An investigation found that hidden mall cameras in Montreal and Laval violated shoppers' privacy

Mall cameras violated privacy laws The Cadillac Fairview Mall consortium violated Canada's privacy laws when it used cameras to scan shoppers and collect data.

MONTREAL — An investigation has found that the Cadillac Fairview Mall Consortium was using hidden cameras at its malls to scan the faces of shoppers in Montreal and Laval.

The way the data was collected and used violated Canada's privacy laws.

If you walked up to an electronic directory at the Galleries D'Anjou or Carrefour Laval in the summer of 2018, a camera hidden along the ledge may have taken a photo of your face.

That raised some serious alarm bells from the federal privacy commissioner.

"With other video surveillance, it's often for safety or security purposes. We know that cameras are there for that purpose. This went further than that," said Brent Homan, privacy commissioner of Canada.

Within a few seconds, facial recognition software analyzed the photo to determine a shopper's age and gender. The photos were not stored, but the data was for around 5 million shoppers.

"This information was being collected without the informed consent of Canadians," said Homan. "We're talking about sensitive information here. This biometric information it's unique to the individual and it can be a key to someone's identity."

Cadillac Fairview says the data was not used to check the identity of shoppers, but just to assess their age and gender.

"Cadillac Fairview disabled and removed the AVA pilot software more than two years ago, when privacy concerns were first raised by the public." a statement from Cadillac Fairview read. "We subsequently deactivated directory cameras and the numerical representations and associated data have since been deleted. We take the concerns of our visitors seriously and wanted to ensure they were acknowledged and addressed."

Some experts say Canada's privacy law - PEPIDA (The Personal Information Protection and Electronic Documents Act) - doesn't have enough teeth, and Canadians are at risk.

"they've essentially said, 'well here's our report,'" said privacy law specialist Allen Mendelsohn. "Yes, they violated PIPEDA, and there's a list of this section and that section that Cadillac Fairview violated. But that's it. They are not punished for those violations."

Mendelsohn adds that corporations are likely collecting even more information now than Cadillac Fairview did, and Canada's privacy laws need a serious revamping.