Vancouver and Richmond malls were among 12 Cadillac Fairview Corporation Limited (CFCL) properties across Canada that used facial recognition technology to collect customer information without their consent.
That’s the primary finding of an investigation by federal, Alberta and B.C. privacy commissioners.
"Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial recognition technology, for analysis," Privacy Commissioner of Canada Daniel Therrien said. "The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity."
B.C. Information and Privacy Commissioner Michael McEvoy said issues around collecting personal information can be complex but the issues in the Cadillac Fairview situation were straightforward: “Pictures of individuals were taken and analyzed in a manner that required notice and consent."
A report released Oct. 29 said the commercial real estate giant embedded cameras inside digital information kiosks at CF Richmond Centre and Vancouver's CF Pacific Centre.
“An individual would not, while using a mall directory, reasonably expect their image to be captured and used to create a biometric representation of their face, which is sensitive personal information, or for that biometric information to be used to guess their approximate age and gender,” the report said.
The company has asserted the goal was to analyze the age and gender of shoppers but not identify them.
Cadillac Fairview also asserted shoppers were made aware of the activity via decals on mall entry doors that referred to its privacy policy. The commissioners called the measure insufficient. Indeed, the notice suggested shoppers visit mall guest services to see the policy, a request that confused services’ staff.
Cadillac Fairview also asserted that it wasn’t collecting personal information as camera images were briefly analyzed, then deleted.
However, the commissioners found Cadillac Fairview did collect personal information, contravening privacy laws by failing to obtain meaningful consent as the company collected the five million images with small, inconspicuous cameras.
The company also used video analytics to collect and analyze sensitive biometric information of customers, the report said.
Cadillac Fairview said it was unaware that the database of biometric information existed. That, the commissioners found, compounded the risk of potential use by unauthorized parties or, in the case of a data breach, malicious actors.
BC Freedom of Information and Privacy Association president Mike Larsen said the decision on the use of such technology – also called anonymous video analytics or AVA – sets an important precedent.
“We are glad that the commissioners jointly rejected the assertion that CFCL had taken reasonable or adequate steps to obtain consent or even notify shoppers that they were subject to biometric surveillance,” Larsen said. “The suggestion that the paltry steps taken by CFCL could have amounted to the provision of ‘valid consent and notice’ is ridiculous.”
Moreover, Larsen said, the case fits a problematic pattern.
“A company adopts and implements a new surveillance technology without completing a proper privacy impact assessment - or even properly understanding its compliance requirements,” he explained. “It violates peoples’ privacy rights, then gets called out for it when the practice is discovered. An investigation ensues, and it finds that the company clearly failed to meet its obligations.
“No fines are issued, because the offices empowered to investigate this sort of thing are not empowered to levy fines,” Larsen said. ”Without fines or penalties, the investigation - while important - lacks the ability to function as a cautionary tale.”
And, while its work was interrupted by the provincial election, a committee was doing a legislative review of the Personal Information Protection Act.
“In our submission to the review committee, we called for amendments that would mandate proactive and meaningful privacy impact assessments and provide the commissioner with fining powers,” Larsen said. “This case underscores the importance of these amendments.”
The commissioners launched their probe after media reports raising questions about Toronto-based Cadillac Fairview's practices. Glacier Media also revealed in September 2019 that Lower Mainland bus stops contained similar cameras.
In response to the investigation, the company removed the cameras from its digital directory kiosks and has no plans to reinstall it. Further, Cadillac Fairview has deleted all information associated with the video analytics technology not required for legal purposes and confirmed it will not retain or use such data for any other purpose.
“This includes the more than five million biometric representations of individual shoppers' faces, which it had retained for no discernable reason,” a commissioners’ joint news release said.
"This investigation exposes how opaque certain personal information business practices have become,” Alberta commissioner Jill Clayton said. "Not only must organizations be clear and up front when customers' personal information is being collected, they must also have proper controls in place to know what their service providers are doing behind the scenes with that information."
The commissioners recommended that if Cadillac Fairview were to use such technology in the future, it should take steps to obtain express, meaningful consent before capturing and analyzing the biometric facial images of shoppers.
The commissioners remain concerned Cadillac Fairview refused their request that it commit to ensuring express, meaningful consent is obtained from shoppers should it choose to redeploy the technology in the future.
Issues around using triangulation of customers’ mobile devices to offer customers deals while using mall WiFi remain a live concern for the commissioners.
@jhainswo
