Recent Ruling by Privacy Commissioners’ on the Use of Biometrics to Identify Consumers
According to an investigation by the federal, Alberta and BC Privacy Commissioners, Cadillac Fairview (CF) – one of North America’s largest commercial real estate companies – embedded cameras inside their digital information kiosks at 12 shopping malls across Canada and used facial recognition technology without their customers’ knowledge or consent. Federal Privacy Commissioner Therrien was deeply concerned with the actions of CF and stated that “Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial recognition technology, for analysis” He went on to say that “the lack of meaningful consent was particularly concerning given the sensitivity of biometric data, which is a unique and permanent characteristic of our body and a key to our identity.” The Commissioners recommended that if this technology is to be used in the future there should be additional steps taken to obtain, express, meaningful consent before capturing and analyzing the biometric facial images of shoppers.
Biometrics are defined as a way to measure a person’s physical characteristics to verify their identity. These can include physiological traits, such as fingerprints and eyes, or behavioral characteristics. In response to the ruling, CF contested that they were in fact not using biometrics to identify consumers but rather their own unique software that was “being used exclusively to detect the presence of a human face and, within milliseconds, assign the face to an approximate age and gender category. It did not store any images during the pilot program, and it was not capable of recognizing anyone.” You can find CF’s full statement here.
IAB Canada is watching carefully as this case is analyzed as there are some important precedents being set from the OPC on the use of technologies and the definitions around terms that are very closely associated with personally identifiable information. Based on the reporting there appears to be some confusion on both sides, in terms of the use of technology and the application of privacy laws. This specific case brings to light some important questions to be taken up by a planned working group at IAB Canada:
- Will this case set a precedent around the principle of obtaining express, meaningful consent in digital out of home?
- Will this case confuse the accurate definition of biometrics amongst regulators and what other activity might fall into this category?
- What best practices does the industry need to align to with respect to AI and how data can be collected and analyzed in a privacy-first way?
We will be updating our members on this issue as more information becomes available. If you are interested in joining our efforts, please reach out to policy@iabcanada.com