________________________________________________________________________________
The company also argued shoppers were made aware of the activity through decals it had placed on shopping mall entry doors that referred to Cadillac Fairview's privacy policy.
Do _what_ now? Physical spaces have privacy policies? We're really sleepwalking into a dystopia. If you don't like the privacy policy of your shopping mall, you're free to shop... online, where they get even more behavioral data on you. Yikes.
> shoppers were made aware of the activity through decals
Indeed there's a huge glaring problem here: many of these malls have branded entrances (Shoppers Drug Mart, Best Buy, etc) through which a large portion of consumers walk into the mall, and these alleged decals are not present in those entrances. Here's an example [1]. Frankly I don't see said decals even in the non-branded entrances[2]
They're going to have a very hard time convincing the commissioner that people were in fact aware of these decals AND any "privay policy" therein. A simple survey would easily show that people are completely clueless about it (anecdote: I used to frequent CF malls quite a bit when I was in Toronto and never saw anything of the sort, even despite being the type of person that might actually read random stuff posted at entrances).
[1]
https://www.google.com/maps/@43.7788812,-79.3447734,3a,75y,1...
[2]
https://www.google.com/maps/@43.7789409,-79.3444783,3a,75y,1...
Sorry but if you're taking their argument at face value that decals might be the way to go here and everything would be fine if only they were there, then they've basically won.
Don't get side tracked.
My take is that the claim that "shoppers were made aware of the activity through decals" fails on multiple levels: whether said decals were actually there, whether they would be capable of capturing nuances of scope if they were (e.g. there's different expectations between a mall entrance, the Shoppers entrance and the LCBO entrance), whether people noticed the alleged decals if they were there, whether they could be reasonably expect to understand it (e.g. non-english speakers), whether people could infer that legalese existed if they did understand it, whether they were capable of understanding the actual terms (e.g. tech illiterates), whether it is reasonable to expect that people would consciously agree to whatever terms are laid out in the legalese, whether all people captured by face recognition necessarily were actually aware of the terms, etc. It just doesn't stick on so many levels.
For non-Canadians here: Shoppers is pharmacies and LCBO is provincially-controlled liquor store that has near monopoly on hard liquor sales.
“Near monopoly”? Outside of duty free, where else can you buy booze (not beer) besides the LCBO?
You can buy hard liquor in artisanal distilleries like Spirit of York or few in Niagara region. And talking about “not beer”, wine has been available in grocery stores for a while now.
Doesn’t this vary by province? BC has quite a few non- bc liquor stores, at least in Vancouver.
Every single one of those private liquor stores buys its stock through the BC Liquor Distribution Branch of British Columbia, so yes, the monopoly is still very much there, just hidden behind a few facades. I suspect something similar is the case in other provinces too.
A bar
Any consent that isn't explicit should have no legal value. A "decal" on a door is about as useful as a size 2 font fine print, or an audio disclaimer played back at 5 times the speed.
This implicit agreement can be used to obtain quite literally anything without the other party ever knowing.
In that case I think we're in agreement. :)
Disclaimer: IANAL, caveat lector.
Taking the argument at face value is probably not the right conclusion [1]. The linked court case establishes what we would call in American law Informed Consent. If you can't read disclaimer at the door until you are in camera range, is that really informed consent? And if the disclaimer does not actually list the policy in question, but refers you to a website to read it, can it be considered sufficient? A quote from the ruling is relevant here - "The more onerous the exclusion clause the more explicit the notice must be". Now, this case was related to legal liabilities related to injury in a ski resort, but it's the closet thing I've found. I suspect a judge won't take long to rule in favor of the plaintiff.
[1] -
https://www.canlii.org/en/bc/bcca/doc/2020/2020bcca78/2020bc...
The decals might be installed on the inside doors that lead from shoppers drug Mart to the the mall.
The streetview images are dated may 2019, but the article says
>CF suspended its use of cameras back in 2018 [...]
Even if there were large signs, people would just not care.
In Canada, do you even really have a right to privacy when in public spaces like a shopping mall? Is there even a legal expectation that there _aren't_ cameras doing this kind of thing all the time? In most places in the US I know there isn't a right to privacy within a public space. If I as a shop owner put up security cameras in this same fashion in most of the US this wouldn't be against the law. There's no law preventing me from putting up cameras all along my home looking out into the street doing the same.
> In Canada, do you even really have a right to privacy when in public spaces like a shopping mall?
Yes, you do, because while a shopping mall might be considered a "public space," it is private property owned by a private organization. In Canada the PIPEDA [1] covers this federally, though the law is written such that it is a backstop, and provinces are free to enact their own "substantially similar" (or stricter) laws if they choose. For example, in Alberta the PIPA [2] covers these issues.
And as the article states, both federal and provincial privacy commissioners found CF in violation of those laws.
[1]
https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-can...
[2]
https://www.alberta.ca/personal-information-protection-act-o...
Personal information under these laws are defined as:
age, name, ID numbers, income, ethnic origin, or blood type;
opinions, evaluations, comments, social status, or disciplinary actions; and
employee files, credit records, loan records, medical records, existence of a dispute between a consumer and a merchant, intentions (for example, to acquire goods or services, or change jobs).
How does video of people passing by meet such a definition?
They stopped a representation that allowed them to identify that the same person visited again. That’s an id number. They guessed age and gender.
By ID, gp likely means government id, not identification by face. I can recognise my neighbours, but that doesn't mean I have their personal information.
In Europe, data that can be used to identify a person is also protected. For example, IP address plus timestamp is protected. Because you could obtain customer information from the ISP.
That's how I understand things.
Just to be clear (because the article isn't), what CF did was install a bunch of computerized kiosks to replace the information map kiosks, then when anyone used those kiosks (peering at screen from 2 feet away, tapping at it), a hidden camera (no external indication that there's a camera behind the black glass screen) recorded their face and what store they were looking for. This was intentional to collect and store info about individual mall users.
It wasn't some security camera overlooking the concourse from 30 feet up or anything like that.
The intent to buy things in the mall (or not) for one
Age and (to a limited extent) ethnic origin can also be inferred from video. So can income and social status, via apparel, posture, etc.
A lack of a law preventing it doesn't make it good though. We can add new laws and regulations
Are the kinds who people who "shop" and attend "malls" the sorts of people we should be protecting?
What the fuck? Your position is that there's something virtuous about exchanging currency for goods as long as you can do it from home, but leaving your house to do it in person is substantively different at all, let alone worthy of disdain?
Are you so hopelessly tribal that it doesn't even take a political ideology difference to dehumanize people on a different side? It just naturally hits you that someone with different shopping habits is some kind of intolerable other?
Not defending the GP, but we do have websites like peopleofwalmart. If they were coming out with peopleofcanadianmalls, then that be interesting. Honestly, I'd expect peopleofWhatevermalls would mainly be teenagers and senior citizens outside of holiday season shoppers.
edit: came to the party late and see that someone else also posted about peopleofwalmart
Oh I find online shopping even worse tbh.
So uhh, did you build the computer you used to post this comment from first principles? Do you grow _all_ your own food from scratch? I'm not really sure where you're coming from with this disdain for people participating in the economy.
I love this comment.
I think every so often I get the urge to make a comment that ultimate burns off a few Karma points.
And what’s your opinion on superiority complexes?
They're the worst
What kind of question is this? Are you intending to imply that some people are less deserving of privacy purely based on if they shop at malls?
More a sarcastic expression of my disdain for the North American Shopping Mall and those who call her home.
Fair enough. Rampant consumerism is a threat to our survival as a species. I personally find it revolting.
How people can derive pleasure buying low-quality clothes and widgets made by people in horrible conditions is beyond me. Never mind the impact on our environment.
I have a lot of compassion for addicts. I used to be an opiate addict. It's all the same phenomenon; trying to fill an internal void with something external.
I suspect that the majority here, however, do not feel the same way. I've seen too many posts where folks describe their love of amazon with a fervour best described as religious.
You'd think as a former opiate addict you might have a little more understanding and less emotionally negative response to something as mundane as shopping. If you feel this way about people who got to malls, how should I feel about junkies shooting up in my alley?
I don't even get any part of this conversation.
A person needs a pair of pants. Maybe, they don't want to use Amazon, or online services. They go to a store. It's in a mall.
Now, they're idiots for some inane, bizarre, incomprehensible reason. Even the "cheap clothes" they use to keep themselves safe from the elements are worse, than the "cheap clothes" bought elsewhere, like from Amazon?!
What a weird thread.
https://www.peopleofwalmart.com/
Ooo this is very important!
Are you saying we shouldn't protect consumers?
It is one thing to have cameras for security and store records for a limited amount of time for police investigation and what not. But applying facial recognition, biometric analysis, and storing it indefinitely is whole another ballgame.
It’s crazy that their lawyers think that merely referring to a privacy policy via a decal on the door is adequate acceptance of this kind of intrusion. I thought the laws required explicit acceptance online, via a check box on sign up, along with emailed updates when the policy changes. Merely walking through a door cannot possibly be construed to be explicit acceptance.
> It’s crazy that their lawyers think that merely referring to a privacy policy via a decal on the door is adequate acceptance of this kind of intrusion
Very abstractly, legal precedent exists for the general implementation. Texas has what's called "the 30.07 sign" codified in the penal code (30.06 concealed, 30.07 open carry)[1] which prohibits firearm carry on that property with nothing more than a proper/legal sign. The responsibility lies on the entrant to notice and comply with the sign prior to entering the establishment, no explicit acknowledgement is required by that place of business for it to be enforced.
(not saying I agree with what's going on here, only that I can see lawyers using laws like this to support the action in the face of no laws saying it _can't_ be done like this - a judge may throw the argument out, but it could be made as a good faith argument? My mind is thinking about how in the 90s "shrink wrap acceptance" was just a given - you opened he box so you accepted the license, but in 2020 many new laws have been developed to curtail that design and now require explicit acceptance by the end-user.)
[1]
https://statutes.capitol.texas.gov/Docs/PE/htm/PE.30.htm
Interesting example.
Not super familiar but that’s a licensed activity right? As in there’s some training and/or test administered upon gun purchase? Sorry if that’s not the case. But that feels marginally different because if you had a handgun and you knew this door sign governed whether or not you could bring it into a premise, you would look out for it.
No one is staring at the door of the drug store, because we are not trained to do that.
Yes, it's licensed. There's a class and a proficiency demonstration:
https://onlinetexasltc.com/texas-concealed-carry/
Not sure about the privacy laws in Canada, but are there any laws against video recording and/or facial recognition? AFAIK by default they're fair game because there's no expectation of privacy while in public.
I don't see it any more crazy than that you can legally agree to something by clicking.
indeed, I almost fell off my chair : ) If we do not read it in comfort of our home, why would one do so walking into the mall.... and there is not even a precedent to do so....
_Physical spaces have privacy policies?_
I've seen TOSes on mall doors before. They've been white letters on clear glass at just about foot level written in letters about 1cm tall. They were usually about violence and guns and shoplifting being grounds to ejection and banning.
The only people who ever see them is the decal printing company, the guy who installs them, and mice.
A lot of malls I've been in have a "terms of conduct" sign near the entrance when you walk in. Similarly bizarre are the signs at the parking lot entrance that act similarly.
I'll take that one further! Every street that enters the city I live in, has a sign with text that you'll only be able to read if you park your car, get out, and walk up to it. I've lived here 5 years and I still don't know what the heck those signs say lol. My guess is it's something about parking enforcement? Sigh. It's completely absurd lol.
The ones here all say "No Roller-blading", which should be a good indicator as to how relevant they are.
The best defense against hackers.
When I was in college Fortinet pitched a capstone project for an automated doorman that tracked passersby, delivery people, residents, etc using cameras posted at doors.
We asked why they couldn't use other biometrics which were much more established at the time (eg fingerprint scanners at the doorway), they said because other biometrics required consent. They wanted to track people without their knowing or agreement.
When asked about the ethics they said something along the lines of "this is what our customers are asking for."
Point being you don't need a privacy policy when you don't have a reasonable expectation of privacy in the first place. They can take pictures of you, store them in a database, sell them if they want. You don't have a right to be forgotten. And there are people that don't see anything wrong with that.
The tech capabilities have changed so much that I'd say it's closer to being surveilled than observed in a public place. Compare it to security cameras where you're recorded almost everywhere, but the video is relatively transient and often only reviewed / saved if a crime or disturbance occurs.
That's a lot different than companies tracking me via facial recognition, storing the data in databases that never get deleted, and combining it with behavioral data. It's going to lead to all kind of abuse. We'll end up with many variants of redlining, but digital.
What happens when that type of data is collected for today's youth and 20 years from now employers start using it to screen job applicants? What if the machine learning algorithms can't distinguish between correlation and causality? Does the "profile" of a successful person become someone from a rich neighborhood as a result of naive correlation?
I'm sure it'll be amazing for wealthy people and terrible for poor people. If I'm rich and walk into a mall, I get treated like a VIP. If I'm poor, maybe the doors don't even open.
About five years ago there was a decal on the glass beside the entrance to the Stanford Shopping Center Neiman Marcus notifying customers that they were tracked by their phones.
I wonder if they stopped in response to complaints, or decided the notification was unnecessary. At the time, I figured their system judged me for browsing $800 jeans and not making a purchase.
_We're really sleepwalking into a dystopia._
Maybe some, but most people are aware. They have very little to zero power to fight back the abuse.
Hey, if you don't like what your local shopping mall is doing, build your own!
Or even better, stop patronizing it and contribute to its crumbling real estate value.
Though, the more malls decline, the more they will behave like this. Optimizing and squeezing more out of their shrinking value.
I have a privacy policy for people entering my dwelling or using my guest wifi.
What's interesting to me about this is how people focus on the 'collection' aspect. But the collection of digital video of people in public spaces with minor (at best) notification (e.g. "smile you're on camera" stickers) has been going on for decades. There's nothing new there at all. So purely from the perspective of collecting data, it seems to me to be well within the purview of established commercial behavior, what they were doing.
The novelty here is not the collection, it's the analysis. And that makes for a kind of interesting legal distinction that hasn't been made in any other domain, as far as I know. A distinction whereby the collection is legal, the retention is legal, but certain types of analysis may not be.
Hi,
It is possible, though not well documented, that in China they actually do analyze[0] the image data from video cameras. That said this would be a case study in what that means from a free and open society.
[0] -
https://www.theatlantic.com/magazine/archive/2020/09/china-a...
Other than those in the industry, like me, you're the only person in these comments astute enough to realize this.
What the article doesn't address is that these same organizations fingerprint visitors phones [i] too.
From a retailer's point-of-view I totally get the rational and value behind collecting these metrics... from a privacy point-of-view it is a bit disconcerting.
[i]
https://www.cbc.ca/news/canada/calgary/cadillac-fairview-mal...
I was standing in a shopping mall last year waiting for a family member when I noticed a person walking towards/past me in dark muted colors wearing a backpack in the same colors across their chest carrying a laptop and a large phone/tablet.
They were clearly working and doing some kind of scan of the mall. Unfortunately I didn't notice soon enough to take their picture or chat with them. Would have been nice to know what they were doing.
If this is all privately held data that can't be accessed without a warrant... why not?
Just so I'm clear, the argument against this is:
- Merchants should be able to hire humans that sit around looking at camera screens all day trying to find shopping patterns, shoplifters, etc.
- Any attempt to automate this tedious task is dystopian and evil
?
A piece of data on its own is usually pretty harmless, a gigantic database that is organized, categorized, and distributed, is potentially very harmful. And it's a smooth gradient between them.
An example of data that is harmless on its own but harmful at scale is license plate reading.
https://arstechnica.com/tech-policy/2015/03/we-know-where-yo...
a few points tells you that a person is in a city, a few more tells you where they live, a few more tells you where they work, a few more tells you where the shop, a few more tells you who their friends are, who their associates are, if they're seeing someone on the side, if their going to any gatherings, if they tend to frequent red light districts... ect.
In this way, as data is aggregated, the picture of a given person slides from blurry to clear. And a clear picture of someone is an invasive and dangerous picture of someone.
As a result, aggregation of "public" data like this is something privacy advocates generally resist. It's not that there's is some line that's been crossed.
Exactly. It's the industrial scale collection, storage, analysis, and sharing of data that becomes a problem. I don't care of Joe Smith the security guard sees me pick my nose or scratch my ass when they're watching security cameras because it's not noteworthy to them and they're not going to recognize me or remember it.
However, I do care if the cameras are feeding into a huge system for analytics and data sharing. What if I cough 2x more than the average person? Does that get tracked, stored, and sold to a health insurance data supplier that ranks me as high risk for respiratory problems?
Does the machine learning algorithm that analyzes footage rank me as a potential thief if the database says I hang out in a lot of poor neighborhoods?
These will turn into class profiling systems that will amplify everything in your life so much that whatever your economic status is when you're born is what it'll be when you die.
The answer to all of these questions is: if there is money to be made on siphoning off some data here or there, someone will invent a way to do it. Sometimes silent, sometimes brazen. Usually silent though.
Do you use a credit card? Why are you so upset about this dataset but not that dataset?
Honest question.
I am definitely not happy about that either.
Having a card is just as unavoidable as needing to go to the shopping centre to buy groceries, so this isn't even a case where "if you don't like it don't use it" applies
Yes. And why do you think I'm not upset about that dataset?
You haven’t actually articulated any harm here - the “dangerous” actions that could potentially happen with the aid of aggregated data, like blackmail or stalking, are already illegal.
It feels a little onerous for me to lay out the a privacy advocates argument from first principles.
I'd presume if umvi had rejected the groundwork reasons for privacy, they would have made a comment more like:
"What bad thing are we asserting would happen if they created this data set? What demonstrable harm can you show from even an omnibus dataset? Let alone what this mall is creating?"
The end equilibrium is everyone running cameras constantly in public spaces, and all public activities scrutinized by... well, who knows? For what ever purposes they choose.
As just one example, I'd expect the emergence of semi-automated blackmail - you can infer a lot from peoples' public activity.
"Merchants should be able to hire humans that sit around looking at camera screens all day trying to find shopping patterns, shoplifters, etc."
There is no identification part in what you describe. Generic stats (how many person in the queue, etc.) are okay.
The issue is not facial detection but facial recognition.
They stored model of faces associated with data which mean they could point a camera at anyone in the street anywhere in the world and find back what is the data associated with that person.
Hiring humans would not result in creating and storing models of faces
You're telling me humans can't recognize faces? Consider a security guard who sits at the entrance to a store and watches people come in. What are the chances he would facially recognize a repeat shoplifting offender?
In scenario 1, getting a warrant doesn't do a whole lot of good.
In scenario 2, if the technology is widespread, police can be searching all stores records country wide within minutes.
Yes, because humans looking at camera screens will a) cost the company money, and also b) creates an incentive to the company to limit its observation to only the most necessary viewpoints.
Attempting to automate the task of constant observation makes constant observation easier, which isn't necessarily a desirable state.
I could not be happier that wearing a mask is more or less societally acceptable now.
As someone who is seriously immune-compromised and also gets social anxiety, masks are the best thing to happen to me in a long time. I get none of the claustrophobia or breathing restrictions some people talk about and find masks perfectly comfortable, and it actually lets me go to the shops or walk through town without freaking out.
More importantly though it sets a precedent for the future. We now know how easy it is for an airborne virus to decimate us, so even when this virus is over it'll be acceptable for people with immune issues to keep wearing masks "just in case" (similar to Japan/etc, although I know some of that is about stopping other people from getting sick).
I was curious if the value of the facial recognition startups is at risk with masks becoming more prevalent. Wouldn't be surprised if they are lobbying against mask mandates and mask enforcement as their entire business model must be at risk.
Good. Fuck 'em. I tried find "better" language, but it's just such a perfect way to express it. No level of "nice words" will convey the mood/tone/loathing I feel towards facial recognition as succinctly.
I've read that gait recognition is even easier to implement and more accurate than facial recognition. People will find more and more innovative ways to invade our privacy.
Newer facial recognition systems work fine with people wearing masks.[1][2]
[1]
https://www.sciencedaily.com/releases/2019/05/190501114602.h...
[2]
Any enterprise class FR was already doing face masks before the pandemic. I know the FR I work on worked fine before with masks, and now with enhancements much better.
Even after a vaccine comes out that makes COVID an annual thing to deal with like the flu, I'm still going to wear a mask in public. Not that I'm concerned about catching anything, but just because of the public facial recog bullshit that is much too prevalent. Plus, there's just something satisfying about walking into my bank wearing a bandana when accessing my account. They make it so damn difficult to use my money they make me feel like I'm trying to rob them. So now I'm just dressing the part.
there is camera software that records an individuals gait/way they walk as a unique fingerprint/identifier
They should use that software to identify the Missy Beavers killer!
https://www.youtube.com/watch?v=c9b1dIi9E2M
Personally I still think it is the father in law even though he allegedly has an alibi.
Think of what a PR coup it would be for the camera company if they resolved a notorious cold case using their tech.
I think the courts have ruled that it is perfectly legal to record somebody outside of their home as that is considered public spaces. Many cities are now moving to embed cameras in street lights to deter and record crimes.
I think that it is safe to assume that if you are outside, you are being recorded, either by a check point camera , a store’s security camera , streetlight camera or even your neighbor’s ring device.
You should not have any expectation of privacy once you are outside the confines of your house.
This "_you should not have any expectations of privacy in public_" argument dates back when there was no facial recognition.
The idea was people can see you in the street, maybe exceptionally a wierdo would take a photo of you but nobody could find your identity back from that photo. In case of a crime in the street the police could exceptionally access surveillance cameras to investigate. That's it.
This is what "no privacy in public" meant in 2000/2010, and I was totally fine with that. I was totally pro video surveillance at that time .
Now we're in 2020 and facial recognition is happening. Everything changes.
Today, taking the picture of someone = taking biometric data like fingerprint or DNA. This allows you to have a total control over that person. Law were made at a time when a cameras were not such devastating weapons.
Everywhere you go, everything you eat, each item in the store you look at, each person you look at, heartbeat & stress level, which house you're at, who are you talking to, what did you bought, when, with who, what ads did you watch in the street, which part if the ads, with which emotion, we can find your identity, social posts, private data, health data, intimate message, browsing history, emotions, stress level, etc just by pointing a camera at you because of facial recognition. All this is anaylzed, sold and stored __forever__.
We're getting in a dystopia the worst case-scenario dystopic sci-fi movie couldn't even imagine and people are like "nah we shouldn't expect privacy anyway ya know"...
> Today, taking the picture of someone = taking biometric data like fingerprint or DNA. This allows you to have a total control over that person.
How does a picture grant total control? Let's say I have a picture of you right now. How do I use that picture to either force you to do something against your will, or prevent you from doing something?
People are being detained & tortured because they've been recognised on footage of public demonstrations.
Looking at China it's pretty clear how having a model of peoples face with facial recognition has been key for their total control of the population
This is a government problem, not a privacy problem. If your government is intent on detaining and torturing dissidents, then privacy laws aren't going to stop them. Who do you think makes and enforces the law? The solution to that is to change your government.
The US is one of the most democratic nations on Earth.
The NSA spies on its own citizens, and won't even tell congress how.
https://ca.reuters.com/article/ctech-us-usa-security-congres...
The CBP is buying location data on US citizens, tracking them without a warrant, country wide (not just at borders), and won't say why/how:
https://ca.news.yahoo.com/dems-call-for-cbp-location-data-in...
Police, the FBI, and more use stingrays without warrants. The NSA works extensively to destroy encryption, and even have back doors into products for full, unlimited, real-time breaking of encryption.
I could post endless stories about this. Different US agencies, different data, different purposes for that data.
Put them all together.
Now consider that some of these agencies are "fighting" with democratically elected officials. Refusing to comply with democratically elected senators, congressmen, officials. State officials have even less sway.
This data is quite simply too powerful to be in anyone's hands. Literally, too powerful.
So if we make it illegal for the mall to have security cameras then the NSA will stop spying on people?
No, you make the data collection illegal and with liability like it appears Canada already did hence why this company is in trouble with regulators.
Data should be legally made in to toxic waste we all know it should be treated as.
Again, if the worry is about a corrupt and hostile government, I fail to see what making it illegal accomplishes. Who do you think the regulators are?
Yes, regulation is great with a just and fair government. If the government can't be trusted, then neither can the regulations. If we can't trust the government, then we need to replace it with one we can trust.
This is not a binary thing.
It is not "the government is corrupt, therefore all is pointless". Instead, there are scenarios such as:
- the government is comprised of people, running different departments
- those people seem to think they are doing things for the common good
- courts determine otherwise, and point to laws passed by legislative bodies as validation
- activity stops
"Spy agencies", and "policing agencies" are constantly under these checks and balances. Cases are thrown out, individual careers are axed, when warrants are not used when they should, for example, when searching homes.
Without the laws, and court cases as they are, then the police would simply enter without those warrants, get convictions, and carry on very happy with themselves.
The real problem here is that technology grows so very fast, and that the world is changing quite rapidly. Don't even get me started on bio-tech, or near-Earth space changes over the next decade. Or Interplanetary law!
Legislative bodies, and law, are literally meant to deal with things over the course of decades or more. Legislative bodies tend to sit for 4 years or more! Change is slower, and of course, we _like_ slower change for many things.
But this means that laws much 'catch up' to faster moving change.
Hell just _crafting_ a law, going through the committees, hearing from experts, at least in Canada, then crafting the law, reading it in both houses, and more experts can take more than a year or two.
And that's after the will is in place to enact change.
This is part of the reason I deem the executive branch as having value, but, that is another discussion.
All said, I fear governments with this power most, and private corps next. One law takes care of _both_ of these scenarios.
Lastly?
Never ignore the interest in something. Any old horse trader will tell you, if everyone clamours for something, it has immense value!
Knowing if I farted last week on Tuesday, is of immense information to everyone. Wha? Yet it is! And if it is of such value, if everyone climbs over each other to get that data, to hold it exclusively, to sell it, trade it, there is likely some import to such things.
If this info is so insanely valuable, then shouldn't the creator control it? Control what happens to it?
We have copyrights, patents, trade secrets, and even things like labour laws, acts to protect safety!
The entire purpose of law, is to protect "my stuff" from "that other guy". My life. My belongings. My health.
Yet this? This is all just "OK"?
The current laws surrounding data, are like period of times before labour laws, before human rights legislation, before food safety acts, and on and on.
This period of time is ending. Legislative bodies are catching up.
The question is, what will happen during the transformative period, where law catches up, and passes more and more laws about personal privacy, and control over personal data?
> The entire purpose of law, is to protect "my stuff" from "that other guy". My life. My belongings. My health.
If someone sees you in public, does the fact that they see you belong to you or them?
This is important. If you see me, does your memory of seeing me belong to me? Can you own memories inside someone else's brain?
Personally, I think not.
To some extent, your appearance in a public place does not constitute "your stuff".
Yes, your health and safety should be protected. Someone seeing you in public is not, in and of itself, a threat to your health or safety.
If you go out in public, you must come to terms with the fact that other people can see you.
Yet that's not what's happening.
What's happening is, effectively, stalking. Stalking laws exist, even if the person is following another in public.
There are limits, you see.
Further, as others have eluded to, this is not about "a person seeing another person". Instead, this is about:
- a non-entity, a device, 'watching' you
- exporting that data from the locality it was taken in
- storing that information forever, if desired
- also scanning you directly, looking for RF signals
To claim that "a person seeing you walking down the street" is the same as this, is not valid.
For example, "stalking" entails following a person, where ever they go.
What else is all of this surveillance, if not 'following' a person where ever they go? And in most legal jurisdictions, this is a crime.
Try this same behaviour as a person? And individual? Follow a person where ever they go, take notes, never leave them alone? Bam! Stalking.
But because it's a corporation doing it, that's OK I suppose?
You keep trying to say that "a person seeing you in public" is the same as "mass surveillance being leveled against you".
It's not. Full stop.
So why not discuss this as it truly is? Please stop this conflation.
Because it's _not_ a single entity following you around from place to place. Each place is keeping it's own records.
If you go to Joe's house and Joe makes a note that you came to his house, then you go to Bob's house and Bob makes a note that you came to his house, nobody is stalking you. Each individual is keeping track of who visits them. That is not stalking.
Yes, _maybe_ later on, the government or someone else could come along and ask to see each person's records of who visited them. But that is _their_ information to share or not share. You went to _their_ place! If someone comes into your place of business or residence, does the record of that person visiting you not belong at least partially to you? Are you not allowed to keep track of who enters your own property?
I think I see where you're coming from, in that you're allowed to have knowledge of other people, and most of the time it's perfectly innocuous. But I don't think that's a very fair comparison. There's a pretty big difference between just happening upon some information (that you would likely immediately forget because it's not important), and actively seeking out and extracting information, often combining it with more information from different sources, saving it to a "profile" associated with you, and often sharing it with third parties, all without your knowledge or consent.
You seem to be implying that there's no difference between having a single piece of harmless information about someone, and having lots of personal and/or intimate knowledge of them, especially if they aren't the ones having given it to you, and even more so if you're strangers.
Courts, laws, judges look at the end game. They often do not care about hand waving, distracting red-herring type logic.
This is how you get torrent sites taken down, even though they host absolutely nothing. Intent, you see, is key.
And what is the intent of all of this data collection? Is it to just randomly, happen-stance note someone in passing?
Or is it a dedicated, planned, targeted collection of data on individuals?
What is the purpose of the data collection? Hmm?
This is what counts.
Right, and the end game is some utterly mundane non-issue like showing me ads that I end up blocking or finding the best spot in the store to put cans of soup.
That's where all this hyperbolic "OMG they took my picture and now they have _total control_ of my life!!1!1" hand-wringing falls flat.
I care about privacy too, but come on. It's not voodoo. If you're not going to be serious about the real risks it's hard to take seriously.
After all this discussion, I've yet to hear an explanation of the actual mechanism by which, say, Macy's having a picture of me in their store allows them to exert control over any action I might want to take.
This. Truth.
> Data should be legally made in to toxic waste we all know it should be treated as.
The vast majority of people do not care about privacy though, at least not to the extent that “tech” people seem to.
There are public spaces, and then there are private spaces open to the public. I fight this one all the time with a local park. It is a park that is not city owned public, but privately operated and open to the public. They have a very strict photography policy, and their "employees" will interfere with you if you do not have "permission".
I believe shopping malls are private spaces open to the public. The point is that I would not be shocked to see that there are different rules regarding public spaces vs private spaces open to the public.
> You should not have any expectation of privacy once you are outside the confines of your house.
My first reaction was “what a sad dystopian position.” But then I thought further and while I agree in general, I think “privacy” needs a bit more nuance to it. If you are outside should it be against the law to have a camera that films you for security? No I don’t think so. There is a reasonable expectation that business and home owners will have security cameras to protect their property. But in the case of filming you in order to monetize your likeness and shopping habits, I think this goes a step too far, and becomes broadly unacceptable as too intrusive. Should I only be able to retain my information (likeness, shopping habits) by hiding in my home? That’s the dystopian part.
I don't know why this is downvoted. I thought the same thing.
"Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial recognition technology, for analysis," said federal Privacy Commissioner Daniel Therrien in a statement.
My default is the opposite, I expect I'm being tracked all the time and that my image, cell signal, and whatever else is being used to try and sell me stuff I don't need.
This has to stop.
Crime? True.
Please read the HN guidelines, which discourage this sort of bait posting.
No, the presumption that it's acceptable to be recorded and tracked in public.
There are laws that paparazzi have to abide by. Maybe they should be applied here?
Paparazzi actually operate under a more leinient set of rules because their subject has chosen to make themselves a public figure.
What about bathrooms, changing rooms, hotel rooms, etc? No expectation for privacy since you aren't at home?
OP's argument would be that bathrooms, changing rooms, hotel rooms are examples of places with expectation of privacy.
And if you are walking in the middle of a mall with lots of people around you, that would be an example where there is no expectation of privacy.
--
OP argument put more simply, if you are in a bathroom, everyone expects that that is private. In fact bathrooms have doors and urinals have privacy screens. If you are taking your clothes off, a reasonable person expects to be private
Whereas, in the middle of the mall where there are tons of people, there are surveillance cameras, and other people taking pictures of each other. That would be somewhere with no expectation of privacy
The system is apparently tracking age and gender of people visiting the information kiosk. This hardly seems like invasive tracking. Even tracking an individual's movement through the mall with the purpose of providing security and marketing analysis seems like a ho-hum no big deal to me.
If they were then taking the data and finding those people through Ring or youtube videos, sharing the pictures of people with companies to learn the earning power or tax history of a person, or using pictures of people and the store they visit to sell to Amazon or Facebook, then it would seem a step too far.
> This hardly seems like invasive tracking.
For now. Give it a while and they'll be looking up your credit score as you walk through the door.
its very similar to what a company called Locarise do in Japan. It's not identifying anyone, merely seeing buyer hotspots, queues, recording visitor numbers, etc. All very valuable to a mall and imo quite harmless to the user if they are not identified
They could later choose to sell this data and the buyer could deanonymize it by merging it with other purchased databases.
There's no such thing as anonymous data.
The ad-tech industry wouldn't exist if there was.
There are anonymous data that are interesting for advertising. The number of people passing by a location is anonymous in itself.
It seems however that in the case of the Canadian mall implementation (or more precisely their solution provider) they stored more than this number, losing the anonymous property of a system they sold as an "Anonymous Video Analytics".
In my opinion, something should be called anonymous if and only if you cannot go back from the stored data to a personally identifiable information.
I don’t see the actual harm here. Malls have operated security cameras for decades. These people added a facial recognition system to generate population statistics (age, gender) and track anonymous individuals as they move around the mall. So what? Who was harmed? Who could be harmed?
Now what if they decide to link that data up with driver license photos or social media data to de-anonymize as many people as they can. Would you still say there's no actual harm here?
I would argue that if the data is stored, it is only a matter of time before it becomes monetized in the manner you are mentioning. There has to be a firewall to prevent that step being taken. Mindlessly filming for future review in the event of a security issue is one thing. Intelligently analyzing the frames for identification purposes is where the feeling of “my privacy has been invaded, or could easily be in the future via storage of my likeness” comes from.
I don’t see this as a victimless act - just that the victimization is uncertain at present but almost 100% certain to occur the more this behaviour occurs.
They know you walked from Baby Gap to the food court, bought a pretzel, then left via the doors by California Pizza Kitchen. If you sue the mall, the court may agree your privacy has been violated and now are asking you to come up with a dollar figure for the harm done. How do you do that?
This argument assumes the court is looking only for compensatory damages whereas punitive damages are likely more applicable in an invasion of privacy case like this. No direct damages but the social implications demand a “whack on the nose” via punitive damages.
To do what with, though? Use it to blackmail you? Use it to track you down and murder you? That’s harm - collecting and analyzing data is not.
Privacy is a human right according to the UN. Whenever your rights are violated you've been harmed.
The release also says it was stored in a 3rd party DB and that they apparently didn't know that
I imagine they used this to also serve up suggestions on the kiosk. Mens vs Womens, Bongs vs. Bath linens, etc.
the NYC subway system has big human sized iphone like map displays complete with a facetime camera, presumably capturing the same stuff.
I have talked to somebody working for this exact company before that was telling me about some of their project that they were working on. In addition to video images they also track people through their phones across stores to analyze shopping behaviour and fingerprint customers.
I never turn on wifi or bluetooth away from home, my question is, are they doing LTE data collection too?
>are they doing LTE data collection too?
Don't cell carriers already sell your "anonymized" location data to marketers?
How is that even legal?! I mean I know the gov gets their data via abuse of the third party doctrine, but just straight up selling your data? If I had to guess they slap a dubious label of"anonymized" data...
Probably because you agreed to it (buried in the ToS somewhere), and there's no government regulations forbidding it.
It's plausible. The mall could have a stingray device monitoring everyone's data.
It's been done before, there was a big outcry about it a while back. Malls were using fake cell phone basestations to locate phones within the mall.
I don't have a problem with this. Most ppl don't know this but there are ppl who make a living harassing other ppl in malls or abusing associative learning to give ppl positive or negative feelings about where they are shopping. They use actual "models" if you want to call it that to influence your decision making everywhere you go. It's actually highly targeted and dangerously accurate.
Do you have more details about this? Honestly it sounds like paranoid delusions. However, I could see using good-looking models playing fake customer for influencing high net worth individual to spend more. It might make financial sense in a high price, high margin business like a jewelry store. I also heard anecdotal reports of paying homeless people to hang out in front of a competitor's business to scare away customers.
And I have the problem with both. Wish the jobs you described were highly illegal, because they're highly immoral.
_The commissioners said it did not meet the standard for meaningful consent._
_"An individual would not, while using a mall directory, reasonably expect their image to be captured and used to create a biometric representation of their face, which is sensitive personal information, or for that biometric information to be used to guess their approximate age and gender," they wrote._
Genuine question - if mall had deployed people whose job was to look at people to guess their gender, age and then jot it down in a notebook, then would it have been a problem?
If not, then why this is a problem? Assuming that the 'biometric representation' is discarded by the system after guessing the age and gender.
> Assuming that the 'biometric representation' is discarded by the system after guessing the age and gender.
It wasn't, it was stored in a third party database.
> Genuine question - if mall had deployed people whose job was to look at people to guess their gender, age and then jot it down in a notebook, then would it have been a problem?
I don't think these notes would ever come close to "a biometric representation of their face" which can tell you with certainty someone was there or not (when, what time, who they were with).
Yay, more big brother type stuff, I'm telling you it will come and most of us won't even notice.
"We as privacy regulators don't have any authority to levy fines on companies that violate peoples' personal information and that should really change."
The privacy commission has no teeth, so nothing stops future abuse :/
"By walking into this mall, you agree to relinquish your identity"
AFAIK it's zero-party consent for video in Canada. So, I'm not seeing the issue (in terms of legality anyways)
I was wondering whether the numerical representations of individual faces were PCA numerical series. Principal Component Analysis (PCA) is the most common method for image-based recognition, image preprocessing, lossless compression, signal-noise analysis, and high resolution spectrum analysis.
PCA can transform an image into a set of unique components, where each component has a numerical degree of distance and relatedness from an agreed on centered component. The first component has the largest possible variance (it accounts for most of the variability in the group). Each succeeding component has the highest variance that is orthogonal to the preceding components. The transformation of the group proceeds linearly from a group with a high degree of dimensionality to a group with a low degree of dimensionality of which the components of the group with a low degree of dimensionality are uncorrelated.
PCA reduces the dimensionality of a complex group of possibly unrelated activities into a smaller group of principal components that accurately represent the entire group with minimum information loss and no loss of essential intrinsic information. PCA also reveals the internal structure of a group of possibly unrelated activities, it can be used to discover meaningful relationships based on commonalities the internal structure of the group shares with other activities that happened in the past. PCA is well known for forcasting with time-series analysis and regression analysis. In most cases the predictability of specific activities can be calculated with high percentages of certainity, by focusing the reconstruction of projected outcomes on the optimization/maximization of the variances of specific activities.
In addition by categorizing the images into age groups and gender groups that information would be very valuable beyond marketing in longer list of industries world-wide.
If this system did not error out and display the error messages to the mall shoppers, it would still be unknown.
I wonder what makes anyone in charge think that such a practice could possibly be welcomed by the affected shoppers?
I'm wondering if just setting up a webcam in a public spot for a few years is enough these days to make a million bucks. I mean, don't you think that someone would buy a billion images of people walking about. It would be excellent for ML teams. LOL
No. There are many public webcams up already you can google and see right now, that content is free and not going away. What's missing is high def up-close cameras, which gets dicey w.r.t. privacy if you're making a profit off the content.
I was actually wondering about the same thing. I don't think you could make $1 million, but if you live on the end of a feeder street I bet there's a chance you could eventually get paid to point a couple cameras at the street.
With the way most modern neighborhoods are designed it would take very few cameras on private property to capture everyone going in/out.
Why would they pay someone $1 million for images that they can capture in a few weeks by parking a van with cameras in a crowded place?
If you need the content right now, vs rigging up a van and spending the required few weeks in it, and then the hassle of managing the RAW content.
You've basically just asked why stock photo/video companies exist.
It's amazing what people pay for in the correct circles.
There is no expectation of privacy in public places in the US. Not sure of Canada has the same norm. Now that said just because you can collect data does not mean should should--there's a wide range for good and evil here.
We are forgetting that until very recently storage was so expensive that there was an expectation of forgetting. This should be talked about more because it changes the picture dramatically.
That's a fantastic point you raise. It's dirt cheap to collect (IoT devices, drones, Digital Globe and the like) and very inexpensive to store data in volumes that were once the only viable for governments or well-funded and motivated private entities (e.g. hedge funds). That opens the door to a radically different set of possibilities.
I recall a youtuber Surveillance Camera Man, when he filmed people in public they seemed to get angry about his actions. To me this says people de facto expect privacy in public spaces.
https://youtube.fandom.com/wiki/Surveillance_Camera_Man
I work in FR, and this is everywhere. Malls and retail establishments of any and all kinds are contacting us and requesting FR for analysis of their shoppers. Police and campus security too. They want to create a tracking system very similar to cookies on the web, but for physical spaces.
Who cares?
So now we have something like shrink wrap EULAs but for malls? Yikes
Is it legal in Canada to deny someome a service offered to the public because they didn't agree to this absurd policy?
One more reason to like wearing masks all the time.
If only that was a surefire solution:
https://www.reuters.com/article/us-health-coronavirus-facial...
Cadillac Fairview said the images taken by camera were briefly analyzed then deleted — but investigators found that the sensitive biometric information generated from the images was being stored in a centralized database by a third party.
The images are not being persisted, just the metadata about the individual. Who is being harmed by this? If a person with a clipboard collecting this information without telling anyone, is there any outrage?
The pictures are not what matter, what matters is the "face features <-> data" association.
The harm ? With that data, any camera in the world pointed at you can find what you did in that store.
I'm outraged every single time I am accosted by someone with a clip board. Not once, ever, have I been remotely concerned with their concerns.
https://www.cadillacfairview.com/en_CA/news/CF-opc-investiga...
It was a beta test run 2 years ago. Someone ran fast and broke things and were probably fired. Take off your tinfoil hat and relax.
CF doesn't care who the individuals are or their identities, though general demographics would probably be interesting. They certainly have signs up at every entrance clearly indicating that you are on camera, but I think they are actually surprised about the biometrics data being stored offsite. I suspect they didn't understand this when they setup the AVA trial.
They use analytics on the WiFi based on MAC as well as Internet use.
This data is used to determine the number of unique users that pass by different parts of the mall to identify high traffic and 'dead zones'. They use different marketing programs to increase traffic to dead zones and can justify higher rent in high traffic zones.
Haha take your tinfoil hat off? No one is stating this is some sort of CIA operation. But the idea that all this stuff just sits collecting dust overlooked in a datacenter forever is naïve. Data is gold, and it's traded and monetized at an incredibly high frequency. Your statement that the data is only used in a static fashion for low impact implementation related functions belies the fact that in 2-3 years when the implementing company loses funding and becomes an asset heap some smart PE investor will connect the dots, get the right team together and extract value from the data and sell off the assets. You're either naïve or willfully ignorant if you think this is totally "okay".