The Cadillac Fairview precedent
In 2020, federal and provincial commissioners jointly found that Cadillac Fairview's use of facial recognition in shopping malls without meaningful consent breached PIPEDA and the Alberta and BC PIPA laws. The mall's practice of collecting and storing 5 million facial images was found unlawful.
What is required
For facial recognition to be lawful, organizations must:
- Have a clear, reasonable purpose proportionate to the privacy impact.
- Provide meaningful notice (not just a small sign at an entrance).
- Obtain express consent where required by law.
- Conduct a privacy impact assessment.
- In Quebec, a biometric database must be disclosed to the CAI at least 60 days before it goes into service.
What to do
The signage, the location, and the store's privacy policy are what a complaint is assessed on. A complaint to the OPC or the applicable provincial commissioner is available where the practice appears to be unlawful.