Malls got facial images without consent, watchdog says
5 MILLION SHOPPERS
OTTAWA • Images of five million peoples’ faces were collected through information kiosks in 12 malls across Canada without the knowledge or consent of the shoppers, privacy watchdogs say.
An investigation by the federal, Alberta and B.C. privacy commissioners found commercial real estate firm Cadillac Fairview embedded cameras equipped with facial- recognition technology in the kiosks.
The company told the privacy watchdogs the goal was to analyze the age and gender of shoppers, not to identify individuals.
Cadillac Fairview also said it was not collecting personal information, since the images were briefly analyzed and then deleted.
However, the commissioners said Thursday the company did collect personal information and contravened privacy laws by failing to obtain meaningful consent.
The investigation also found that sensitive biometric information generated from the images was being stored in a centralized database by a third party.
Cadillac Fairview said it was unaware the database of biometric information existed, which compounded the risk of use by unauthorized parties or, in the case of a data breach, by malicious actors, commissioners said.
“Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial- recognition technology, for analysis,” said federal privacy commissioner Daniel Therrien.
“The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity.”
The watchdogs began examining the matter following media reports.
In response to the investigation, the company removed the cameras from its digital directory kiosks, and it has no current plans to reinstall the technology, the privacy commissioners said.
The commissioners added they remain concerned Cadillac Fairview refused their request that it commit to ensuring express, meaningful consent is obtained from shoppers should it choose to use the technology in future.