WINNIPEG -- More than five million Canadians had their pictures taken at 12 malls across the country that are run by Cadillac Fairview, including a mall in Manitoba.
The federal privacy commissioner announced the findings on Thursday.
One of the malls in question that collected a chunk of those images was CF Polo Park in Winnipeg.
The pictures were being taken by a small camera that was set up inside the directory kiosks.
The pictures would be taken and then converted into lines of information to determine age, gender, and other demographic information.
Andrew Buck, a privacy lawyer and partner at Pitblado Law, said that kind of information is considered sensitive and it raises the question of if proper consent is being given.
"The thinking is that if you're going to collect someone's personal information in Canada for a business purpose, then you need to make sure that the person has given you consent to doing that," said Buck.
He said to give consent people need to know what the information is being used for and what is being collected.
"So what this finding from the office of the privacy commissioner of Canada has told us, is that you really need to be clear about this information, they regarded as biometric information."
Cadillac Fairview had said that there were stickers on the doors of malls informing people the information might be taken.
Buck said that isn't enough to obtain people's consent.
"According to the privacy commissioners office is not sufficient in order to bring that home to people to give them that notice and get the consent from them that is necessary," he said.
Buck said privacy is about reasonableness and he said in the report, the commissioner noted it is not reasonable that customers would think the information would be collected.
Cadillac Fairview has said the cameras were taken down two years after complaints were originally brought up about them.
The company also said it is following all the recommendations the privacy commissioner has made and that it doesn't plan to use the technology again in the future.
Buck said this case could lead to a potential lawsuit, which could claim breach of privacy, but he did note most of those cases involve information that is lost due to a breach and then harm comes from it.
"I think this might be regarded as something that is put out there as a best practice for people so that businesses can understand their rights and obligations, consumers can understand their expectations."
Buck said for consumers who are concerned about their information being used, they should do their research and they can ask businesses if their information is being collected.
COLLECTING AND SELLING INFORMATION
Buck also mentioned privacy is becoming something that is being commoditized by companies, saying businesses are in the business of collecting and selling information and personal information is used to subsidize the cost of services.
Buck doesn't think there is anything wrong with that but said people need to know this is happening.
"The take-home point from cases like this is it helps people understand and have awareness that these things are going on."
Cadillac Fairview said the technology was originally used to assess the amount of foot traffic at a given site.
"While the focus of this report is of technology that was disabled and removed more than two years ago, we want to reiterate that we take the concerns of our visitors seriously and are committed to protecting our visitors' privacy," a statement from the company said.
It said the privacy of customers at the malls must always be a top priority for the company.
