Ontario’s former privacy commissioner is blasting Cadillac Fairview after the revelation that the mall operating giant recorded 5 million digital images of its shoppers without their consent, as well as the company’s arguments for the practice.
“I was outraged by it, I could not believe that a company like Cadillac Fairview would collect people’s facial images without any notice or consent to the individuals involved?” Ann Cavoukian said. “It’s just unfathomable to me.”
Canada’s Privacy Commissioner said the company violated both federal and privacy laws by installing cameras in kiosks at 12 shopping malls in summer of 2018, as well as briefly in 2017.
The company said the data was being used to develop foot traffic, as well as age and gender demographic data, but not to capture faces or identify anyone.
However, the investigation also found the data “on a decommissioned server, for no apparent purpose and with no justification.” Furthermore, the commission found images were also stored by a third-party - contractor Mappedin - which the company said it was unaware of.
“How could they not know and they expect us just to believe them?” Cavoukian said.
In a statement, Cadillac Fairview notes the images weren’t faces, removed the software two years ago when concerns were first raised and that it takes them very seriously. It makes no mention of third-party involvement.
Cavoukian, Executive Director at Global Privacy & Security by Design Centre, also slams the argument CF made to the commission with regards to consent, that shoppers actually were giving it to them when they agreed to their privacy policy.
“It just baffles me how anyone could be so naive,” she said. “Just by virtue of entering into a mall to buy things, that’s somehow consenting to them doing this, capturing your facial image without your knowledge or consent? It’s absurd.”
The commission also found the argument inadequate.
“An individual would not, while using a mall directory, reasonably expect their image to be captured and used to create a biometric representation of their face, which is sensitive personal information,” the report said.
Michael Byrant with the Canadian Civil Liberties Association said this ultimately comes down to growing revenue.
“They’re not a charity, this isn’t the Red Cross, they’re profiteers,” he told CP24. “But unfortunately, legal to a large degree because most Canadian governments really other than Quebec have not updated our digial privacy laws.
Cavoukian says the company should now be independently audited and certified by privacy groups.