This article was originally published by The Lawyer’s Daily (www.thelawyersdaily.ca), part of LexisNexis Canada Inc.

It is a common occurrence to see people checking the directory in a mall to get the location of the most popular stores. But what is less well known is that some malls have begun using those directories to identify shoppers’ age and gender, and legal analysts are noting they are walking a tightrope in ensuring those scans are not violating people’s privacy.

Late last month, a steely-eyed shopper at Calgary’s Chinook Centre posted a photo to social networking site Reddit that showed facial-recognition software running in the background. At the time, mall owner Cadillac Fairview said the mall does not record or store any of the content and that getting consent is not required as they are not capturing or retaining images.

But on Aug. 3, the Office of the Privacy Commissioner of Canada and Alberta’s Information and Privacy Commissioner both announced they were opening investigations into Cadillac Fairview’s use of the technology. The federal investigation will examine whether the practices are in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA), and the Alberta commissioner’s investigation will determine what types of personal information are being collected, whether the data is being shared with third parties and what safeguards or security measures are in place to protect personal information.

As a result of the investigations, Cadillac Fairview announced it was suspending use of the technology pending resolution of the matter. Janine Rampiras, director of corporate communications for Cadillac Fairview, said the company will co-operate with the investigations and will not provide further comment.

But no consensus has emerged on what the ultimate outcome of the investigations could be. Brian Vail, who practises technology and privacy law at Field Law in Edmonton, noted the provincial Personal Information and Privacy Act (PIPA) applies to all private enterprise in Alberta, and deals with the collection, use or disclosure of personal information, which is defined as information about an identifiable individual. He said, if the software makes an individual identifiable, then it is caught by PIPA and therefore would require people’s consent.

“But I tend think it’s not identifiable information as long as they are just using it in the way they say,” he said. “But if they store it, even for a short period of time, then I think they’re storing a personal record of information. Then if that’s the case the Act applies.”

Vail noted the mall representatives “aren’t even pretending to get any kind of consent.”

“So the issue then is whether a reasonable person would consider this appropriate in the circumstances,” he said. “The fact that somebody who saw it actually put it on social media would suggest somebody was unhappy about it.”

Vail’s Field Law colleague Marc Yu said the basic privacy principles associated with facial recognition software don’t differ from those applied to other security measures in a mall, such as surveillance cameras. But he noted malls have to put up signs that indicate surveillance is taking place and “there is no question the mall is recording that surveillance.”

“In this instance the mall is saying no, as users approach this camera on our mall directory we’re not capturing a single image from them. What we’re doing is this video looks at that image and quickly produces an estimated gender and age,” he said. “I don’t know how that works but if the technology actually has to capture that image for even a split second, then there’s an argument that that’s an actual collection of personal information.”

Pina D’Agostino, founder and director of the Intellectual Property Law and Technology Program at Osgoode Hall Law School (IP Osgoode), said PIPEDA would also be applicable in this case because the legislation looks at any type of organization which is collecting personal information during its commercial activities, which would apply to Cadillac Fairview.

“One thing I found interesting was that the mall’s argument was they are not doing anything wrong because they’re not storing or actually collecting information,” she said. “But if you actually look at the Act, it is very specific about this. It protects information that is collected, used or disclosed. Clearly there is use, so even your use of this information could trigger a violation of PIPEDA in this case.”

D’Agostino said, in order to run the analytics to get the age and gender from the facial recognition technology images will likely have to be stored, even if for a couple of seconds. She said the situation is similar to the concept of ephemeral recording in copyright law, where broadcasters are allowed to make a single recording of a copyrighted work for archival and logistics purposes.

“And if you look at the big picture and all the other information that they are collecting in the course of someone entering the mall, it is very reasonable to think you can identify a person by putting together the gender, the age, the security camera footage and all of that which the mall is privy to,” she said.

Whatever the outcome of the investigations, it is generally accepted that the pervasive use of technology is something that people will have to deal with, whether they view it as a utopian ideal oran Orwellian nightmare. Vail noted a colleague once said to him in 20 years’ time people will be saying, “privacy, what the hell is that?”

“Trends tend to show that privacy is a concept that is becoming less and less important in the minds of people,” he said. “My father would say [the mall tracking technology] is unacceptable and I would probably say I’m uncomfortable with it, but a millennial would probably say I don’t care. There is a trend towards people wanting to have less privacy as they use social media and other things — it just becomes part of their lifestyle and personal privacy becomes less important to them.”

 

Ian Burns is a Digital Report for The Lawyer’s Daily.