stored, where is it stored, and can it be deleted on request. Get the answers before you buy, which is the discipline in assessing a vendor.
- Offer a real alternative and record that it was offered.
- Set a deletion trigger, not just a retention period. When someone leaves, their template should be destroyed, and someone should be responsible for doing it.
- Tell people plainly what is collected, why, who can see it and how long it is kept. Short and readable beats a clause buried in a handbook.
- File with the CAI if Quebec applies, before the system goes live.
What this means for your business
Biometrics are one of the few areas where the compliance answer and the commercial answer point the same way: collect the least permanent identifier that solves your problem. If a PIN works, use the PIN. If you do need a fingerprint or a voiceprint, the obligations are manageable, but they are real, and in Quebec one of them is a filing most businesses have never heard of. The whole decision takes an hour, and it is considerably cheaper to have it before the system is installed than after someone asks what you are storing.