By Moira Warburton
TORONTO (Reuters) - Canadian mall operator Cadillac Fairview illegally collected personal information of 5 million people via cameras installed in its malls, federal and provincial privacy commissioners said on Thursday.
Cadillac Fairview, owned by Ontario Teachers' Pension Plan, used facial recognition technology in 12 malls across Canada without customers' consent, the Office of the Privacy Commissioner of Canada (OPCC) and the privacy commissioners of Alberta and British Columbia provinces said in a statement after a joint investigation.
No financial penalties were handed out but Cadillac has removed cameras from its digital directory kiosks, deleted all information associated with the video analytics technology, and said it will not retain or use such data for any other purpose.
However, the commissioners "remain concerned that Cadillac Fairview refused ... to commit to ensuring express, meaningful consent is obtained from shoppers should it choose to redeploy the technology in the future," the statement said.
Cadillac told the government agencies it was not storing personal information gathered, instead briefly analyzing images using facial recognition software to estimate the age and gender of shoppers and then deleting them.
Although the images were deleted, the OPCC said, sensitive biometric data generated was stored on a centralized database by a third party.
"Cadillac Fairview stated that it was unaware that the database of biometric information existed, which compounded the risk of potential use by unauthorized parties or, in the case of a data breach, by malicious actors," the OPCC said in a statement.
Cadillac said in a statement the information it collected was not identifiable to individuals but agreed that "the privacy of our visitors must always be a top priority."
The company argued that shoppers were made aware by stickers alerting them to the potential analysis of images taken when entering the malls, but the investigation found this was insufficient.
Earlier this year, New York-based Clearview AI stopped offering facial recognition services in Canada after OPCC launched an investigation.