National Post (National Edition)
IS YOUR MALL WATCHING YOU?
A shopping centre in Calgary, among others, is using facial recognition software to gather data on customers.
A few lines of computing file pathway on a mall directory screen was the clue: A Calgary mall is using facial recognition software to harvest information from users who come through its doors.
Earlier this week, a Reddit user posted a photo of a browser window — presumably open in error — on one of the directory screens at the Chinook Centre, which suggested the mall was recording information about those who opened the directory.
As it turns out, that’s exactly what it was, and it has privacy advocates concerned about personal information being collected without the knowledge — or consent — of shoppers. Cadillac Fairview, the parent company, said in a statement that “because we are not capturing/storing images, we do not require shopper consent.”
The company, which owns malls across Canada, including Toronto’s Eaton Centre and Ottawa’s Rideau Centre, confirmed that it began testing the technology, which collects “approximate age and gender” and counts the number of people using the directory. Cadillac Fairview said the technology has not been rolled out, but didn’t elaborate on what that means.
Janine Ramparas, the company’s director of corporate communications, declined to say where else the technology was being used — beyond Chinook and the Market Mall, another Calgary mall, saying it’s proprietary information. (The company also declined the Post’s request for an interview, instead sending an emailed statement.)
“The cameras in our directories are there to provide traffic analysis to help us understand usage patterns and continuously create a better shopper experience,” said Ramparas’s email.
Nevertheless, usage of the technology has raised privacy concerns among experts and privacy advocates, though it’s hard to say what the scope of such activities are in Canada. In other areas, though — take Facebook — privacy concerns recently raised major concerns, and led to a corporate bludgeoning, with stock prices reeling over revelations about its use of customers’ data.
Ann Cavoukian, a former Ontario information and privacy commissioner and Ryerson University privacy expert, said she finds it “so unacceptable” that facial recognition is used in malls without telling customers.
“It’s a lose-lose proposition and I think it should be stopped immediately, and at least the consent of the shoppers, the customers entering the mall, (should) be obtained before it’s used,” Cavoukian said.
But, she said, she believes malls “will be reluctant to do it (ask for consent) for the fear of people reacting negatively against it, which they will.”
Sharon Polsky, president of the Privacy and Access Council of Canada and the executive director of the Rocky Mountain Civil Liberties Association, argued that even if the company is not using facial images, it’s gathering personal data points. “If they’re using my face at all ... I’m supposed to be given notice,” Polsky said.
In many cases, Polsky said, it’s unclear what is actually done with personal information. Is it, for example, shared with third parties or advertisers? This, plus that consent isn’t obtained in this specific instance, she said, suggests that privacy legislation — developed when the fax machine was revolutionary technology — needs to be updated and given sharper teeth to control corporate behaviour.
The Office of the Information and Privacy Commissioner of Alberta said use of facial recognition software and consent would fall under its legal jurisdiction, but that it hasn’t yet received any complaints. “The Commissioner is aware of the media reports and is considering how to proceed. Anyone with concerns that their information was collected without consent may submit a privacy complaint to our office and we will investigate,” said a statement from Scott Sibbald, manager of communications.
Recently, Cavoukian said, there has been more and more public concern over privacy, and it’s now at an all-time high. Pew Research polling from 2014 — in the wake of Edward Snowden’s revelations about National Security Agency surveillance — showed that 91 per cent of respondents felt as though they had lost control of how their personal information was collected and used by businesses of all sorts. That, in turn, could translate into respect for privacy being a good business practice, argued Cavoukian.
“I’ve been in this business for well over 20 years, I’ve never seen data in the 90 percentile, relating to concern for privacy,” she said. “I always tell companies who do privacy strongly, ‘Don’t keep it to yourself. Shout it from the rooftops. Gain a competitive advantage by doing this.’ ”