On October 29, 2020 the Canadian Office of the Privacy Commissioner (OPC) published a news release finding that commercial real estate company Cadillac Fairview (Cadillac) contravened applicable privacy laws through the use of embedded cameras inside digital information kiosks across twelve Canadian shopping malls to collect images of customers and generate biometric information from the images without the customer's knowledge or consent.
The joint investigation by the OPC and the privacy commissioners of Alberta and British Columbia (collectively, the Commissioners) found that Cadillac collected personal information and contravened privacy laws by failing to obtain meaningful consent from its shoppers since Cadillac:
However, the Commissioners found that the notice and consent was insufficient and found that the information did constitute personal information. Further, the Commissioners found that the fact that Cadillac was unaware of the storage of the biometric information compounded the risk of potential use by unauthorized parties, or, in the case of a data breach, by malicious actors.
The investigation stemmed from media reports surrounding Cadillac's practices. Since the investigation, Cadillac has removed the cameras from its digital directory kiosks, deleted all the information associated that is not required for potential litigation purposes, and confirmed that it will not retain or use such data for any other purpose.
Summary By: Hashim Ghazi
Disclaimer: This Newsletter is intended to provide readers with general information on legal developments in the areas of e-commerce, information technology and intellectual property. It is not intended to be a complete statement of the law, nor is it intended to provide legal advice. No person should act or rely upon the information contained in this newsletter without seeking legal advice.
E-TIPS is a registered trade-mark of Deeth Williams Wall LLP.