Images of Calgary shoppers collected without consent at kiosks in 2 local malls

Malls under fire for breaching shopper privacy Cadillac Fairview is under investigation after millions of shoppers had their images collected without consent. Ina Sidhu reports.

Calgary — The images of five million Canadian shoppers were collected without their consent at 12 malls across the country, including CF Market Mall and CF Chinook Centre in Calgary, according to an investigation by the Alberta, British Columbia and federal privacy commissioners.

"There’s no question in our mind, we were absolutely united on the finding that there is personal information at issue here," said Jill Clayton, Information and Privacy Commissioner of Alberta.

The privacy commissioner found Cadillac Fairview, the parent company of malls across Canada, embedded cameras inside digital information kiosks and captured images of mall patrons without their knowledge.

The investigation was launched in 2018 after media reports about information kiosks in malls having unmarked cameras to monitor visitor demographics.

"Personal information about them was being collected a digital image, if only for milliseconds, and that was being converted to a numerical representation," said Clayton. "Individuals wouldn't have known that that was happening and they wouldn't have had an opportunity to consent to that."

The privacy commissioner said the facial recognition software generated personal information about individual shoppers such as estimated age and gender. Investigators determined the images were being deleted but sensitive biometric information generated from the images was being stored in a centralized database by a third party.

Clayton said the information was stored on a decommissioned server that could potentially be reactivated.

"Part of the concern is that's a vast trove of sensitive information and that as we pointed out in the report, that's potentially a risk what if there had been a breach of some kind so we were quite pleased that the organization was amenable to our recommendation to delete that information."

The corporation told the investigators there were decals placed on shopping mall entry doors noting their privacy policy, but that was found to be an "insufficient" measure.

In a statement, Cadillac Fairview said the Anonymous Video Analytics (AVA) technology was briefly conducted at select CF properties in July 2018 to assess the amount of foot traffic at a given site and categorize the general demographics of visitors anonymously.

Cadillac Fairview issued the following statement, which reads in part:

"Cadillac Fairview disabled and removed the AVA pilot software more than two years ago, when privacy concerns were first raised by the public. We subsequently deactivated directory cameras and the numerical representations and associated data have since been deleted.  We take the concerns of our visitors seriously and wanted to ensure they were acknowledged and addressed.

"The AVA software in our digital directories was being used exclusively to detect the presence of a human face and, within milliseconds, assign the face to an approximate age and gender category. It did not store any images during the pilot program, and it was not capable of recognizing anyone.

"The five million representations referenced in the OPC report are not faces. These are sequences of numbers the software uses to anonymously categorize the age range and gender of shoppers in the camera’s view. If the same shopper crossed the camera’s view again, a new string of numbers would be generated.”

Cadillac Fairview said it has no plans to reintroduce the technology and says it's committed to protecting the privacy of visitors.

Clayton said if malls utilize this type of technology in the future it must be done in compliance with privacy laws that require consent and an option to opt-out.