Millions of mall visitor photos secretly collected, probe finds

Facial recognition technology broke privacy laws, watchdog says Cadillac Fairview says stored data never identified individuals

Cadillac Fairview broke Canadian privacy vv laws after the company installed f facial recognition technology inside a dozen malls and analyzed visitors’ images a without obtaining proper consent, f federal and provincial privacy commissioners announced Thursday.

Toronto’s Eaton Centre, Sherway Gardens and Fairview Mall all used the software. Markville Mall in Markham, Lime Ridge in Hamilton, and seven others in four other provinces did as well.

Cameras embedded in wayfinding directories — the digital touch- screen maps that help visitors navigate malls — captured images of faces within the camera’s field of view, and converted them into a “biometric numerical representation” of each individual. That information was used to assess individuals’ ages and genders, and to monitor foot traffic.

While the privacy commissioners found ff the company had contravened legislation designed to protect Canadians’ personal information, experts and politicians noted that these regulators wield ww little in the way of enforcement powers.

“They should be facing fines,” said New Democrat MP Charlie Angus, a member of the House of Commons standing committee on access to information, privacy and ethics.

“I’m really hoping that parliament will get serious about the threat posed by facial recognition technology and lay down some rules before it is too late and the abuse of this technology becomes ubiquitous.”

The investigators did not find evidence that the technology, known as Anonymous Video Analytics, was used to identify individuals, according to a joint report released Thursday by the federal, British Columbia and Alberta commissioners’ offices.

But while Cadillac Fairview maintained that these “numerical representations” were not stored after use, the privacy investigators found that Anonymous Video Analytics kept five million of these facial representations on a decommissioned server on the company’s behalf, “for no apparent purpose and with no justification.”

It also stored 16 hours of video, including some audio captured during a “testing phase” at two Toronto malls, the Eaton Centre and Sherway Gardens. The images and video have since been deleted.

In a statement, Cadillac Fairview described the technology as a “beta test” that was “briefly conducted” at some locations, and noted the report “found no evidence that the company was using the technology for the purposes of identifying individuals.”

The company disabled and removed the software more than two years ago, “when concerns were first raised by the public,” the statement said, adding “we take the concerns of our visitors seriously and wanted to ensure they were acknowledged and addressed.”

“We thank the privacy commissioner for the report and recommendations on how to further strengthen our privacy practices and agree that the privacy of our visitors must always be a top priority.”

Questions about the use of facial recognition technology in Cadillac Fairview’s malls first surfaced in 2018 after a user on Reddit, a popular online forum, posted a picture of a malfunctioning wayfinding screen at Calgary’s Chinook Centre. The screen displayed lines of code that appeared to reference facial recognition programs.

Following media reports, the federal, B.C. and Alberta privacy commissioners’ offices opened a joint investigation.

The investigators found the privacy complaints “wellfounded,” and considered the case “resolved” after the company stopped using the technology, deleted the stored numerical facial representations and video, and provided privacy training for its guest services employees.

But the report notes Cadillac Fairview “expressly disagreed” with the findings of the privacy commissioners’ offices, and refused to commit to obtaining express, opt-in consent if it decides to use similar technology in the future — a position they called “concerning.”

“This case also raises a big red flag regarding the need for stronger privacy laws with some teeth,” said Brenda McPhail, director of the Privacy, Technology & Surveillance Project at the Canadian Civil

Liberties Association (CCLA).

The federal privacy commissioner does not have the power to levy fines against individuals or corporations who contravene Canada’s privacy legislation. Last year, Facebook refused to acknowledge or comply with the office’s findings that it had violated Canadian users’ privacy by allowing apps to access personal information and share it with companies involved in U.S. political campaigns, including Cambridge Analytica. Lacking enforcement powers of its own, the commissioner’s office asked a federal court for an order prohibiting Facebook from breaking privacy laws again. The CCLA and NDP MP Angus have both called for a moratorium on facial recognition technology until better regulatory protections are established. “I think that the technology is being used and abused in many areas and jurisdictions,” Angus said, noting the example of Clearview AI.

A February Star investigation showed Clearview AI’s controversial facial recognition technology had been used by Rexall and other private companies, in addition to several law enforcement agencies across Canada.

In July, amid a privacy commissioner investigation into their practices, the company pulled out of Canada.

“We have a right to be able to go in public places without being photographed, tracked, put into data surveillance machines, whether it’s for corporations or for police and government,” Angus said.

The report concludes that the Cadillac Fairview’s practice of obtaining consent was insufficient. A sticker displayed on doors at the mall’s entrance directed shoppers to obtain a copy of the privacy policy at the guest services kiosk. But investigators found the relevant information was buried in the middle of the 5,000-page document, was described in overly broad language, and when investigators asked for a copy at the Eaton Centre kiosk, they were met with confusion.

“An individual would not, while using a mall directory, reasonably expect their image to be captured and used to create a biometric representation of their face, which is sensitive personal information, or for that biometric information to be used to guess their approximate age and gender,” the report notes.

“This case also raises a big red flag regarding the need for stronger privacy laws with some teeth.”

BRENDA MCPHAIL CANADIAN CIVIL LIBERTIES ASSOCIATION