On February 6, 2023, Québec was abuzz with the news of the introduction of artificial intelligence into a store chain’s closed-circuit television (CCTV) system. Essentially, the CCTVs were enhanced with software trained to recognize suspicious behaviour in a retail store to detect shoplifters. When the system detects what it deems to be suspicious behaviour, within 10 to 20 seconds, it sends an alert exclusively to whoever is responsible for security in the store qualifying the behaviour as “suspicious” or “very suspicious The alerted individual chooses to act or not on the basis of the video image sent with the alert.

The concern was, “is this security measure a violation of the right to privacy?” In fact, the integration of surveillance technology in retail goes beyond security and includes business intelligence gathering. Our purpose here is to identify how Canadian privacy law allows or prohibits new trends in the use of surveillance technology in retail, whether for security or consumer engagement. In Part I, we provide an overview of the context for the use of the technology, in Part II we identify the applicable law and in Part III we take stock of the current application of privacy law to existing store and mall security technology and to marketing initiatives. In Part IV, we examine new trends in privacy law reform and apply them to new technologies to identify the privacy issues that may raise.

I. The context of technology in retail

To establish the legality of any form of collection of personal information, the first step is to assess appropriateness of purpose. This requires looking at context.

Reading the joint Retail Safety Security Guide, issued by the Retail Council of Canada and Safe Work Manitoba,¹ one realizes that the challenge of maintaining safety in retail stores and malls ranges from preventing and investigating shoplifting, responding to robbery, to violence or to the presence of intoxicated persons and other incidents that call for a broad use of surveillance technology. According to the Retail Council of Canada, shoplifting alone accounts for up to CA$ 5 billion a year in losses for Canadian retailers. Of course, the loss is passed on to consumers.

Several security measures do not imply surveillance. Monitored alarms, strategic staff assignment, store configuration and other recommended security measures in retail do not call upon any processing of personal information. It is important to keep that in mind in assessing the legality of the measures that do. Where there is a non-intrusive alternative to achieve the same goal, the use of personal information through surveillance will not be deemed appropriate.

Business intelligence is also getting its technological supports: mobile phone location tracking identifies a customer’s shopping route, view detection or gaze tracking determines where a customer is looking to assess conversion into purchasing, “booty cams” in dressing rooms allow the customer to see the jeans fit from the back and are meant to reduce returns, super cams, as well as kiosks and touch screens, can detect age and gender of customers to send targeted ads as they walk by. Some retailers automatically bring customers on their Wi-Fi network to monitor their online searches.

The two purposes, security and business intelligence, require different legal groundings. To a certain extent, security surveillance technology constitutes an appropriate purpose, consistent with the purpose of providing retail services and is therefore supported by implied consent; business intelligence surveillance, on the other hand, may constitute an appropriate purpose, but it is distinct from the purpose of providing retail services and therefore requires new consent, unless the information is properly anonymized at source.

II. The applicable law

In Canada, the use of personal information in the course of commercial activities may engage one of four pieces of legislation:

• For stores everywhere in Canada except in Alberta, British Columbia and Québec, the Personal Information Protection and Electronic Documents Act (PIPEDA) governs the use of personal information through store and mall surveillance measures;
• In Alberta, we refer to the Alberta Personal Information Protection Act (Alberta PIPA);
• In British Columbia, we refer to the Personal Information Protection Act (BC PIPA).
• In Québec, the newly amended Act respecting the protection of personal information in the private sector (the Québec Act), the Civil Code of Québec and the Québec Charter of human rights and freedoms govern the use of surveillance technology, in conjunction with the Act to establish a legal framework for information technology (Québec IT Act). The Québec Act and the Québec IT Act were amended by An Act to modernize legislative provisions as regards the protection of personal information (Act 25, formerly Bill 64), impacting the use of technology in the private sector.

Significant amendments to PIPEDA are proposed through Bill C-27, currently before the House of Commons, with the proposed Consumer Privacy Protection Act (CPPA). The proposed Artificial Intelligence and Data Act is also relevant.

Because private sector privacy legislation has been found to have a quasi-constitutional status,² as it protects the right to privacy which is enshrined in the Canadian Charter of Rights and Freedoms,³ the Office of the Privacy Commissioner of Canada (OPC) applies the four-part test of “reasonable limits” under section 1 of the Charter as developed in R. v. Oakes.⁴ So the legality of using store or mall surveillance technology predicated upon the use of personal information will rest upon the demonstration that:

• It is necessary for the reasonable purposes for which it would be implemented;
• Its use of personal information is proportionate to that necessity;
• It is effective in relation to meeting that necessity; and
• There is no less intrusive alternative.

It is against this backdrop that we must examine any retail surveillance technology.

III. Current guidance from the Office of the Privacy Commissioner of Canada

1. Surveillance for security

We already have a framework to assess what is permissible or not in relation to the use of CCTVs for store and mall security through the OPC 2008 Guidelines for Overt Video Surveillance in the Private Sector. They set the boundaries for us to apply to store and mall surveillance in general.

These are the criteria to apply to determine whether envisaged retail surveillance technology is compliant with the Personal Information Protection and Electronic Documents Act (PIPEDA):

1. Is the purpose of surveillance reasonable? The first step in implementing surveillance technology is to clearly identify the issue to address. Shoplifting? Violence? Robbery? All of the above? This is critical to ground the initiative in purposes that will meet the test of subsection 5(3) of PIPEDA being the demonstration of “purposes that a reasonable person would consider are appropriate in the circumstances” as well as demonstrate necessity, proportionality and effectiveness.
2. Having defined the objectives pursued, the next question is whether less intrusive technology would just as effectively meet the security objectives. For example, in relation to shoplifting, the very common Electronic Article Surveillance (EAS) tools, tags attached to merchandise and removed or deactivated upon purchase, will trigger an alarm if taken out of the store and the shoplifter can be caught. If that less intrusive measure fully meets the objectives in relation to shoplifting, then, by law, no more intrusive measure can be applied.

If the intrusive security technology appears necessary to meet the identified reasonable purposes and there is no less intrusive alternative, then compliance resides in the method of implementation:

1. The Accountability principle, the principle of identifying purposes, and the Openness principle – as well as the legislative trend towards requiring Privacy Impact Assessments, discussed in Part IV – dictate that the definition of the purposes be documented. This corresponds to the obligation to develop policies and procedures on the management of personal information, explain the purposes for collecting personal information at or before the time of collection and make readily available to individuals specific information about the management of personal information.
2. Once the security measure has been approved and before it is rolled out, a corporate policy must be adopted to govern its lawful implementation. Collection, use, retention and disclosure of personal information must be limited to what is demonstrably necessary, safeguards must be applied and mechanisms to respond to individual access requests must be in place.
3. Limitation of collection and use measures include:
   1. Short retention periods, set on the basis of evidence of need to detect, investigate or litigate, with automatic and secure destruction at the end of the retention period;
   2. Limited access to the information on the basis of need-to-know;
   3. Security of CCTV footage; and
   4. Limited camera range, avoiding the capture of excessive or of sensitive information.
4. Signage and public information must be developed to inform customers of the use of the technology. Signage must be sufficiently prominent to achieve the objective of realistically implying consent through walking into a surveillance area.
5. Signage must also include contact information to learn more: the exact purpose of the surveillance, its scope, retention periods and individual rights mechanisms with contact information. A link to the online privacy policy is required but not sufficient (signage must be clear and prominent) and the privacy policy must specifically address the collection, use, retention and disclosure of personal information through the surveillance measures.
6. Staff must be trained and supervised to respect the privacy of the individuals photographed or filmed.
7. The technology must be monitored to ensure it is never positioned to capture information beyond its intended range or to disseminate images beyond its purpose. For example, Bottom Of The Basket (BOB) cameras, positioned near the floor, at the cash, serve to detect merchandise at the bottom of the cart to ensure it is paid for. If the camera faces upwards then it can capture a lot more than it is supposed to. The question also arises, in relation to proportionality and to the limitation principle, whether sensors that merely detect the presence of an object could be sufficient and reduce risk of unlawfully capturing personal information.
8. The effectiveness of the technology must be evaluated on an ongoing basis: does it really enhance safety in the store? Does it do so in a manner that “outweighs any potential adverse effect on the individual resulting from that collection or use” of that technology, to use the terms of the proposed CPPA in relation to the demonstration of legitimate interests to collect or use an individual’s personal information without their knowledge or consent? ⁵

Essentially, privacy compliance will rest upon the ongoing demonstration of appropriate purposes, necessity, proportionality and effectiveness in relation to the purposes and the absence of a less intrusive alternative.

2. Surveillance for business intelligence

Canadian regulators have provided guidance in individual or joint positions regarding the use of personal information for business intelligence, including marketing, applicable to store and mall surveillance for that purpose. The following parameters emerge:

• The objective to generate increased advertising revenue is valid and therefore may be an “appropriate purpose;”⁶
• Collecting comprehensive location data, beyond what is used for advertising, however, does not constitute an “appropriate purpose;”⁷
• The use of personal information for the purpose of advertising is subject to consent;⁸
• The use of sensitive personal information for the purpose of advertising is subject to express consent;⁹
• The creation of a profile constitutes creating sensitive personal information;¹⁰
• Consent is only valid with proper information;¹¹ and
• Mere reference to a privacy policy does not constitute sufficient information to obtain valid consent.¹²

The bottom line is that regulators will want to see individual control over the use of business intelligence surveillance technology: are individuals effectively informed about the use of their personal information and are they given effective tools to control it?

IV Emerging trends in technology and in privacy law

Moving to what is coming, emerging uses of technology in retail meet legislative changes in privacy law through the Québec Act 25 (formerly Bill 64), An Act to modernize legislative provisions as regards the protection of personal information (Act 25) amending the Québec Act respecting the protection of personal information in the private sector (Québec Act) and the proposed Bill C-27 in relation to the Consumer Privacy Protection Act (CPPA) to replace PIPEDA as well as the Artificial Intelligence and Data Act (AIDA) to:

“(a) [R]egulate international and interprovincial trade and commerce in artificial intelligence systems by establishing common requirements, applicable across Canada, for the design, development and use of those systems; and

(b) [To] prohibit certain conduct in relation to artificial intelligence systems that may result in serious harm to individuals or harm to their interests.”¹³

1. Relevant developments to the Québec Act through the Québec Act to modernize legislative provisions as regards to the protection of personal information (Act 25)

Focusing on the amendments to the Québec Act through Act 25 that governs technology, the implementation of surveillance technology, for security or business intelligence, in retail engages the following new provisions:

• Section 44 of the Act to establish a legal framework for information technology (Québec IT Act) applies to the use of technology to verify or confirm a person’s identity through biometric characteristics or measurements and
  • Requires previous disclosure to the Commission d’accès à l’information du Québec (the Québec access to information commission, CAI) and express consent of the individual;
  • Limits to a minimum the number of characteristics or measurements captured;
  • Prohibits the use of the personal information without the person’s knowledge; and
  • Requires that the record of the characteristics or measurements and any notation relating to it be destroyed “as soon as the purpose of verification or confirmation of identity has been met or the reason for the verification or confirmation no longer exists.”
• Under section 45 of the Québec IT Act, if the technology creates a database of biometric characteristics, it must be disclosed to the CAI “promptly and not later than 60 days before it is brought into service.”
• New section 3.3 of the Québec Act requires a Privacy Impact Assessment about any project to acquire, develop or redesign an electronic system involving the collection, use, retention and disclosure of personal information proportionately to the purpose and amount of processing of personal information.
• New section 12.1.applies to the use of personal information to “render a decision based exclusively on an automated processing.”

The Civil Code of Québec already contains provisions that govern the use of surveillance technology. In particular, Article 36 states that “using [a person’s] name, image, likeness or voice for a purpose other than the legitimate information of the public” may be considered an invasion of privacy.

Under the proposed CPPA :

• New provision 62(2) would require disclosure of the use of any automated decision system, which could include surveillance technology that could be deemed to make a decision about individuals; and
• New section 63(3) would require the organization that has used an automated decision system that could have a significant impact on individuals to, upon request of the individual, provide an explanation of the decision; it is realistic to expect that surveillance technology may be deemed to be an automated decision system if it makes a determination about an individual.

Under the proposed AIDA, surveillance technology that includes artificial intelligence and meets the test, to be defined by regulation, of a “high-impact system” will be subject to regulations to,

• Establish measures to identify, assess and mitigate the risks of harm or biased output that could result from the use of the system. (section 8); and,
• Establish measures to monitor compliance with the mitigation measures as well their effectiveness (section 9).

All these new provisions, whether adopted through Act 25 or proposed through the CPPA and the AIDA, are subject to penalties for non-compliance.

2. Case studies

Retail stores constantly renew their technological tools to improve security, customer experience and business intelligence. Worldwide, emerging trends include:

• Enhanced CCTVs with real-time monitoring through AI as well as high-resolution cameras incorporating facial recognition;
• Body-worn cameras (BWC) for security staff;
• Anonymous Video Analytics (AVA) technology in kiosks or directories; and
• Reward apps for business intelligence.

In Québec, adoption of all these technological measures would engage section 3.3 of the Québec Act and require a Privacy Impact Assessment.

i. Looking at the legality of AI in CCTV

Going back to the news of artificial intelligence (AI) introduced into CCTVs in a store chain and the privacy concerns that arose, we must add to the test of reasonable purpose, necessity, proportionality, effectiveness and absence of a less intrusive alternative, the consideration of new provisions on automated decision-making.

The use of AI in CCTVs where the technology determines whether a customer’s behaviour is “suspicious” or “very suspicious” and decides to send an alert, may be deemed to constitute automated decision-making, even though the decision to intercept the customer belongs to the individual responsible for security. If that is the interpretation the CAI chooses to apply, then section 12.1. of the Québec Act is engaged. This means the adoption of this such surveillance technology would require:

• Specific signage to that effect; and
• An individual rights mechanism to:
• Inform individuals, upon request, of the personal information used to render the decision and the reasons and the principal factors and parameters that led to the decision;
• Correct the personal information as appropriate; and
• Receive observations from the individual by a staff member who is in a position to review the decision.

Even if the introduction of AI in the CCTVs does not come under section 12.1, it broadens the scope of collection and use of personal information and must be disclosed. Signage must therefore reflect this technology.

ii. Privacy issues around body-worn cameras for retail security personnel

After much debate in the context of police services, body-worn cameras (BWC) are making their way into the retail sector, often at the request of retail security employees. They are touted as solutions against employee abuse, particularly in the context of enforcement by retail staff of sanitary measures during the pandemic. The OPC Guidelines for Overt Video Surveillance in the Private Sector are relevant here as well, as is the Guidance for the use of body-worn cameras by law enforcement authorities, developed in consultation with all provincial and territorial commissioners.

In the Guidance for the use of body-worn cameras by law enforcement authorities, the commissioners raise the following privacy issues that extend to the private sector context:

• BWC significantly increase the collection of personal information, collecting audio-visual records focused on specific individuals;
• The microphone and the camera may record personal information from bystanders; and
• The BWC’s intrusiveness is such that they cannot be used unless “a demonstrable operational need” exists. They cannot be merely convenient.

A retail store or mall that envisages providing its security staff with BWC should consider the following:

• Acquiring all data necessary to demonstrate the necessity of the BWC and to offer a cogent case as to their effectiveness at addressing that necessity;
• Developing a specific corporate privacy policy applicable to the BWC to minimize collection of personal information, limit its use and retention of footage to strict necessity as well as restrict access of footage on the basis of the need to know;
• Applying appropriate data security safeguards;
• Providing sufficient public information on the use of the BWC and rights of individual access; and
• Adopting a process to address individual right of access requests.

In Québec, if the BWC includes facial recognition, the new Québec IT Act could require disclosing the adoption of the measure to the CAI, before implementation, as well as express consent from the customer before activating the camera if it is deemed to constitute technology used to verify or confirm a person’s identity.

iii. Reward apps for business intelligence

Increasingly, retail stores provide apps in exchange for rewards. Through some apps, the customer earns rewards just by walking into the store, which naturally requires location tracking. The 2022 joint investigation of the OPC, the CAI, the Office of the Information and Privacy Commissioner of Alberta and the Office of the Information and Privacy Commissioner for British Columbia into location tracking by the Tim Hortons App¹⁴ provides guidance on the use of this technology:

• No consent can support the use of an app for purposes a reasonable person would not deem appropriate;
• The collection of granular location data, such as the location of a user’s home and place of work, when they are travelling and when they visit a competitor constitutes sensitive personal information;
• The collection through an app of vast amounts of sensitive location information beyond any legitimate need does not constitute an appropriate purpose;
• The collection of data when the app is not in use represents a loss in privacy that is not proportional to the objective of gaining business intelligence for targeted marketing; and
• Valid consent requires:
  • An appropriate purpose, meaning a purpose limited to the granting of rewards;
  • Disclosure of sufficient and accurate information on the collection and use of personal information to ensure users understand the consequences of consenting to the app;
  • Limitation of collection and use to what is disclosed; and
  • Any agreement with a service provider to implement the app that contains contractual clauses to ensure the service provider’s compliance with privacy law.

Conclusion

We see two distinct trends with respect to the regulation of the use of surveillance technology in retail: some relaxation regarding surveillance for security purposes and a tightening regarding surveillance for business intelligence purposes. In support of the former, security incidents build a case of appropriate purpose, provided the surveillance technology is demonstrably necessary, proportionate and effective. In the latter case, the preservation of individual control over one’s personal information brings under scrutiny any surveillance technology to ensure appropriate purpose and valid consent.

The guiding test, therefore, in the implementation of security surveillance is “do we really need it”? In relation to business intelligence surveillance is “would consumers find it appropriate and if not, do they have control over it?”

For more information on this topic, please contact the author Chantal Bernier.

1. Retail Safety Security Guide, https://www.retailcouncil.org/wp-content/uploads/2018/08/Safe-Work-x-RCC-Retail-Safety-Guide.pdf ↩
2. In relation to PIPEDA, Nammo v. TransUnion of Canada Inc., 2010 FC 1284 at paragraph 74, followed by Bertucci v. Royal Bank of Canada, 2016 FC 332, at paragraph 34. In relation to Alberta PIPA, Alberta (Information and Privacy Commissioner) v. United Food and Commercial Workers, Local 401, 2013 SCC 62 at paragraphs 19 and 22. ↩
3. Section 8, “Everyone has the right to be secure against unreasonable search or seizure.” ↩
4. R. v. Oakes, [1986] SCR 1 103 at paragraphs 70 and 71 ↩
5. Proposed Section 18(3):
   An organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for the purpose of an activity in which the organization has a legitimate interest that outweighs any potential adverse effect on the individual resulting from that collection or use and
   (a)   a reasonable person would expect the collection or use for such an activity; and
   (b)   the personal information is not collected or used for the purpose of influencing the individual’s behaviour or decisions. ↩
6. Results of Commissioner Initiated Investigation into Bell’s Relevant Ads Program ↩
7. Joint investigation into location tracking by the Tim Hortons App ↩
8. As per note 5 and Investigation into Home Depot of Canada Inc.’s compliance with PIPEDA ↩
9. As per notes 5 and 6. ↩
10. As per note 5. ↩
11. As per note 7. ↩
12. Investigation into Home Depot of Canada Inc.’s compliance with PIPEDA ↩
13. Section 4 ↩
14. Joint investigation into location tracking by the Tim Hortons App at https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2022/pipeda-2022-001/↩