CF Richmond Centre embedded tiny, inconspicuous cameras inside digital information kiosks to capture images of shoppers without their knowledge or consent, a Canada-wide investigation of Cadillac Fairview malls has found.
In total, Cadillac Fairview – a Toronto-based real estate company that owns and operates 23 malls across the country – collected five million shoppers’ images, and analyzed sensitive biometric data using “anonymous video analytics” (AVA), according to the privacy commissioners of Canada, B.C. and Alberta.
The cameras were at CF Richmond Centre – where they captured images of 475,300 shoppers – as well as CF Pacific Centre in downtown Vancouver and 10 of its other malls in Canada, states the commissioners’ investigation report.
And while the company has removed the cameras, it hasn’t promised to not do it again, nor has it been fined.
The commissioners say they “remain concerned” that CF refused their request to ensure that express, meaningful consent – for example, an opt-in option – is obtained from shoppers, in the event the company chooses to use the technology again.
“It has to be transparent and public and be upfront, when you put a hidden camera in the kiosk” said Kenny Chiu, MP for Steveston-Richmond East.
“No customer requiring services at that directory, would expect that his or her images would be captured, let alone be retained and tracked. So it’s just sneaky for the system to do that.”
In a statement, the company said it accepted and implemented all the commissioners’ recommendations, “with the exception of those that speculate about hypothetical future uses of similar technology.”
The company said the AVA software was a pilot – designed to anonymously analyze foot traffic at the malls, as well as the age and gender of shoppers – and was stopped in 2018 when privacy concerns were first raised by the public.
CF also told the privacy commissioners that it was not collecting personal information, since the images taken by the cameras were “briefly analyzed, then deleted.”
However, each image was converted into a unique numeric code, according to the investigation report, which could be used to identify individuals based on their facial features. This biometric data is intrinsically, and usually permanently, linked to each individual.
Furthermore, the images were stored in a centralized database by a third party, which CF said it was “unaware” existed – which elevated the risk that the data could be used by unauthorized parties.
By collecting personal information and failing to obtain meaningful consent, CF contravened privacy laws – something that was of particular concern given the sensitivity of biometric data, according to the report.
Vito Pilieci, senior communications advisor with the federal privacy commissioner’s office, told the Richmond News that the concern is CF could simply restart this practice – or a similar one – and the commissioner would then either have to go to court or launch a new investigation.
This illustrates the need to change Canada’s privacy laws – which the federal privacy commissioner, Daniel Therrien, has been calling for – Pilieci added.
In a report issued in December 2019, Therrien said the law should “truly and firmly put an end to self-regulation” in the private sector, and should incorporate a rights-based framework, so that people aren’t “left alone” when interacting with businesses.
He also said that legislation should not only put rules in place around consent, transparency and access, but also define privacy in a broad sense, for example, as “freedom from unjustified surveillance.”
“Our current privacy laws are drafted largely as data protection statutes rather than as laws that protect and promote the exercise of a broad range of rights,” the report reads.
The law should also be able to keep up with technological changes.
“Privacy legislation should allow for responsible innovation that serves the public interest and is likely to foster trust, but prohibit using technology in ways that are incompatible with rights and values,” said Pilieci.
However, merely adopting “adequate” legislation isn’t enough, he added, explaining that laws need to be enforced “through quick and effective mechanisms,” for example, giving regulatory authorities the power to issue orders and impose monetary fines.
Chiu, MP for Steveston-Richmond East, agreed that changes need to be made to Canada’s privacy laws as new technologies emerge.
“There are countries around the world that are exploiting this advanced technology to the point that it’s actually getting very scary. Imagine if you could actually not only identify the person as an individual, but…gain access to all (their) records, what he or she buys, what number he or she calls,” he said.
Chiu pointed to Article 13 of the European Union’s General Data Protection Regulation, which states, for example, that when people’s personal data is collected, they should be provided with contact information for the “controller” of the data, reasons why the data is being collected, and a copy of the data if they request it.
The investigation found that the AVA technology was used in the following CF malls across Canada:
- CF Richmond Centre (British Columbia)
- CF Pacific Centre (British Columbia)
- CF Market Mall (Alberta)
- CF Chinook Centre (Alberta)
- CF Polo Park (Manitoba)
- CF Galeries d’Anjou (Quebec)
- CF Carrefour Laval (Quebec)
- CF Toronto Eaton Centre (Ontario)
- CF Sherway Gardens (Ontario)
- CF Lime Ridge (Ontario)
- CF Fairview Mall (Ontario)
- CF Markville Mall (Ontario)
