The real estate company behind some of Canada’s most popular shopping centres embedded cameras inside its digital information kiosks at 12 shopping malls across Canada to collect millions of images — and used facial recognition technology without customers’ knowledge or consent — according to a new investigation by the federal, Alberta and B.C. privacy commissioners.
“Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial recognition technology, for analysis,” said federal Privacy Commissioner Daniel Therrien in a statement.
“The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity.”
But the commissioners said that wasn’t good enough.
The privacy watchdogs also found that Cadillac Fairview contravened privacy laws by failing to “obtain meaningful consent” when it collected five million images with inconspicuous cameras.
Cadillac Fairview also used video analytics to collect and analyze sensitive biometric information of customers, investigators said.
Company says technology couldn’t identify people
The watchdogs said the facial recognition software was used to generate additional personal information about individual shoppers, including estimated ages and genders. The images were subsequently deleted — but investigators found that the sensitive biometric information generated from the images was being stored in a centralized database by a third party.
“Cadillac Fairview stated that it was unaware that the database of biometric information existed, which compounded the risk of potential use by unauthorized parties or, in the case of a data breach, by malicious actors,” said the investigation report.
The company said the technology was used to detect the presence of a human face and assign it “within milliseconds” to an approximate age and gender category.
Cadillac Fairview spokesperson Jess Savage said the AVA technology did not store any images during the pilot program and was not capable of recognizing anyone.
“The five million representations referenced in the [Office of the Privacy Commissioner] report are not faces.These are sequences of numbers the software uses to anonymously categorize the age range and gender of shoppers in the camera’s view,” she said in a statement to CBC News.
“The OPC report concludes there is no evidence that CF was using any technology for the purpose of identifying…