On October 29, 2020 the Canadian Office of the Privacy Commissioner (OPC) published a news release finding that commercial real estate company Cadillac Fairview (Cadillac) contravened applicable privacy laws through the use of embedded cameras inside digital information kiosks across twelve Canadian shopping malls to collect images of customers and generate biometric information from the images without the customer's knowledge or consent.

The joint investigation by the OPC and the privacy commissioners of Alberta and British Columbia (collectively, the Commissioners) found that Cadillac collected personal information and contravened privacy laws by failing to obtain meaningful consent from its shoppers since Cadillac:

  • collected five million images with small, inconspicuous cameras inside their digital information kiosks;
  • used video analytics to collect and analyze sensitive biometric information of customers;
  • used facial recognition software to generate additional personal information about individual shoppers, including estimated age and gender; and
  • stored the sensitive biometric data collected and generated in a centralized third party database.

Cadillac said it collected the information to analyze the age and gender of shoppers and not to identify individuals, and that shoppers were made aware of the activity via decals placed at the entrance of the shopping malls that made reference to the company's privacy policy. Further, Cadillac asserted that the information collected was not personal information, since the information was analyzed and then deleted, and that it was not aware the information was being stored in a third party database.

However, the Commissioners found that the notice and consent was insufficient and found that the information did constitute personal information. Further, the Commissioners found that the fact that Cadillac was unaware of the storage of the biometric information compounded the risk of potential use by unauthorized parties, or, in the case of a data breach, by malicious actors.

The investigation stemmed from media reports surrounding Cadillac's practices. Since the investigation, Cadillac has removed the cameras from its digital directory kiosks, deleted all the information associated that is not required for potential litigation purposes, and confirmed that it will not retain or use such data for any other purpose.

Summary By: Hashim Ghazi

E-TIPS® ISSUE

20 11 04

Disclaimer: This Newsletter is intended to provide readers with general information on legal developments in the areas of e-commerce, information technology and intellectual property. It is not intended to be a complete statement of the law, nor is it intended to provide legal advice. No person should act or rely upon the information contained in this newsletter without seeking legal advice.

E-TIPS is a registered trade-mark of Deeth Williams Wall LLP.