Mall real estate company collected 5 million images of shoppers, say privacy

“The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity.”

According to the report, the technology Cadillac Fairview used — known as “anonymous video analytics” or AVA— took temporary digital images of the faces of individuals within the field of view of the camera in the directory.

It then used facial recognition software to convert those images into biometric numerical representations of individual faces, about five million images in total.

That sensitive personal information could be used to identify individuals based on their unique facial features, said the commissioners.

The report said the company also kept about 16 hours of video recordings, including some audio, which it had captured during a testing phase at two malls.

Cadillac Fairview said it used AVA technology to assess foot traffic and track shoppers’ ages and genders — but not to identify individuals. 

The company also argued shoppers were made aware of the activity through decals it placed on shopping mall entry doors that warned cameras were being used for “safety and security” and included the web address for Cadillac Fairview’s privacy policy.

But the commissioners said that wasn’t good enough and did not meet the standard for meaningful consent. 

“An individual would not, while using a mall directory, reasonably expect their image to be captured and used to create a biometric representation of their face, which is sensitive personal information, or for that biometric information to be used to guess their approximate age and gender,” they wrote.

The privacy watchdogs also took issue with the way the five million images were stored.

Cadillac Fairview said the images taken by camera were briefly analyzed then deleted — but investigators found that the sensitive biometric information generated from the images was being stored in a centralized database by a third-party company,

“Our investigation revealed that [Cadillac Fairview Corporation Limited’s] AVA service provider had collected and stored approximately five million numerical representations of faces on CFCL’s behalf, on a decommissioned server, for no apparent purpose and with no justification,” notes the investigation.

“Cadillac Fairview stated that it was unaware that the database of biometric information existed, which compounded the risk of potential use by unauthorized parties or, in the case of a data breach, by malicious actors.”

Company says technology couldn’t identify people

The company said the technology was used to detect the presence of a human face and assign it “within milliseconds” to an approximate age and gender category and maintains it did not store any images during the pilot program and was not capable of recognizing anyone. 

“The five million representations referenced in the [Office of the Privacy Commissioner] report are not faces.These are sequences of numbers the software uses to anonymously categorize the age range and gender of shoppers in the camera’s view,” Cadillac Fairview spokesperson Jess Savage said in a statement to CBC News.

“The OPC report concludes there is no evidence that CF was using any technology for the purpose of identifying individuals.”

CF suspended its use of cameras back in 2018 when provincial and federal privacy commissioners launched their probe following a CBC investigation.

In a statement to CBC News on Thursday, the company said it has deleted the data.

“We subsequently deactivated directory cameras and the numerical representations and associated data have since been deleted,” said Savage.

“We take the concerns of our visitors seriously and wanted to ensure they were acknowledged and addressed.”

However, the three commissioners said they have concerns about the company’s plans going forward.

…