CADILLAC Fairview, one of North America’s largest commercial real estate companies, imbedded cameras inside its digital information kiosks at 12 shopping malls across Canada (including the CF Richmond Centre and Vancouver’s CF Pacific Centre) and used facial recognition technology without its customers’ knowledge or consent, an investigation by federal, Alberta and B.C. privacy commissioners has found.
The goal, the company said, was to analyze the age and gender of shoppers and not to identify individuals. Cadillac Fairview also asserted that shoppers were made aware of the activity via decals it had placed on shopping mall entry doors that referred to its privacy policy, a measure the commissioners determined was insufficient.
Cadillac Fairview also asserted that it was not collecting personal information, since the images taken by camera were briefly analyzed, then deleted. However, the commissioners found that Cadillac Fairview did collect personal information, contravening privacy laws by failing to obtain meaningful consent as the company collected the five million images with small, inconspicuous cameras. Cadillac Fairview also used video analytics to collect and analyze sensitive biometric information of customers.
The investigation also found that:
* facial recognition software was used to generate additional personal information about individual shoppers, including estimated age and gender;
* while the images were deleted, the sensitive biometric information generated from the images was being stored in a centralized database by a third party; and
* Cadillac Fairview stated that it was unaware that the database of biometric information existed, which compounded the risk of potential use by unauthorized parties or, in the case of a data breach, malicious actors.
“Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial recognition technology, for analysis,” said Daniel Therrien, Privacy Commissioner of Canada. “The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity.”
Michael McEvoy, British Columbia’s Information and Privacy Commissioner, said: “Questions about when an organization is collecting personal information can be complex, but the conclusion we came to about cameras in mall directories was straightforward. Pictures of individuals were taken and analyzed in a manner that required notice and consent.”
Jill Clayton, Information and Privacy Commissioner of Alberta, said: “This investigation exposes how opaque certain personal information business practices have become. “Not only must organizations be clear and up front when customers’ personal information is being collected, they must also have proper controls in place to know what their service providers are doing behind the scenes with that information.”
The regulators launched the investigation following media reports that raised questions about Toronto-based Cadillac Fairview’s practices.
In response to the investigation, the company removed the cameras from its digital directory kiosks. It has no current plans to reinstall the technology. Cadillac Fairview has also deleted all information associated with the video analytics technology that is not required for legal purposes and confirmed it will not retain or use such data for any other purpose. This includes the more than five million biometric representations of individual shoppers’ faces, which it had retained for no discernable reason.
The three privacy commissioners have recommended that if Cadillac Fairview were to use such technology in the future, it should take steps to obtain express, meaningful consent before capturing and analyzing the biometric facial images of shoppers.
The commissioners remain concerned that Cadillac Fairview refused their request that it commit to ensuring express, meaningful consent is obtained from shoppers should it choose to redeploy the technology in the future.
Read the report: Report of findings: Joint investigation of the Cadillac Fairview Corporation Ltd. by the Privacy Commissioner of Canada, the Information and Privacy Commissioner of Alberta, and the Information and Privacy Commissioner for British Columbia (https://www.oipc.bc.ca/reports/investigation-reports/)
Read the guidelines: Guidelines for obtaining meaningful consent (https://www.oipc.bc.ca/guidance-documents/2255)
