In late July of 2018, an observant shopper at Calgary’s Chinook Centre mall saw an electronic wayfinding directory displaying computer code suggesting that facial recognition technology was being used in the display boards.
Days later, PACC asked the Privacy Commissioner of Canada and the Information and Privacy Commissioner of Alberta to investigate and determine if this use of facial detection/recognition, surveillance, and tracking technologies in retail environments complied with or contravened PIPEDA and PIPA. We also questioned the manner, sufficiency, and timing of notice given to consumers that images of their faces would be captured for analysis, and the opportunity for individuals to provide or withhold meaningful consent.
The shopping center owner, Cadillac Fairview halted the pilot project testing the technology once the Commissioners announced an investigation — after saying it saw no need to obtain consent since it was “not capturing or retaining images” and the “cameras do not record or store any photo or video content.”
On October 28, 2020, the Federal, Alberta, and BC Commissioners jointly issued a report of their findings. The regulators were critical of the way Cadillac Fairview had provided notice to shoppers during the facial detection pilot program, and of how it sought consumers’ consent.
The Commissioners noted that the images of individual faces that had been captured “through the cameras installed on the wayfinding directories are, in and of themselves, clearly personal information.”
In addition, the Commissioners confirmed that Cadillac Fairview had “collected and used personal information, including sensitive biometric information” but that it did not obtain meaningful or “valid consent and notice, for its collection and use of personal information.”
The Commissioners’ decision confirms PACC’s positionthat people’s faces are their personal information; and that obtaining meaningful and informed consent is necessary before applying facial detection or recognition technology. The ruling also supports PACC’s assertions that the momentary capture of facial images does indeed constitute the collection of personal information; and that the length of time a facial image is retained does not dismiss the obligation to obtain meaningful consent beforehand.
We commend Cadillac Fairview for halting its facial recognition pilot project and for having changed signage at mall entrances to provide better notice to the public; and the Commissioners for recommending that Cadillac Fairview ensure it obtains express opt-in consent before employing facial recognition technology or cease its use entirely.
As the voice for privacy and access, the Privacy and Access Council of Canada is a trusted voice for privacy, access, and data protection. PACC is devoted to advancing awareness of Access to Information, Protection of Privacy, Data Protection, and Information Governance, and to promoting ethical and sound practices, policies, and legislation.
