Stock Markets
Daily Stock Markets News

Mall real estate company collected 5 million images of shoppers, say privacy

The real estate company behind some of Canada’s most popular shopping centres embedded cameras inside its digital information kiosks at 12 shopping malls in major Canadian cities to collect millions of images — and used facial recognition technology without customers’ knowledge or consent — according to a new investigation by the federal, Alberta and B.C. privacy commissioners.

“Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial recognition technology, for analysis,” said federal Privacy Commissioner Daniel Therrien in a statement.

“The lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity.”

According to the report, the technology Cadillac Fairview used — known as “anonymous video analytics” or AVA— took temporary digital images of the faces of individuals within the field of view of the camera in the directory.

It then used facial recognition software to convert those images into biometric numerical representations of individual faces, about five million images in total.

That sensitive personal information could be used to identify individuals based on their unique facial features, said the commissioners.

The report said the company also kept about 16 hours of video recordings, including some audio, which it had captured during a testing phase at two malls.

Cadillac Fairview said it used AVA technology to assess foot traffic and track shoppers’ ages and genders — but not to identify individuals. 

The company also argued shoppers were made aware of the activity through decals it placed on shopping mall entry doors that warned cameras were being used for “safety and security” and included the web address for Cadillac Fairview’s privacy policy.

This directory in Chinook Centre mall in south Calgary uses facial recognition technology. (Sarah Rieger/CBC)

But the commissioners said that wasn’t good enough and did not meet the standard for meaningful consent. 

“An individual would not, while using a mall directory, reasonably expect their image to be captured and used to create a biometric representation of their face, which is sensitive personal information, or for that biometric information to be used to guess their approximate age and gender,” they wrote.

The privacy watchdogs also took issue with the way the five million images were stored.

Cadillac Fairview said the images taken by camera were briefly analyzed then deleted — but investigators found that the sensitive biometric information generated from the images was being stored in a centralized database by a third-party company,

“Our investigation revealed that [Cadillac Fairview Corporation Limited’s] AVA service provider had collected and stored approximately five million numerical representations of faces on CFCL’s behalf, on a decommissioned server, for no apparent purpose and with no justification,” notes the investigation.

“Cadillac Fairview stated that it was unaware that the database of biometric information existed, which compounded the risk of potential use by unauthorized parties or, in the case of a data breach, by malicious actors.”

Company says technology couldn’t identify people

The company said the technology was used to detect the presence of a human face and assign it “within milliseconds” to an approximate age and gender category and maintains it did not store any images during the pilot program and was not capable of recognizing anyone. 

The decal found on the entrance doors of the CF Toronto Eaton Centre (Office of the Privacy Commissioner report)

“The five million representations referenced in the [Office of the Privacy Commissioner] report are not faces.These are sequences of numbers the software uses to anonymously categorize the age range and gender of shoppers in the camera’s view,” Cadillac Fairview spokesperson Jess Savage said in a statement to CBC News.

“The OPC report concludes there is no evidence that CF was using any technology for the purpose of identifying individuals.”

CF suspended its use of cameras back in 2018 when provincial and federal privacy commissioners launched their probe following a CBC investigation.

In a statement to CBC News on Thursday, the company said it has deleted the data.

“We subsequently deactivated directory cameras and the numerical representations and associated data have since been deleted,” said Savage.

“We take the concerns of our visitors seriously and wanted to ensure they were acknowledged and addressed.”

However, the three commissioners said they have concerns about the company’s plans going forward.

Read More: Mall real estate company collected 5 million images of shoppers, say privacy

Notify of
Inline Feedbacks
View all comments

Get more stuff like this
in your inbox

Subscribe to our mailing list and get interesting stuff and updates to your email inbox.

Thank you for subscribing.

Something went wrong.