When ICBC took the photo for your driver's licence, did anyone mention it could end up being scanned to see if you committed a crime?

Unlikely. But that could be happening soon if the Vancouver police department takes up ICBC's offer to use its database and face-recognition software to identify culprits in Vancouver's infamous hockey riot.

It is the most high-profile example to date in this country of what Simon Fraser University communication professor Peter Chow-White warns is 'function creep' -- that is using a technology or process designed for a specific purpose for other purposes. Thanks to face recognition technology, data collected for drivers' licences could be used for everything from naming rioters to providing police with personal data on people caught committing a variety of crimes.

"The function of the ICBC database is not for law enforcement as far as I know," said Chow-White. "They don't tell me when I get my picture taken this could be used in a police investigation."

You didn't need to be anywhere near downtown Vancouver on the night of the riots for your photo to be scanned for a possible match to potential criminals. ICBC's database contains current and post photos of the more than three million people who hold BC driver's licences plus non-drivers, such as seniors or youth over the age of 12, who have a photo card from ICBC to use as government-issued ID.

ICBC is offering to take photos from the police that are the subject of active investigations and run them against its database. ICBC spokesman Adam Grossman said if there is a confirmed match, ICBC will let the police know but it will only turn over personal data if the police get a court order requiring it. Grossman said the police haven't submitted any photos yet but he said he thinks that is because it is early in their investigations.

The court order isn't a requirement of privacy law governing the public sector, which gives public sector organizations discretion over sharing information with the police in specific investigations, according to BC's Information and Privacy Commissioner Elizabeth Denham. She says ICBC has gone one step further in requiring judicial oversight and it has also agreed to cooperate with her audit of the process.

"Generally personal information collected for one purpose should not be used for a new purpose or re-purposed without a person's consent," said Denham. "The exception is for law-enforcement investigations."

However, while ICBC's proposal to share its database is within the law, Denham said she has misgivings about it because it is a case of information collected for one purpose being used for another purpose.

"The use of this data for law enforcement raises signficant issues for all of us," she said.

Denham said while people may be anxious to see the rioters identified and charged, the experience with the riots here showed that social media can be used for citizen surveillance.

"That's a very slippery slope," she said. "We all have to think about what we are giving up when we act this way."

While ICBC has a rich repository of photo IDs, it has only been since last February that the face recognition software it uses - provided by the U.S. company L-1 Identity Solutions - was enabled to scan photos from sources outside ICBC's own photo database. Grossman said no data on British Columbians is stored in the U.S. and no L-1 employees have access to the data.

ICBC has had L-1's software since 2009. The software analyzes facial characteristics that don't change, such as the size and location of cheekbones and the distance between a person's eyes. In 2010, the software aided in a number of convictions for identity theft and fraud.

In one case, when a woman took a road test using her sister's name the software revealed she had been prohibited from driving. In another case, the same person's photo appeared on two difference licences. An investigation revealed that one of the identities used to get a driver's licence and register and insure several vehicles was that of a dead person. In another case, someone in organized crime who had been deported was found out when he applied for a driver's licence using another man's identity.

ICBC's offer to the Vancouver police would mark the first time the software has been used for outside purposes and privacy experts warn it marks an alarming anti-privacy trend that could see the huge amounts of information collected in databases used for other than their originally intended purposes. Chow-White said in the case of the ICBC database, the function creep has extended across organizations. And he points out that the face recognition software, which may not be entirely accurate, scans the entire database and not just suspects.

"it widens the surveillance net, instead of those under surveillance, everybody comes under their surveillance net," he said.

While Grossman didn't have specific statistics on accuracy of the software, he said analysts check the results when the software turns up a match. The issue of inaccuracy with face recognition software is one raised by many privacy and security experts, including Kris Constable, director of the Victoria-based PrivaSecTech, which specializes in information security and privacy technology. He said face recognition software could result in a lot of false positives.

"It is realy hard to do it right without false positives," he said. "Google tried and they were unsuccessful and they just gave up. Why do we as citizens accept that this is happening?"

Constable, who is also on the privacy and access committee of the BC Civil Liberties Association, said concern was raised with the introduction of the enhanced driver's licence database that there could be potential uses and abuses outside of the original purpose of the database.

"This is the what if we brought up at the beginning," he said of the face recognition scanning for riot suspects.

gshaw@vancouversun.com

@gillianshaw on Twitter