Cadillac Fairview collected 5 million shoppers’ images without consent

Cadillac Fairview collected five million shoppers’ images without their consent, according to an investigation by the federal, Alberta and B.C. Privacy Commissioners. 

The investigation found that 12 shopping malls across Canada used facial recognition through embedded cameras inside digital information kiosks, a press release said. 

Cadillac Fairview said that images were collected to “analyze the age and gender of shoppers and not to identify individuals.”

The company said shoppers were “made aware of the activity via decals it had placed on shopping mall entry doors that referred to their privacy policy.” The commissioners determined that doing so was insufficient. 

The company also noted that it did not collect personal information “since images taken by camera were briefly analyzed then deleted,” however the investigation found that personal information was collected and that Cadillac Fairview contravened privacy laws by failing to obtain meaningful consent. 

The investigation also noted that the company used video analytics to collect and analyze sensitive biometric information of customers. It noted that while images were deleted, they were stored in a “centralized database by a third party.”

“Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial recognition technology, for analysis,” said Daniel Therrien, Privacy Commissioner of Canada, said in the release.

“The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity.” 

Therrien recently stated that the country’s privacy laws are not robust enough to protect Canadians. He called on the government to take action in amending the privacy act, which hasn’t been done since 2015.

The release noted that the company removed cameras in response to the investigation and does not have any plans to reinstall the technology. It added that all information associated with video analytics has been deleted and the company has confirmed it will not retain or use the data for any other purpose. 

Story continues

Cadillac Fairview said in a news release that collecting information was a beta test that was “briefly conducted” at select malls in July 2018. It said the software used “was designed to assess the amount of foot traffic at a given site and categorize the general demographics of visitors anonymously.”

“We have accepted and implemented all the Privacy Commissioner’s recommendations, with the exception of those that speculate about hypothetical future uses of similar technology. We currently have no plans to use the technologies in question,” the statement read.

It noted that technology was removed when concerns were raised two years ago, adding that the five million images are not of faces.

Ann Cavoukian, former information and privacy commissioner of Ontario, said in an interview it was “outrageous” the company collected images without consent.

“Once your facial image is compromised, you’ve lost it all in terms of being able to use your face to identify yourself,” she said. “I would now want third-party confirmation, an independent auditor to look at all their systems and ensure that they have in fact deleted everything.”

Cavoukian pressed that Cadillac Fairview should extend a sincere apology to all individuals affected. She added the federal government should give Therrien authority to assign penalties.

Download the Yahoo Finance app, available for Apple and Android and sign up for the Yahoo Finance Canada Weekly Brief.