The Cadillac Fairview precedent
In 2020, federal and provincial commissioners jointly found that Cadillac Fairview's use of facial recognition in shopping malls without meaningful consent breached PIPEDA and the Alberta and BC PIPA laws. The mall's practice of collecting and storing 5 million facial images was found unlawful.
What is required
For facial recognition to be lawful, organizations must:
- Have a clear, reasonable purpose proportionate to the privacy impact.
- Provide meaningful notice (not just a small sign at an entrance).
- Obtain express consent where required by law.
- Conduct a privacy impact assessment.
- Register with the CAI if in Quebec (biometric registration requirement).
What to do
Document the signage and the location. Ask the store for their privacy policy. File a complaint with the OPC or applicable provincial commissioner if you believe the practice is unlawful.