Quis custodiet ipsos custodes?
Shopping centers have always been a great place to escape rainy days, too-hot weather, and boredom. They’re also great places for people watching.
But now it turns out that shopping centers are the ones watching people. And since nobody knew they were being watched, there was no way to agree — or disagree — to being spied upon.
Privacy advocates and security specialists were among countless Canadians surprised to learn that Cadillac Fairview, one of Canada’s pre-eminent commercial land owner-operator-developers, which is itself owned by the owned by the weighty Ontario Teachers’ Pension Plan, had quietly launched a facial recognition pilot project at some of its shopping centers.
For its part, Cadillac Fairview assured that it was not storing “images” or “videos” and that the pilot project launched in June, 2018, was in place only to determine the age and gender of people at some of their malls who used the digital information boards, so there was no need to let anybody know or get their consent.
Others disagree and have gone so far as to characterize that stance as “greasy”.
The revelation generated considerable media attention and public scrutiny of the sort that most organizations would rather avoid.
As the voice of privacy and access in Canada, the Privacy and Access Council of Canada has been called on by CBC, CTV, Global National, CKNW Vancouver, Global News Calgary, The Epoch Times, and other local and national media to provide insight about the privacy implications of facial recognition technology, and to comment on its use — and how easy it is to identify anonymous individuals by combining the results from different sources or tracking technologies. The story also caught the attention of the IAPP, Gizmodo, World News ABC and Yahoo.
In keeping with its mandate to advance awareness about issues relating to Access to Information, Protection of Privacy, Data Protection and Information Governance; to promote ethical and sound privacy, access, and data governance practices, policies, and legislation; and to give voice to issues that affect its members, PACC has been instrumental in increasing awareness about privacy impacts of facial recognition and other new technologies.
The media attention, public response, and the Request for Investigation submitted by the Privacy and Access Council of Canada were no doubt among factors that led to both led to the Alberta and federal Privacy Commissioners launching investigations into the use of facial recognition without consent — and to Cadillac Fairview suspending its facial recognition pilot project pending the outcome of the Commissioners’ investigations.
The investigation results and any guidelines issued by the Commissioners will benefit information privacy and access privacy practitioners, as well as all organizations operating in Canada. Clarifying the landscape will also help to advance technological innovation, and to educate federal, provincial and territorial lawmakers as they consider whether and how to update the country’s access and privacy laws — most of which were drafted in the last century.
Coverage of this issue is also important to help organizations and governments recognize that, despite decades of being told otherwise, people do indeed care about their privacy and the ownership of their own data. They resent being treated as commodities. They distrust organizations that are less than forthcoming about their information handling practices and motives. And they also are increasingly distrustful of politicians who permit passé privacy protections to perpetuate.
Until the laws are changed to reflect data protection, privacy and access realities of the 21st century, organizations in all sectors would be prudent to conduct comprehensive assessments on all contemplated projects, systems, initiatives, and programs to ascertain the impact to privacy — because everything you do has an impact on privacy — and to build in privacy by design and by default as the standard. It’s good for customers, good for reputations, and good for the bottom line.
