An investigation by Canada’s privacy officials has found that a real estate management company has surreptitiously collected five million images of unsuspecting customers at shopping malls across the country, raising serious concerns about the use of facial recognition technology.
Privacy Commissioner of Canada Daniel Therrien reported Thursday that Cadillac Fairview contravened federal and provincial privacy laws by embedding cameras inside digital information kiosks at 12 shopping malls across Canada, and captured users’ images without their consent.
The goal, the company said, was to analyze the age and gender of shoppers and not to identify individuals.
Cadillac Fairview also asserted that shoppers were made aware of the activity via decals it had placed on shopping mall entry doors that referred to their privacy policy – a measure the commissioners determined was insufficient.
The investigation also found that while the images were deleted, the sensitive biometric information generated from the images was being stored in a centralized database by a third party.
In addition, Cadillac Fairview stated that it was unaware that the database of biometric information existed, which compounded the risk of potential use by unauthorized parties or, in the case of a data breach, by malicious actors, the report by privacy commissioners said.
“Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial recognition technology, for analysis,” Therrien said in a statement.
“The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity.”
Jill Clayton, Information and Privacy Commissioner of Alberta, said the investigation has exposed how opaque certain personal information business practices have become.
“Not only must organizations be clear and up front when customers’ personal information is being collected, they must also have proper controls in place to know what their service providers are doing behind the scenes with that information,” Clayton said.
In a statement released Thursday, Cadillac Fairview said the AVA (Anonymous Video Analytics) technology was briefly used at select Cadillac Fairview properties in July 2018.
“Cadillac Fairview disabled and removed the AVA pilot software more than two years ago, when privacy concerns were first raised by the public,” the company said in a statement.
“We subsequently deactivated directory cameras and the numerical representations and associated data have since been deleted. We take the concerns of our visitors seriously and wanted to ensure they were acknowledged and addressed.”
For reasons beyond our control, and for an undetermined period of time, our comment section is now closed. However, our social networks remain open to your contributions.