Cadillac Fairview Suspends Facial Recognition at Malls Pending Investigation

Real-estate giant was capturing customers’ age and gender without their knowledge

Cadillac Fairview owns several large malls in Canada, including the Toronto Eaton Centre, shown here in 2011. The company has put a hold on the use of facial recognition cameras in its mall directories at all locations pending investigations. (Svetlana Grechkina/CC BY-SA 2.0)

The real-estate giant that owns and operates some of the largest shopping malls in Canada is suspending its use of facial recognition cameras in its malls pending an investigation.

Cadillac Fairview is halting the use of cameras embedded inside its mall directories after it came to light that facial recognition software was being used at Chinook Centre in Calgary.

The Office of the Privacy Commissioner of Canada (OPC) opened an investigation on Aug. 3 into the company’s use of facial recognition software amid concerns that Cadillac Fairview may be collecting and using personal information without consent. Alberta’s provincial privacy commissioner is also investigating.

Director of media relations Janine Ramparas confirmed in an emailed statement that the company is suspending the use of the cameras pending resolution of the investigation.

“Of course, we will cooperate fully with the Privacy Commissioner throughout this process,” she said.

It was discovered last month that facial recognition software was being used in mall directories at Chinook Centre, the largest shopping centre in Calgary. A browser window had been left open on one of the directories, displaying libraries for analyzing gender and age. A passing visitor snapped a picture of it and posted it to the social news site Reddit.

Cadillac Fairview is putting the practice on hold at all mall locations where it was being used, including Chinook Centre and Market Mall in Calgary, according to news reports.

The federal and provincial investigations will endeavour to ascertain if Cadillac Fairview is violating the federal Personal Information and Electronic Documents Act and/or Alberta’s Personal Information Protection Act, which govern how private sector organizations collect, use, and disclose personal information in the course of commercial business.

The company has stated that it uses the technology to monitor traffic and the age and gender of shoppers, but says it didn’t capture images of individuals and therefore consent isn’t required.

Canadians Unaware of Privacy Rights

Most Canadians are unaware of privacy laws and their rights and responsibilities when it comes to privacy or access to information—regardless of their level of education, social standing, or race, said Privacy and Access Council of Canada president Sharon Polsky.

“It’s a Catch 22,” Polsky explained. “You don’t know your information is being collected or what it’s being used for, so there’s no way (or reason) for you to request that the organization stop collecting your personal information—which is your right under most Canadian privacy laws.”

Moreover, consent often not only allows for companies to collect information from a person, but also about a person from other parties. Information is often shared with affiliates, partners, suppliers, as well as sold to data brokers. There are even privacy policies that only exclude sharing prohibited by law, meaning many uses are not excluded.

Furthermore, consent and purpose are often generally worded in an all-or-nothing fashion.

“You want to do business with us, these are our terms. Agree or go elsewhere. And when everywhere else has the same terms, what choice do you have really,” Polsky said.

Companies often use broad and generalized statements in their terms of service, making it unclear what they are asking permission for or for what purpose they are collecting information. This means people are often consenting to their private information being collected and used in ways they’re unaware of—and wouldn’t consent to if they knew.

The OPC is in the process of updating its guidance on biometrics and facial recognition, to be completed by the end of fiscal year.

Increasing Use of Facial Recognition

The OPC has identified facial recognition as having the potential to be the most highly invasive of the current biometric identifying technologies, according to senior adviser Tobi Cohen.

“What makes biometric data in general so valuable, and so sensitive, is that it is a uniquely measurable characteristic of our body and a key to our identity,” he said.

“Faces have been transformed into electronic information that can be aggregated, analyzed, and categorized in unprecedented ways.”

Facial Recognition aims to identify individuals by comparing their face against a database of known faces and looking for a match, as defined in a 2013 report by the OPC. The technology can be used to either confirm or discover someone’s identity.

Facial recognition is being used increasingly in the retail industry, often without customers’ knowledge. For example, the OPC report identifies the use of facial detection in digital signs to detect the gender, age, and even emotions of passersby to deliver targeted advertising.

While a person in front of a facial recognition scanner may be anonymous, smartphones have a unique MAC address, which can be used to identify the owner.

If a customer directly connects to a store’s Wifi, which is often freely available for this purpose, the phone’s MAC address is now available to the store. Combined with other information, a detailed profile of the consumer can be created or verified.

Wifi tracking in retail spaces is quite common, regardless of whether one even connects to the Wifi. Phones regularly ping out, looking for a Wifi signal, and that can be used to triangulate a customer’s location in a store.