Cadillac Fairview collected five million shoppers’ images without consent, according to the federal, Alberta and B.C. privacy commissioners.
The investigation from the commissioners reveals that the commercial real estate company embedded cameras inside their digital information kiosks at 12 shopping malls across Canada and used facial recognition technology without customers’ consent.
The company states that the goal behind the cameras was to analyze the age and gender of shoppers and not to identity individuals.
Cadillac Fairview says that shoppers were made aware of the activity through decals it had placed on shopping mall entry doors that referred to its privacy policy. However, the commissioners found that this measure was insufficient.
“The commissioners found that Cadillac Fairview did collect personal information, and contravened privacy laws by failing to obtain meaningful consent as they collected the five million images with small, inconspicuous cameras,” the commissioners noted in a news release.
Further, Cadillac Fairview also used video analytics to collect and analyze sensitive biometric data of customers, which was generated from the images and was being stored in a centralized database by a third party.
“The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity,” Privacy Commissioner of Canada Daniel Therrien, said in a statement.
Cadillac Fairview has since removed the cameras from the kiosks and says that it doesn’t have any current plans to reinstall the technology. It says that it has also deleted the information and data collected.
The company released a statement outlining that it had conducted a beta test in July 2018 that was designed “to assess the amount of foot traffic at a given site and categorize the general demographics of visitors anonymously.”
It notes that it removed the technology more than two years ago when concerns were raised by the public, and the five million images referenced by the commissioners are not of faces.
“We have accepted and implemented all the Privacy Commissioner’s recommendations, with the exception of those that speculate about hypothetical future uses of similar technology. We currently have no plans to use the technologies in question,” the statement reads.
Source: Privacy Commissioner of Canada
