The Office of the Privacy Commissioner of Canada says it has discovered that Cadillac Fairview, a commercial real estate company, collected and analyzed five million shopper’s images without their knowledge or consent using an Anonymous Video Analytics (AVA) tool.
According to the investigation findings, Cadillac Fairview embedded cameras inside their digital information kiosks at 12 Canadian shopping malls to capture shoppers’ images. The company claimed that the purpose was not to identify individuals but to analyze shoppers’ age and gender.
The company said it had placed decals on shopping mall entrances that explained their privacy policy.
“Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial recognition technology, for analysis,” wrote Privacy Commissioner of Canada Daniel Therrien. “The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity.”
The investigation “exposes how opaque certain personal information business practices have become,” added Jill Clayton, Information and Privacy Commissioner of Alberta, in a statement. “Not only must organizations be clear and upfront when customers’ personal information is being collected, they must also have proper controls in place to know what their service providers are doing behind the scenes with that information.”
Cadillac Fairview insisted that images were deleted after analysis, but the investigation found that numeric representations of images were stored in a centralized database by a third party, which Cadillac Fairview denied any knowledge of. The investigation concluded that the lack of knowledge compounded the risk of these data being stolen by unauthorized parties.
Following the investigation, Cadillac Fairview removed all cameras from their directory kiosks and deleted the five million biometric representations of the images they captured. The company says it has no plans on reinstalling these cameras, which the privacy commissioner noted it had no “discernable reason” to store.