But Elizabeth Denham did not recommend police stop using the cameras mounted on squad cars to photograph, scan and record licence plate numbers.
Rather, she said municipal police in B.C. should alter the system to immediately delete information about vehicles that do not match an alert list compiled by the Mounties.
"Victoria Police Department originally adopted automated licence plate recognition for traffic enforcement purposes — so that's detecting stolen vehicles, that's identifying uninsured drivers. My investigation determined that's a completely legitimate use of the technology and we have no issue with that," Denham said in an interview.
"What I am concerned about is ALPR, as it's currently being used, is collecting information about law-abiding citizens and their whereabouts for no justifiable purpose and disclosing that information to the RCMP, and that use and disclosure contravenes B.C.'s privacy laws."
The cameras compare licence plates to a list of plate numbers of interest to police. The system also records the time, location and a photograph of the vehicle.
The program originated in Ireland to deal with the Irish Republican Army. It has been in use by RCMP since 2006 and the Victoria Police Department began using it in March, prompting complaints to the privacy commission.
In the Victoria region, the cameras scan 500 vehicles every day they're in operation, and police get about one hit for every 100 scans.
But the cameras cannot be used as a surveillance tool, collecting and storing data on citizens who police have no reason to track, Denham said.
Currently, a daily scan record is turned over to RCMP that includes the information from vehicles that do not generate a hit from the alert list.
RCMP voluntarily delete that information within 30 minutes of receipt, but police agencies expressed to the commission office during the investigation that they may retain that data.
"Collecting personal information for law enforcement purposes does not extend to retaining information on the suspicionless activities of citizens just in case it may be useful in the future," she wrote in the 32-page report.
She also expressed concern that the alert list includes information that may be needed by police in emergency situations but is not relevant to traffic enforcement, such as whether a licence plate owner has been the victim or domestic abuse, attempted suicide, or may have been refused a firearms certificate.
It's a violation of the constitutional right to privacy, Denham said.
RCMP said the program allows officers to be much more efficient.
"The non-hit data collected by the officers is not used in any way, shape or form," Supt. Denis Boucher, officer in charge of E Division traffic services, said in an email. "It is deleted from the system as soon as the data is transferred to the RCMP server."
The RCMP manages the data for all police agencies in the province in order to protect the integrity of the information, he said.
"The Office of the Information & Privacy Commissioner of British Columbia report, in our view, contains inaccurate information in regards to the ALPR system which we will address with the privacy commissioner," Boucher wrote.
"We will review the recommendations and provide a response once we have had more time to review the report."
RCMP, as a national police force, is not subject to provincial privacy laws but Assistant Federal Privacy Commissioner Chantal Bernier said the recommendations in B.C. are similar to recommendations the federal commission made in a review done at the request of the RCMP's E Division in 2009.
The force agreed to reconfigure the system to immediately delete that information, and Bernier said the agency is still grappling with how to do so.
"We've received assurances from the RCMP that these would be implemented," Bernier said.
Ontario Provincial Police also use the automated scans, but its system only retains information associated with hits from the alert list.
Victoria Police Chief Const. Jamie Graham said the licence plate scans have paid "tremendous dividends" for traffic enforcement and he disagreed with some of Denham's findings.
"For example, VicPD does not make known or reveal any 'non-hit' data at any time. This data is transferred to the RCMP for the sole purpose of its destruction," Graham wrote.
B.C. Attorney General Shirley Bond said she will take a look at the recommendations — but they are recommendations, not orders, she pointed out.
"We want to make sure that there is clearly that balance that allows us to have law enforcement use the tool, but to protect privacy," she said in Victoria.
The privacy breach occurs when Victoria police provide the data to RCMP to delete, she said.
"That's a technical issue," Bond told reporters.
"The RCMP have made it clear that they follow the protocols that have been laid out."
— By Dene Moore in Vancouver