Loading articles...

Cadillac Fairview collected 5M shoppers’ images, biometric data without consent: privacy commissioner

Last Updated Oct 29, 2020 at 1:41 pm EST

The Eaton Centre in Toronto is photographed on March 1, 2018. THE CANADIAN PRESS/Christopher Katsarov

An investigation by the federal, Alberta and British Columbia Privacy Commissioners has found that Cadillac Fairview embedded small, inconspicuous cameras inside digital information kiosks at 12 shopping malls to collect five million images, unbeknownst to customers and without their consent.

Cadillac Fairview is one of North America’s largest commercial real estate companies and owns 73 properties across Canada and the U.S. including several malls in the GTA. The investigation was launched after media reports raised questions about the company’s practices.

A release from the office of Canada’s privacy commissioner Thursday says the investigation also found that facial recognition software was used to estimate the age and gender of individual shoppers from the images collected. They also used video analytics to collect and analyze sensitive biometric information. The images were deleted but such biometric information generated from them was stored in a centralized database by a third party.

Cadillac Fairview said they did not know that the biometric information database existed and the commissioners add this only further increased the risk of unauthorized parties using the information in the case of a data breach by possible “malicious actors.”

The investigation revealed that the technology had been used in malls in Alberta, B.C., Manitoba, Ontario and Quebec.

The company said their goal was only to analyze the age and gender of shoppers and not to specifically identify anyone. They added that their privacy policy was pasted on decals on the shopping mall doors that made customers aware of what they were doing, but the commissioners determined that was not enough.

Cadillac Fairview also said since the photos were only briefly analyzed and deleted, that they were not actually collecting personal information. But the commissioners found that they did in fact collect personal information and breached privacy laws by not getting informed consent from customers.

In response, the company has removed the cameras from their digital directory kiosks and currently does not have any plans to reinstall them. All information related to the video analytics technology was also deleted, except any that was needed for the investigation. They have also confirmed the data will not be retained for any other purpose. The commissioners say this also includes “the five million biometric representations of individual shoppers’ faces, which it had retained for no discernable reason.”

The commissioners have recommended that if Cadillac Fairview uses such technology in the future it must obtain “express, meaningful consent” from customers.

“The Commissioners remain concerned that Cadillac Fairview refused their request that it commit to ensuring express, meaningful consent is obtained from shoppers should it choose to redeploy the technology in the future,” the release said.