VICTORIA (NEWS 1130) — One of North America’s largest commercial real estate companies embedded small cameras inside digital information kiosks at 12 shopping malls across Canada — including two in B.C. — and used facial recognition technology without customers’ knowledge or consent, an investigation found.
Cadillac Fairview, which owns Pacific Centre in Vancouver and Richmond Centre, collected five million images of shoppers, who were unaware their sensitive biometric information was being gathered, according to the Office of the Information and Privacy Commissioner for B.C.
“Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial recognition technology, for analysis,” says Privacy Commissioner of Canada Daniel Therrien.
“The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity.”
‘Goal was to analyze age, gender’
The goal, according to the company, was to analyze the age and gender of shoppers, not to identify them.
Cadillac Fairview said it was not collecting personal information, and that images were analyzed briefly, then deleted.
But commissioners found Cadillac Fairview did collect personal information and contravened privacy laws by failing to obtain meaningful consent.
Cadillac Fairview also used video analytics to collect and analyze sensitive biometric information of customers, according to investigators.
In addition to these findings, investigators say facial recognition software was used to generate additional personal information about individual shoppers.
While the images were deleted, investigators found that information from them was being stored in a centralized database by a third party.
Cadillac Fairview ‘unaware of database’
Cadillac Fairview stated it was unaware of the database, which investigators say compounded the risk of potential use by unauthorized parties or malicious actors.
“Questions about when an organization is collecting personal information can be complex, but the conclusion we came to about cameras in mall directories was straight-forward,” says Michael McEvoy, Information and Privacy Commissioner for B.C.
“Pictures of individuals were taken and analyzed in a manner that required notice and consent.”
He added the biometric information if unique, for example about the shape of someone’s face.
“As more and more of this information is collected, it can be used by all kinds of people to link up other kinds of information about you, to paint a picture of you, without your permission or consent,” he said.
Cadillac Fairview has since removed the cameras and says it has no plans to reinstall them. It has also deleted all information associated with the video analytics technology that is not required for legal purposes, and confirmed it will not retain or use such data for any other purpose.
“This investigation exposes how opaque certain personal information business practices have become,” says Jill Clayton, Information and Privacy Commissioner of Alberta. “Not only must organizations be clear and upfront when customers’ personal information is being collected, they must also have proper controls in place to know what their service providers are doing behind the scenes with that information.”
The commissioners said they are concerned that Cadillac Fairview refused a request that it commit to ensuring express, meaningful consent is obtained from shoppers should it choose to use the cameras again.