ICBC cannot let police use the provincial insurance company's facial recognition technology to identify suspected Stanley Cup rioters without a court order, B.C.'s Information and Privacy Commissioner has ruled.

Privacy Commissioner Elizabeth Denham says her department launched an investigation into the use of the technology after ICBC offered to let police use its software to match photographs of suspects with driver licence photographs in its database.

The ruling matches statements made by Denham in June in the days following the riot. Vancouver police did not take up ICBC on the offer, but did build its own computer database of photographs and videos of hundreds of suspects.

"While Vancouver Police did not respond to ICBC's offer in this particular instance, the case raised important questions about the legality of biometric databases compiled by public agencies," said a statement issued by the commissioner on Thursday morning.

The commissioner ruled that while ICBC can use the technology to detect and prevent driver's licence fraud, the corporation failed to notify its customers that facial recognition is in use.

She recommended ICBC inform all customers clearly that it was using the software, cease any use of the information by police without a warrant, and review its privacy procedures and policies.

"A public body can only use personal information for the original purpose it was collected, except in very limited circumstances. ICBC's offer to use its database to check police-submitted images is clearly a different purpose," said Denham.

But Denham said police still have the power to request personal information from ICBC through a warrant or court order.

"Facial recognition has the potential to become a technology of surveillance, and we must ensure that public bodies and private organizations using it or contemplating using it have the legal authority to do so along with strong safeguards to protect personal information," said Denham.

The technology measures the specific facial characteristics of anyone holding a driver's licence in the province. It also stores images taken for the B.C. ID card, issued to non-drivers over the age of 12.