The facial recognition software installed in the Cadillac Fairview referral directories was called “Anonymous Video Analytics (AVA) and, thanks to cameras installed behind a protective glass, was used in Canadian malls for a brief period. test in 2017, then in July 2018.
The software took temporary digital images of any individual’s faces in the camera’s field of view inside the directory and converted the images into biometric digital representations of each face and used this information to compile demographic information about visitors to the mall.
According to the report, the technology has been used in directories in the following locations:
- CF Market Mall in Alberta
CF Chinook Center in Alberta
CF Richmond Center in British Columbia
CF Pacific Center in British Columbia
CF Polo Park in Manitoba
CF Toronto Eaton Centre en Ontario
CF Sherway Gardens en Ontario
CF Lime Ridge in Ontario
CF Fairview Mall en Ontario
CF Markville Mall en Ontario
CF Galeries d’Anjou in Quebec
CF Carrefour Laval in Quebec
According to a statement by Canada’s Privacy Commissioner Daniel Therrien, the company said the purpose of its cameras was “to analyze the age and gender of buyers, not to identify individuals.” .
The company said it did not collect personal information because the images were briefly reviewed and then deleted, but the information generated from the images was stored by a third-party contractor called Mappedin, which Cadillac Fairview said did not. to know.
“When asked about the purpose of such a collection, Mappedin was unable to provide an answer, indicating that the person responsible for programming the code was no longer working for the company,” it read. in the report.
Therrien notes in his report that Cadillac Fairview’s failure to be aware of the information storage by Mappedin “has compounded the risk of potential use by unauthorized parties or, in the event of a data breach, by malicious actors.
“Buyers had no reason to expect their image to be collected by a discreet camera, or that it would be used, along with facial recognition technology, for analysis,” Therrien said in a statement. . “The lack of meaningful consent was of particular concern given the sensitivity of biometric data, which is a unique and permanent feature of our body and a key to our identity.
The investigation was launched in 2018, following several media reports that information kiosks in shopping malls were fitted with unmarked cameras to monitor visitor demographics. Their review in this case included visiting Cadillac Fairview’s head office in Toronto to interview key personnel, viewing the AVA technology inside the guidance directories in action, and extracting the records from the directories for use. forensic analysis.
The software’s existence emerged after a user posted an image on Reddit of a display screen at CF Chinook Center in Calgary showing an encoding language including “FaceEncoder” and “FaceAnalyzer”.
Commissioner Therrien’s office worked with Alberta Information and Privacy Commissioner Jill Clayton as well as Colombia’s Information and Privacy Commissioner. Briton Michael McEvoy in connection with the investigation.
“Organizations not only need to be clear and straightforward when personal customer information is collected, but they also need to put in place appropriate controls to know what their service providers are doing behind the scenes with that information,” Clayton said in a statement.
The trio of commissioners expressed concern that the company has not accepted their request to commit to ensuring that it obtains meaningful and express consent from buyers in the future if it chooses to redeploy similar technology in the future.
In a statement provided to CTV News, Cadillac Fairview notes that the issue has been resolved, data removed, and cameras disabled. Additionally, facial recognition software is no longer in use, but the company says it will not commit to taking its “hypothetical future uses of similar technology” approach.
“The five million representations mentioned in the OPC report are not faces. These are sequences of numbers that the software uses to anonymously categorize the age range and gender of buyers in camera view, ”the company said. “We thank the Privacy Commissioner for the report and recommendations on how to further strengthen our privacy practices and agree that the privacy of our visitors should always be a top priority.