Cadillac Fairview Collected Five Million Shopper Images Using Undisclosed Facial Recognition in Canadian Malls

Cadillac Fairview, one of North America's largest owners, operators, and developers of commercial properties, embedded small cameras inside digital directory kiosks at 12 shopping malls across five provinces — Ontario, Quebec, Alberta, British Columbia, and Manitoba (OPC, 2020; CBC News, 2020). These included high-traffic properties such as Toronto's Eaton Centre and CF Carrefour Laval in Laval, Quebec. The cameras captured images of shoppers without their knowledge or consent — over five million numerical facial representations were generated — and facial recognition software analyzed the images to estimate each person's age and gender (OPC, 2020; CBC News, 2020).

A joint investigation by the federal Privacy Commissioner, Alberta's Information and Privacy Commissioner, and British Columbia's Information and Privacy Commissioner — with Quebec's Commission d'accès à l'information collaborating separately — found that Cadillac Fairview violated the Personal Information Protection and Electronic Documents Act (PIPEDA) (OPC, 2020). The investigation revealed that the third-party technology provider Mappedin had retained approximately five million numerical facial representations on a decommissioned server (OPC, 2020). The commissioners found the company had failed to obtain meaningful consent for the collection of sensitive biometric information and had not been transparent about the facial recognition capabilities embedded in the kiosks (OPC, 2020).

The investigation concluded that shoppers had no reasonable expectation that visiting a mall would result in the capture and analysis of their biometric data (OPC, 2020). While mall entrances displayed generic security camera decals stating premises were video-recorded for safety purposes, no signage disclosed the facial recognition or biometric analysis capabilities of the kiosk cameras (OPC, 2020). The commissioners recommended that Cadillac Fairview delete the collected data and obtain express consent before any future use of such technology (OPC, 2020). Cadillac Fairview subsequently confirmed it had deleted the data and removed the cameras, though the commissioners noted that CF refused to commit to obtaining express opt-in consent before any future use of similar technology (OPC, 2020).