The real estate company behind some of Canada’s most popular shopping centres embedded cameras inside its digital information kiosks at 12 shopping malls across Canada to collect millions of images — and used facial recognition technology without customers’ knowledge or consent — according to a new investigation by the federal, Alberta and B.C. privacy commissioners.
“Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial recognition technology, for analysis,” said federal Privacy Commissioner Daniel Therrien in a statement.
“The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity.”
But the commissioners said that wasn’t good enough.
The privacy watchdogs also found that Cadillac Fairview contravened privacy laws by failing to “obtain meaningful consent” when it collected five million images with inconspicuous cameras.
Cadillac Fairview also used video analytics to collect and analyze sensitive biometric information of customers, investigators said.
Commissioners unsatisfied with CF’s response
The watchdogs said the facial recognition software was used to generate additional personal information about individual shoppers, including estimated ages and genders. The images were subsequently deleted — but investigators found that the sensitive biometric information generated from the images was being stored in a centralized database by a third party.
“Cadillac Fairview stated that it was unaware that the database of biometric information existed, which compounded the risk of potential use by unauthorized parties or, in the case of a data breach, by malicious actors,” said the investigation report.
The company said it suspended its use of cameras back in 2018 when provincial and federal privacy commissioners launched their probe following a CBC investigation.
The three commissioners said the company has reported it has no current plans to reinstall the technology and has deleted all information associated with the video analytics tech that is not required for potential litigation purposes. Cadillac Fairview also told the commissioners that it will not retain or use that data for any other purpose.
“The commissioners remain concerned that Cadillac Fairview refused their request that it commit to ensuring express, meaningful consent is obtained from shoppers should it choose to redeploy the technology in the future,” said the commissioners’ statement.
The investigation found the technology was used in five provinces at the following malls:
- CF Market Mall (Alberta)
- CF Chinook Centre (Alberta)
- CF Richmond Centre (British Columbia)
- CF Pacific Centre (British Columbia)
- CF Polo Park (Manitoba)
- CF Toronto Eaton Centre (Ontario)
- CF Sherway Gardens (Ontario)
- CF Lime Ridge (Ontario)
- CF Fairview Mall (Ontario)
- CF Markville Mall (Ontario)
- CF Galeries d’Anjou (Quebec)
- CF Carrefour Laval (Quebec)