Some Canadian Tire stores in B.C. used facial recognition technology to track customers, privacy watchdog says

Open this photo in gallery:

Several Canadian Tire stores in B.C. were found using facial recognition technology without alerting their customers, B.C.’s Privacy Commissioner said in a report condemning the practice.

Michael McEvoy wants the provincial government to tighten regulations to safeguard residents’ privacy rights. He investigated four Canadian Tire stores in the province that used facial recognition technology (FRT) to collect customers’ biometric information between 2018 and 2021. The stores claimed the technology was used to guard against shoplifting and protect staff. But the privacy commissioner concluded its use contravened the Personal Information Protection Act.

“The investigation showed the stores did not adequately notify customers and did not obtain consent for the collection of personal information using FRT. Even if the stores had obtained consent, which they failed to do, they were still required to demonstrate a reasonable purpose for collection and use. The investigation found that they did not do so,” the report, which was released on Thursday, read.

Mr. McEvoy’s office surveyed 13 of B.C.’s largest retailers to determine the prevalence of FRT in the province’s retail sector following media reports about its use. The office then found one retailer – Canadian Tire – was using the technology in 12 of its stores. Of those, Mr. McEvoy selected four stores, covering the regions of the Lower Mainland, Vancouver Island and the Interior, for investigation.

“The biometric information captured by FRT systems – the precise and unique mathematical rendering of your face – is highly sensitive. Retailers, like the ones in this case, would have to present a highly compelling case to demonstrate such collection would be reasonable,” Mr. McEvoy said in news release. “The stores failed to do so in this case.”

His report said those stores collected facial images or videos of individuals entering the stores, created biometric templates from those faces, and compared these to a database of previously collected photos and biometric templates representing persons of interest who had allegedly been involved in incidents at Canadian Tire stores in the same regions.

Carolyn Skinner, a spokesperson for Canadian Tire Corporation, said the company is vigilant about data protection and privacy, and FRT is not used at any corporate-owned stores or offices.

“While Canadian Tire stores are independently owned and operated by associate dealers, the corporation and the dealers have mutually agreed to prohibit the use of Facial Recognition Technology in Canadian Tire stores. Customers can remain confident that regardless of where they shop across our group of companies, their privacy will be protected,” she said in an e-mail.

The commissioner said the stores should build and maintain robust privacy management programs that guide internal practices and contracted services.

Meanwhile, he recommends the B.C. government amend laws to explicitly regulate the sale or installation of technologies that capture biometric information, and to create additional obligations for organizations that deploy biometric technologies.

“Government needs to tighten regulation related to those who install technologies like FRT. It’s ironic that regulation applies to those who sell and install old closed-circuit television systems, but not those who deploy the even more invasive facial recognition technology,” Mr. McEvoy said in the news release.

The province’s Citizens’ Services Minister Lisa Beare said she will look at the recommendations to ensure the laws keep up to date with evolving technologies. But she stressed those protections already exist through the Personal Information Protection Act, which is why the commissioner was able to take action.

She said for anyone who’s concerned about information being collected, either by an organization, an app or business, they can contact the Office of the Information and Privacy Commissioner and file a report.

Last year, an investigation conducted by the federal Privacy Commissioner with counterparts in Quebec, B.C. and Alberta, found Tim Hortons violated privacy laws by tracking people who used its app.

The joint investigation found that people who downloaded the food chain’s app had their movements tracked and recorded every few minutes, even when their app was not open.

Privacy officials said in their report that location data are highly sensitive because they can be used to infer where people live and work, and reveal personal details such as trips to medical clinics. They listed several recommendations, which the coffee chain agreed to implement.