“Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial recognition technology, for analysis,” said federal Privacy Commissioner Daniel Therrien in a statement.
“The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity.”
- Read the report here
- At least two malls are using facial recognition technology to track shoppers’ ages and genders without telling
But the commissioners said that wasn’t good enough.
The privacy watchdogs also found that Cadillac Fairview contravened privacy laws by failing to “obtain meaningful consent” when it collected five million images with inconspicuous cameras.
Cadillac Fairview also used video analytics to collect and analyze sensitive biometric information of customers, investigators said.
Company says technology couldn’t identify people
The watchdogs said the facial recognition software was used to generate additional personal information about individual shoppers, including estimated ages and genders. The images were subsequently deleted — but investigators found that the sensitive biometric information generated from the images was being stored in a centralized database by a third party.
“Cadillac Fairview stated that it was unaware that the database of biometric information existed, which compounded the risk of potential use by unauthorized parties or, in the case of a data breach, by malicious actors,” said the investigation report.
Cadillac Fairview spokesperson Jess Savage said the AVA technology did not store any images during the pilot program and was not capable of recognizing anyone.
“The five million representations referenced in the [Office of the Privacy Commissioner] report are not faces.These are sequences of numbers the software uses to anonymously categorize the age range and gender of shoppers in the camera’s view,” she said in a statement to CBC News.
“The OPC report concludes there is no evidence that CF was using any technology for the purpose of identifying individuals.”
CF suspended its use of cameras back in 2018 when provincial and federal privacy commissioners launched their probe following a CBC investigation.
In a statement to CBC News on Thursday, the company said it has no plans to reinstall the cameras.
“We subsequently deactivated directory cameras and the numerical representations and associated data have since been deleted,” said Savage.
“We take the concerns of our visitors seriously and wanted to ensure they were acknowledged and addressed.”
However, the three commissioners said they have concerns about the company’s plans going forward.
- Cellphone tracking has been used in at least 1 Canadian mall, former employee says
- Company suspends use of mall directory cameras running facial recognition software
“The commissioners remain concerned that Cadillac Fairview refused their request that it commit to ensuring express, meaningful consent is obtained from shoppers should it choose to redeploy the technology in the future,” said the commissioners’ statement.
Savage said Cadillac Fairview accepted and implemented all the recommendations “with the exception of those that speculate about hypothetical future uses of similar technology.”
The investigation found the technology was used in five provinces at the following malls:
- CF Market Mall (Alberta)
- CF Chinook Centre (Alberta)
- CF Richmond Centre (British Columbia)
- CF Pacific Centre (British Columbia)
- CF Polo Park (Manitoba)
- CF Toronto Eaton Centre (Ontario)
- CF Sherway Gardens (Ontario)
- CF Lime Ridge (Ontario)
- CF Fairview Mall (Ontario)
- CF Markville Mall (Ontario)
- CF Galeries d’Anjou (Quebec)
- CF Carrefour Laval (Quebec)
With files from Thomas Daigle
Credit belongs to : www.cbc.ca