OTTAWA — Five million images of peoples' faces were collected through digital information kiosks in 12 malls across Canada without the knowledge or consent of the shoppers, privacy watchdogs say.
An investigation by the federal, Alberta and B.C. privacy commissioners found commercial real estate firm Cadillac Fairview embedded small cameras equipped with facial-recognition technology in the kiosks.
The company told the privacy watchdogs the goal was to analyze the age and gender of shoppers, not to identify individuals.
Cadillac Fairview also said it was not collecting personal information, since the images were briefly analyzed and then deleted.
However, the commissioners said Thursday the company did collect personal data in mid-2018 and contravened privacy laws by failing to obtain meaningful consent.
The investigation also found that sensitive biometric information generated from the images was being stored in a centralized database by a third party.
Cadillac Fairview was unaware the database of biometric information existed, which compounded the risk of use by unauthorized parties or, in the case of a data breach, by malicious actors, the commissioners concluded.
“Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial-recognition technology, for analysis,” said federal privacy commissioner Daniel Therrien.
"The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity."
Cadillac Fairview also retained about 16 hours of video recordings, some including audio, which it had captured during a test of the technology at two malls.
The commissioners uncovered no evidence the information gathered was used for identification purposes.
The company said any consent required was obtained via its privacy policy, a position the commissioners rejected.
The language in the policy was overly broad and buried in the middle of a 5,000-word document, which would not be easily accessible to shoppers while they are engaging with a mall directory, the investigation report said.
The commissioners also noted that while shoppers were directed, by stickers displayed at mall entrances, to visit guest services to obtain a copy of Cadillac Fairview's privacy policy, when the watchdogs asked an employee at one of the malls for that policy, they were confused by the request.
The commissioners began examining the matter following media reports.
In response to the investigation, the company removed the cameras from its digital directory kiosks, and it has no current plans to reinstall the technology, the watchdogs said.
The commissioners added, however, they remain concerned that Cadillac Fairview refused their request that it commit to ensuring express, meaningful consent is obtained from shoppers should it choose to use the technology in future.
The findings "raise a red flag regarding the lack of transparency and accountability for uses of such technologies," said Brenda McPhail of the Canadian Civil Liberties Association.
The case also supports the association's call to for a moratorium on facial surveillance technologies until there is an open debate about how uses align with public values and privacy rights, she added.
This report by The Canadian Press was first published Oct. 29, 2020.
Jim Bronskill, The Canadian Press