An investigation into Cadillac Fairview’s use of facial recognition technology at a dozen Canadian malls found the real estate company collected the images of five million unsuspecting shoppers from across the country.
The results of the investigation, conducted by the federal, Alberta and B.C. privacy commissioners, were released on Thursday.
According to the report, the company embedded small, inconspicuous cameras inside their mall directories at 12 Canadian malls (two in Alberta, two in B.C., one in Manitoba, five in Ontario and two in Quebec) which collected images of customers without their knowledge or consent.
Cadillac Fairview said it was using facial recognition technology to determine the age and gender of shoppers, and that images taken by the cameras were analyzed briefly before being deleted.
It argued that shoppers were made aware of the activity through decals placed on the doors to enter the shopping malls, but the commissioners determined that wasn’t enough to obtain meaningful consent.
“Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial recognition technology, for analysis,” privacy commissioner of Canada Daniel Therrien said.
“Questions about when an organization is collecting personal information can be complex, but the conclusion we came to about cameras in mall directories was straight-forward,” B.C. information and privacy commissioner Michael McEvoy said.
“Pictures of individuals were taken and analyzed in a manner that required notice and consent.”
Though Cadillac Fairview said the images weren’t kept on file, investigators found the sensitive biometric information generated from the images was being stored in a centralized database by a third party.
“Cadillac Fairview stated that it was unaware that the database of biometric information existed, which compounded the risk of potential use by unauthorized parties or, in the case of a data breach, by malicious actors,” a news release stated.
Cadillac Fairview is one of North America’s largest commercial real estate companies with 69 properties in Canada including Toronto-Dominion Centre, CF Toronto Eaton Centre, CF Pacific Centre, CF Chinook Centre, Tour Deloitte and CF Carrefour Laval.
The investigation was launched after the use of the facial recognition software came first came to light in 2018.
Since then, Cadillac Fairview removed the cameras from its digital directory kiosks and said it has no plans currently to reinstall the technology.
It has also deleted all information associated with the cameras that is not required for legal purposes.
The three privacy commissioners recommended that if Cadillac Fairview were to use the technology again, it needs to put more effort into obtaining shoppers’ consent before capturing and analyzing their images.
“This investigation exposes how opaque certain personal information business practices have become,” Alberta information and privacy commissioner Jill Clayton said.
“Not only must organizations be clear and up front when customers’ personal information is being collected, they must also have proper controls in place to know what their service providers are doing behind the scenes with that information.”
In a news release, the commissioners said they “remain concerned” that Cadillac Fairview “refused” their request to “commit to ensuring express, meaningful consent is obtained from shoppers should it choose to redeploy the technology in the future.”
In a statement sent to Global News via email, Cadillac Fairview confirmed it accepted and implemented all the recommendations from the investigation with the exception of those that speculate about hypothetical future uses of similar technology.
“We currently have no plans to use the technologies in question,” the company said.
It went on to say the images collected of shoppers referenced in the report “are not faces.”
“These are sequences of numbers the software uses to anonymously categorize the age range and gender of shoppers in the camera’s view. If the same shopper crossed the camera’s view again, a new string of numbers would be generated.
“We want to reiterate that we take the concerns of our visitors seriously and are committed to protecting our visitors’ privacy.”
Cybersecurity expert Karen Macdonald said any photo is considered identifiable information, and can identify people using that image.
“You can do a reverse image search, you can find people based on any other information that might go along with it,” she said. “It might be an email address, any kind of location data from a phone.”
Macdonald said most people don’t look at privacy policies like the ones CF said were posted on doors of the malls in question, because they’re hard to read.
The malls where the technology was used were:
- CF Market Mall in Calgary
- CF Chinook Centre in Calgary
- CF Richmond Centre in Richmond
- CF Pacific Centre in Vancouver
- CF Polo Park in Winnipeg
- CF Toronto Eaton Centre in Toronto
- CF Sherway Gardens in Toronto
- CF Fairview Mall in Toronto
- CF Lime Ridge in Hamilton
- CF Markville Mall in Markham
- CF Galeries d’Anjou in Montreal
- CF Carrefour Laval in Laval
With files from Jenna Freeman