Canadian Mall Operator Collected Biometric Information Without Consent: Privacy Commissioners

Federal and provincial privacy commissioners have determined that Cadillac Fairview collected the biometric information of 5 million Canadian shoppers without proper consent. Cadillac Fairview is a commercial real estate company that operates 69 properties in Canada.

The commissioners’ report specifically concerns 12 shopping malls across the country, where Cadillac Fairview installed small, easily-overlooked cameras in its mall directories. Those cameras had facial recognition capabilities, and were used to collect age and gender information about the consumers frequenting those locations.

While Cadillac Fairview claims that all of the images were analyzed and then deleted, the commissioners found that the biometric data generated with those images was being stored on a central database with a third party. The company claimed that it was unaware of that database, and pointed out that the faces were stored as strings of numbers, and not as static images. However, critics noted that that information could still be used to identify individuals caught on camera, and that all of that personal information could be exposed in a data breach.

The investigation started in 2018, and was carried out by federal privacy commissioners in collaboration with the privacy commissioners from Alberta and British Columbia. Cadillac Fairview argued that it gave consumers proper notification about the cameras, but the commissioners ruled that the decals posted at mall entrances did not meet the standard for meaningful consent.

“Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial recognition technology, for analysis,” said Canadian Privacy Commissioner Daniel Therrien.

Cadillac Fairview has now deleted everything associated with the cameras, save for information needed for legal purposes. It also removed the cameras from the 12 malls that had them, and indicated that it has no plans to install new ones in the future. The privacy commissioners stressed that the company would need to do a better job of obtaining explicit consent if it ever did so, and was concerned that Cadillac Fair was unwilling to make such a commitment.

“Not only must organizations be clear and up front when customers’ personal information is being collected, they must also have proper controls in place to know what their service providers are doing behind the scenes with that information,”  said Alberta information and privacy commissioner Jill Clayton.

The list of affected malls included five in Ontario, one in Manitoba, and two each in Quebec, BC, and Alberta. The results of the investigation could create business challenges for companies like VSBLTY, which specialize in smart retail technology.

For its part, the Canadian privacy commissioners have opened a separate investigation into Clearview AI, prompting the company to suspend all of its contracts in the country.

Source: Global News

–

October 30, 2020 – by Eric Weiss