Â鶹´«Ã½Ó³»and Richmond malls were among 12 Cadillac Fairview properties across Canada that used facial recognition technology to collect customer information without their consent.
That’s the primary finding of an investigation by federal, Alberta and B.C. privacy commissioners.
"Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial recognition technology, for analysis," Privacy Commissioner of Canada Daniel Therrien said. "The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity."
B.C. Information and Privacy Commissioner Michael McEvoy said issues around collecting personal information can be complex but the issues in the Cadillac Fairview situation were straightforward: “Pictures of individuals were taken and analyzed in a manner that required notice and consent."
Cameras embedded in kiosks
A said the commercial real estate giant embedded cameras inside digital information kiosks at CF Richmond Centre and Vancouver's CF Pacific Centre.
“An individual would not, while using a mall directory, reasonably expect their image to be captured and used to create a biometric representation of their face, which is sensitive personal information, or for that biometric information to be used to guess their approximate age and gender,” the report said.
The company has asserted the goal was to analyze the age and gender of shoppers but not identify them.
Cadillac Fairview also asserted shoppers were made aware of the activity via decals on mall entry doors that referred to its privacy policy. The commissioners called the measure insufficient. Indeed, the notice suggested shoppers visit mall guest services to see the policy, a request that confused services’ staff.
Cadillac Fairview also asserted that it wasn’t collecting personal information as camera images were briefly analyzed, then deleted.
However, the commissioners found Cadillac Fairview did collect personal information, contravening privacy laws by failing to obtain meaningful consent as the company collected the five million images with small, inconspicuous cameras.
The company also used video analytics to collect and analyze sensitive biometric information of customers, the report said.
Cadillac Fairview said it was unaware that the database of biometric information existed. That, the commissioners found, compounded the risk of potential use by unauthorized parties or, in the case of a data breach, malicious actors.
The commissioners launched their probe after media reports raising questions about Toronto-based Cadillac Fairview's practices. Glacier Media also that Lower Mainland bus stops contained similar cameras.
Mall owners deleting all data
In response to the investigation, the company removed the cameras from its digital directory kiosks and has no plans to reinstall it. Further, Cadillac Fairview has deleted all information associated with the video analytics technology not required for legal purposes and confirmed it will not retain or use such data for any other purpose.
“This includes the more than five million biometric representations of individual shoppers' faces, which it had retained for no discernable reason,” a commissioners’ joint news release said.
"This investigation exposes how opaque certain personal information business practices have become,” Alberta commissioner Jill Clayton said. "Not only must organizations be clear and up front when customers' personal information is being collected, they must also have proper controls in place to know what their service providers are doing behind the scenes with that information."
The commissioners recommended that if Cadillac Fairview were to use such technology in the future, it should take steps to obtain express, meaningful consent before capturing and analyzing the biometric facial images of shoppers.
The commissioners remain concerned Cadillac Fairview refused their request that it commit to ensuring express, meaningful consent is obtained from shoppers should it choose to redeploy the technology in the future.
Issues around using triangulation of customers’ mobile devices to offer customers deals while using mall WiFi remain a live concern for the commissioners.
@jhainswo
