Skip to main content
Open this photo in gallery:

People walk through the Eaton Centre shopping mall in Toronto on June 24, 2020.Carlos Osorio/Reuters

Five million images of peoples' faces were collected through digital information kiosks in 12 malls across Canada without the knowledge or consent of the shoppers, privacy watchdogs say.

An investigation by the federal, Alberta and B.C. privacy commissioners found commercial real estate firm Cadillac Fairview embedded small cameras equipped with facial-recognition technology in the kiosks.

The company told the privacy watchdogs the goal was to analyze the age and gender of shoppers, not to identify individuals.

Cadillac Fairview also said it was not collecting personal information, since the images were briefly analyzed and then deleted.

However, the commissioners said Thursday the company did collect personal data in mid-2018 and contravened privacy laws by failing to obtain meaningful consent.

The investigation also found that sensitive biometric information generated from the images was being stored in a centralized database by a third party.

Cadillac Fairview was unaware the database of biometric information existed, which compounded the risk of use by unauthorized parties or, in the case of a data breach, by malicious actors, the commissioners concluded.

“Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial-recognition technology, for analysis,” federal Privacy Commissioner Daniel Therrien said.

“The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity.”

Cadillac Fairview also retained about 16 hours of video recordings, some including audio, which it had captured during a test of the technology at two malls.

The commissioners uncovered no evidence the information gathered was used for identification purposes.

The company said any consent required was obtained through its privacy policy, a position the commissioners rejected.

The language in the policy was overly broad and buried in the middle of a 5,000-word document, which would not be easily accessible to shoppers while they are engaging with a mall directory, the investigation report said.

The commissioners also said that while shoppers were directed, by stickers displayed at mall entrances, to visit guest services to obtain a copy of Cadillac Fairview’s privacy policy, when the watchdogs asked an employee at one of the malls for that policy, they were confused by the request.

The commissioners began examining the matter after media reports.

In response to the investigation, the company removed the cameras from its digital directory kiosks, and it has no current plans to reinstall the technology, the watchdogs said.

The commissioners added, however, they remain concerned that Cadillac Fairview refused their request that it commit to ensuring express, meaningful consent is obtained from shoppers should it choose to use the technology in future.

The findings “raise a red flag regarding the lack of transparency and accountability for uses of such technologies,” said Brenda McPhail of the Canadian Civil Liberties Association.

The case also supports the association’s call to for a moratorium on facial surveillance technologies until there is an open debate about how uses align with public values and privacy rights, she added.

Your time is valuable. Have the Top Business Headlines newsletter conveniently delivered to your inbox in the morning or evening. Sign up today.

Follow related authors and topics

Authors and topics you follow will be added to your personal news feed in Following.

Interact with The Globe