Privacy Survey Finds 5 Million Shopper Images Collected From Shopping Malls Across Canada


OTTAWA – Unbeknownst to customers, more than five million images of Canadian shoppers have been collected using facial recognition software used by Cadillac Fairview, a parent company of shopping centers across the country, according to a survey conducted by those responsible for the protection of privacy. The Federal Privacy Commissioner reported Thursday that Cadillac Fairview violated federal and provincial privacy laws by embedding cameras in digital information kiosks at 12 shopping malls across Canada and by capturing user images without their consent.

The facial recognition software installed in the Cadillac Fairview referral directories was called “Anonymous Video Analytics (AVA) and, thanks to cameras installed behind a protective glass, was used in Canadian malls for a brief period. test in 2017, then in July 2018.

The software took temporary digital images of any individual’s faces in the camera’s field of view inside the directory and converted the images into biometric digital representations of each face and used this information to compile demographic information about visitors to the mall.

According to the report, the technology has been used in directories in the following locations:

  • CF Market Mall in Alberta

  • CF Chinook Center in Alberta

  • CF Richmond Center in British Columbia

  • CF Pacific Center in British Columbia

  • CF Polo Park in Manitoba

  • CF Toronto Eaton Centre en Ontario

  • CF Sherway Gardens en Ontario

  • CF Lime Ridge in Ontario

  • CF Fairview Mall en Ontario

  • CF Markville Mall en Ontario

  • CF Galeries d’Anjou in Quebec

  • CF Carrefour Laval in Quebec

According to a statement by Canada’s Privacy Commissioner Daniel Therrien, the company said the purpose of its cameras was “to analyze the age and gender of buyers, not to identify individuals.” .

The company said it did not collect personal information because the images were briefly reviewed and then deleted, but the information generated from the images was stored by a third-party contractor called Mappedin, which Cadillac Fairview said did not. to know.

“When asked about the purpose of such a collection, Mappedin was unable to provide an answer, indicating that the person responsible for programming the code was no longer working for the company,” it read. in the report.

Therrien notes in his report that Cadillac Fairview’s failure to be aware of the information storage by Mappedin “has compounded the risk of potential use by unauthorized parties or, in the event of a data breach, by malicious actors.

Cadillac Fairview – one of the largest owners and operators of retail and other properties in North America – “expressly disagreed” with the findings of the investigation, telling commissioners that there were stickers placed on it. the entrance doors of shopping centers indicating their privacy policy.

These stickers urged visitors to visit customer services for a copy of the company’s privacy policy, but when investigators asked a customer services employee at the Eaton location in Toronto, the employee was “baffled by the request” and therefore Therrien found the stickers to be an “insufficient” measure.

“Buyers had no reason to expect their image to be collected by a discreet camera, or that it would be used, along with facial recognition technology, for analysis,” Therrien said in a statement. . “The lack of meaningful consent was of particular concern given the sensitivity of biometric data, which is a unique and permanent feature of our body and a key to our identity.

The investigation was launched in 2018, following several media reports that information kiosks in shopping malls were fitted with unmarked cameras to monitor visitor demographics. Their review in this case included visiting Cadillac Fairview’s head office in Toronto to interview key personnel, viewing the AVA technology inside the guidance directories in action, and extracting the records from the directories for use. forensic analysis.

The software’s existence emerged after a user posted an image on Reddit of a display screen at CF Chinook Center in Calgary showing an encoding language including “FaceEncoder” and “FaceAnalyzer”.

Commissioner Therrien’s office worked with Alberta Information and Privacy Commissioner Jill Clayton as well as Colombia’s Information and Privacy Commissioner. Briton Michael McEvoy in connection with the investigation.

“Organizations not only need to be clear and straightforward when personal customer information is collected, but they also need to put in place appropriate controls to know what their service providers are doing behind the scenes with that information,” Clayton said in a statement.

The trio of commissioners expressed concern that the company has not accepted their request to commit to ensuring that it obtains meaningful and express consent from buyers in the future if it chooses to redeploy similar technology in the future.

In a statement provided to CTV News, Cadillac Fairview notes that the issue has been resolved, data removed, and cameras disabled. Additionally, facial recognition software is no longer in use, but the company says it will not commit to taking its “hypothetical future uses of similar technology” approach.

“The five million representations mentioned in the OPC report are not faces. These are sequences of numbers that the software uses to anonymously categorize the age range and gender of buyers in camera view, ”the company said. “We thank the Privacy Commissioner for the report and recommendations on how to further strengthen our privacy practices and agree that the privacy of our visitors should always be a top priority.


Please enter your comment!
Please enter your name here