Canadian Tire stores in B.C. broke privacy laws on facial ID technology, privacy commissioner says

British Columbia's privacy commissioner is recommending the province amend its information protection laws after his investigation found several Canadian Tire stores contravened privacy laws by using facial recognition technology without properly notifying customers.

B.C. should tighten its Security Services Act and the Personal Information Protection Act to better regulate the sale of technologies that capture biometric information and create more reporting obligations for those using it, Michael McEvoy said Thursday.

"The biometric information captured by (facial recognition) systems the precise and unique mathematical rendering of your face is highly sensitive,'' McEvoy said in a statement.

The report from the Office of the Information and Privacy Commissioner said four Canadian Tire stores that used facial recognition technology didn't adequately notify their customers and didn't get consent to collect the information.

McEvoy's report also recommended Canadian Tire create and maintain a robust privacy management program even though the retailer said it removed the biometric technologies from its B.C. outlets and destroyed the collected information.

He said even if the stores had obtained permission, they were still required to show a reasonable purpose for collecting the information, which the investigation found they didn't do.

The investigation concluded the four stores that used facial recognition technology to collect biometric information from customers between 2018 and 2021 breached the province's Personal Information Protection Act.

McEvoy said the investigation found 12 Canadian Tire stores in B.C. were using the technology, saying it was needed for theft monitoring and staff safety.

The systems were removed, and the information destroyed when the commissioner notified the chain that four stores were under investigation, he said.

"Large-scale surveillance of people that was the case here with this retailer, on the occasion it might help to more quickly identify a potential shoplifter is just not a proportionate response to the kind of invasion of peoples' privacy that these technologies possess,'' said McEvoy in an interview.

Technology no longer in use

Canadian Tire said in a statement the technology is no longer used at its stores or offices.

"While Canadian Tire stores are independently owned and operated by associate dealers, the corporation and the dealers have mutually agreed to prohibit the use of facial recognition technology in Canadian Tire stores,'' said the statement.

"Customers can remain confident that regardless of where they shop across our group of companies, their privacy will be protected.''

The stores will not face sanctions because there are no penalty provisions under the act, said McEvoy, adding the law does give him the power to order the retailer to stop using the technology.

The 25-page report said Canadian Tire used two systems that "generally operated by capturing images or videos of any person entering the stores, as they passed into view of facial recognition technology cameras.

"Visitors included customers, staff, delivery personnel, contractors, and others who may have entered the store, including minors.''

The report said the software "mapped facial co-ordinates from the images or videos, creating a biometric template of each unique face. The systems would then compare a newly arrived visitor's facial biometrics to others stored in a database of previously flagged 'persons of interest.'''

'Carefully consider privacy rights' of customers'

McEvoy said he found it ironic that there are regulations for those who sell and install old closed-circuit television systems, but not for those who deploy the even more invasive facial recognition technology.

"I recognize retailers face a challenging environment. However, they have to carefully consider the privacy rights of their customers before buying and installing new technologies that gather very sensitive personal information,"he said in a statement.

He said B.C.'s Security Services Act and the Personal Information Protection Act could be amended to harmonize with other jurisdictions over biometric legislation.

In Quebec, the province's privacy commissioner must be consulted when a business is planning to deploy facial recognition technology or other biometric scanning, McEvoy said.

The Quebec commissioner has the power to suspend a business plan to use facial recognition technology, he said.

"These are the kinds of protections I think British Columbians would expect to have in place here because this is again sensitive information about individuals unique to every individual and can be misused and lead to a whole series of harms,'' he said. "I think we really need to make sure we properly regulate in this field.''

Lisa Beare, B.C.'s citizens' services minister, said the Personal Information Protection Act provides strong protections for people in the province, but the government is open to reviewing the legislation.

"Obviously, as government we need to keep abreast of current technology and make sure that our legislation matches what's happening out in the world,'' she said.