Several million shoppers at malls across Canada had their images recorded, analyzed, and then saved in a database without their knowledge.
The Privacy Commissioners of BC, Alberta, and Canada conducted an investigation into the data collection activities of Cadillac Fairview, one of the biggest real estate companies in North America.
The company operates malls across Canada and used facial recognition technology to document people at information kiosks.
Five million photos were collected using small inconspicuous cameras to gather biometric data without the consent of shoppers.
The Privacy Commissioners say Cadillac Fairview collected personal information in a manner that violated privacy laws.
BC’s Information and Privacy Commissioner, Michael McEvoy says the pictures of individuals in the malls were clearly collected and used in a way that required notice and consent.
“Questions about when an organization is collecting personal information can be complex, but the conclusion we came to about cameras in mall directories was straight-forward.”
Cadillac Fairview says it was not trying to identify individuals, just analyzing the age and gender of consumers using the malls.
The images were deleted, but investigators found that the sensitive biometric information generated from the images was being stored in a centralized database by a third party.
Jill Clayton, Information and Privacy Commissioner of Alberta, says their investigation exposes how “opaque” certain personal information practices have become.
“Not only must organizations be clear and upfront when customers’ personal information is being collected, but they must also have proper controls in place to know what their service providers are doing behind the scenes with that information.”
In the view of the commissioners: Cadillac Fairview stated that it was unaware that the database of biometric information existed, which compounded the risk of potential use by unauthorized parties or, in the case of a data breach, by malicious actors.
The three privacy commissioners recommend that if Cadillac Fairview uses such technology in the future, it should take steps to obtain meaningful consent before capturing and analyzing the biometric facial images of shoppers.
