Canadian Mall Operator Illegally Collected Shoppers' Biometric Data Using AI Facial Recognition

The event explicitly mentions the use of facial-recognition technology, an AI system, to analyze shoppers' age and gender without consent. The collection and storage of biometric data without meaningful consent violates privacy laws, constituting a breach of fundamental rights. The AI system's use directly led to this harm, fulfilling the criteria for an AI Incident under violations of human rights and applicable law. Therefore, this event is classified as an AI Incident.

The event explicitly involves an AI system (facial recognition technology) used to analyze biometric data. The use of this AI system without meaningful consent led to a violation of privacy rights, which falls under harm category (c) - violations of human rights or breach of obligations under applicable law protecting fundamental rights. The harm has already occurred as millions of images and biometric data were collected and stored without consent. Therefore, this qualifies as an AI Incident rather than a hazard or complementary information.

The event explicitly involves an AI system (facial recognition technology) used to collect personal biometric data without consent, which is a violation of privacy rights under applicable law. The AI system's use directly led to harm in the form of privacy violations and potential exposure of sensitive biometric data. The involvement of federal and provincial privacy commissioners and the investigation confirms the breach of legal obligations. Therefore, this qualifies as an AI Incident due to violations of human rights and legal obligations related to privacy.

The event explicitly involves the use of facial recognition AI technology to collect and analyze biometric data of shoppers without their express consent, which is a violation of privacy rights and applicable law. The AI system's use directly led to the unauthorized collection and storage of sensitive personal data, fulfilling the criteria for an AI Incident under violations of human rights and legal obligations. The investigation and subsequent removal of the technology do not negate the fact that harm occurred through the illegal data collection.

The use of facial recognition technology to covertly collect sensitive biometric information without consent directly breaches privacy rights and legal protections. This constitutes a violation of human rights and applicable privacy laws, fulfilling the criteria for an AI Incident as the AI system's use has directly led to a breach of obligations intended to protect fundamental rights.

The event explicitly involves the use of an AI system (facial recognition software) that processed biometric data without meaningful consent, violating privacy rights and legal protections. The AI system's use directly led to harm in the form of unauthorized collection and storage of sensitive personal information, constituting a breach of human rights and privacy laws. The investigation by privacy commissioners confirms the misuse and lack of compliance with legal frameworks. Therefore, this qualifies as an AI Incident due to violations of human rights and legal obligations related to biometric data use.

The event explicitly mentions the use of facial recognition software, an AI system, to collect and analyze sensitive biometric information without customers' knowledge or consent. This constitutes a violation of privacy rights and applicable laws protecting personal data, which falls under violations of human rights or breach of legal obligations. The collection and storage of biometric data without consent is a direct harm to individuals' privacy and identity rights. Therefore, this qualifies as an AI Incident due to the realized harm caused by the AI system's use in this context.

The event explicitly involves an AI system using facial recognition technology to collect biometric data without meaningful consent, violating privacy rights and legal obligations. The harm is realized as individuals' biometric data were collected and stored without proper consent, constituting a breach of fundamental rights. The AI system's use directly led to this harm. The company's failure to ensure meaningful consent and the unauthorized storage of data further support classification as an AI Incident. The event is not merely a potential risk or a complementary update but a clear case of harm caused by AI use.

The use of facial recognition software to capture images without consent directly implicates an AI system's use leading to a violation of privacy rights, which falls under breaches of obligations under applicable law protecting fundamental rights. The collection of five million images without knowledge or consent is a clear harm to individuals' privacy, making this an AI Incident.

The event explicitly involves an AI system (facial recognition software) used to collect and analyze biometric data without consent, violating privacy laws and fundamental rights. The harm is realized as the privacy of millions of individuals was compromised, and the data was stored by a third party without proper oversight, increasing risks of misuse or breach. The investigation confirms the unauthorized use and lack of meaningful consent, fulfilling the criteria for an AI Incident under violations of human rights and legal obligations.

The event explicitly involves an AI system (facial recognition software) used to analyze biometric data (age and gender) from shoppers without consent, violating Canada's privacy laws (PIPEDA). This constitutes a breach of legal obligations intended to protect fundamental rights, specifically privacy rights. The harm is realized as the data was collected and stored for millions of individuals, and the privacy commissioner has raised serious concerns. The event is not merely a potential risk or a response update but a confirmed violation caused by the AI system's use, fitting the definition of an AI Incident.

The event clearly involves an AI system—facial recognition technology—that was used to analyze images of shoppers to infer age and gender. The use of this AI system led to a breach of privacy rights and legal obligations regarding personal data collection and consent, fulfilling the criteria for an AI Incident under violations of human rights or breach of applicable law. The harm is realized as it affected millions of individuals' biometric data without their knowledge or consent, and the investigation confirms the misuse and inadequate controls over the data. Therefore, this is classified as an AI Incident.

The event explicitly involves an AI system—facial recognition technology—used to analyze biometric data (age, gender, facial images). The use of this AI system led to violations of privacy rights and legal obligations, as personal biometric information was collected and stored without meaningful consent. This constitutes a breach of fundamental rights and applicable privacy laws, fulfilling the criteria for an AI Incident under violations of human rights or breach of legal obligations protecting fundamental rights. The harm is realized, as customers' sensitive biometric data was collected and stored improperly, and the investigation confirmed these violations.

The event explicitly involves an AI system (facial recognition technology) used to analyze biometric data. The use and malfunction (improper consent and data storage) of this AI system directly led to violations of privacy rights, a breach of applicable law protecting fundamental rights. The harm has already occurred, as confirmed by privacy commissioners, making this an AI Incident rather than a hazard or complementary information. The company's refusal to commit to proper consent in the future is noted but does not change the classification of this past harm.

The article explicitly mentions the use of facial-recognition technology based on machine-learning algorithms, which qualifies as an AI system. The unauthorized collection of five million images without consent constitutes a violation of privacy rights, a breach of obligations under applicable law protecting fundamental rights. The involvement of AI in this harm is direct, as the AI system was used to process and analyze images for age and gender recognition without consent. Hence, this event meets the criteria for an AI Incident due to realized harm involving human rights violations.

The event explicitly involves the use of an AI system—facial recognition technology embedded in kiosks—that collected biometric data without consent, violating privacy rights and legal frameworks. The harm is realized, as millions of individuals' biometric data were collected secretly, constituting a breach of fundamental rights and privacy laws. The privacy commissioners' investigation and findings confirm the direct link between the AI system's use and the harm caused. Hence, this is classified as an AI Incident.

The event involves the use of facial recognition software, an AI system, to collect and analyze biometric data of individuals without consent, which constitutes a violation of privacy rights and applicable data protection laws. The unauthorized collection and storage of sensitive biometric information directly breaches fundamental rights related to privacy and data protection, fulfilling the criteria for an AI Incident under violations of human rights or breach of legal obligations. The involvement of AI in the development and use stages led to realized harm through privacy violations and potential risks of misuse or data breaches.

The event explicitly involves an AI system (facial recognition technology) used to process biometric data. The use of this AI system directly led to a violation of privacy rights, a breach of fundamental human rights and legal obligations. The unauthorized data collection and storage, combined with insufficient consent measures, caused harm to individuals' privacy. The event describes realized harm rather than a potential risk, meeting the criteria for an AI Incident rather than an AI Hazard or Complementary Information.

The event describes the use of an AI system (facial recognition technology) in a way that violated privacy laws and fundamental rights by collecting personal data without consent. This constitutes a breach of obligations under applicable law intended to protect fundamental rights, fitting the definition of an AI Incident. The harm is realized (privacy violation), and the AI system's use directly led to this harm. Therefore, this is classified as an AI Incident.

The use of facial recognition technology constitutes an AI system as it processes biometric data to infer age and gender. The collection and storage of sensitive biometric information without consent is a violation of privacy rights, which falls under violations of human rights and applicable law. The involvement of AI in unauthorized data collection and storage directly led to harm in terms of privacy breaches and potential misuse of data, qualifying this as an AI Incident.

The event explicitly mentions the use of facial recognition software and video analytics AI systems to collect biometric data without consent, which is a violation of privacy laws and fundamental rights. The unauthorized collection and storage of biometric data from five million shoppers is a clear harm to individuals' rights and privacy. The company's failure to obtain informed consent and the risk of data breaches further underline the harm caused. Therefore, this qualifies as an AI Incident due to the direct involvement of AI systems in causing violations of rights and privacy harm.

The event explicitly involves the use of an AI system—facial recognition technology—to collect and analyze biometric data. The use of this AI system directly led to violations of privacy rights and contravention of privacy laws, which are breaches of obligations intended to protect fundamental rights. The lack of meaningful consent and the unauthorized storage of derived personal information demonstrate harm to individuals' rights. Therefore, this event meets the criteria for an AI Incident due to the realized harm caused by the AI system's use.

The event explicitly involves an AI system—facial-recognition technology—used to analyze shoppers' images. The use of this AI system led to the collection and storage of sensitive biometric data without meaningful consent, constituting a violation of privacy rights and applicable laws protecting personal data. This harm to individuals' rights and privacy meets the criteria for an AI Incident, as the AI system's use directly led to a breach of obligations under applicable law and harm to individuals' rights.

The use of facial-recognition technology qualifies as an AI system. The collection and analysis of facial images without consent, along with the storage of sensitive biometric data, directly violates privacy laws and fundamental rights. This constitutes harm under the category of violations of human rights or breach of legal obligations. Hence, this event is classified as an AI Incident due to the realized harm caused by the AI system's use without proper consent and legal compliance.

The event clearly involves an AI system (facial recognition) used to collect biometric data surreptitiously, leading to violations of privacy rights and data protection laws, which are breaches of legal obligations protecting fundamental rights. The harm is realized through unauthorized data collection and storage, and the risk of misuse or breach of sensitive biometric data. Therefore, this qualifies as an AI Incident due to violations of human rights and legal obligations related to privacy and data protection.

The event explicitly involves an AI system (facial-recognition technology) used without meaningful consent, leading to the collection and storage of sensitive biometric data. This constitutes a violation of privacy rights and applicable laws, fulfilling the criteria for an AI Incident under violations of human rights and legal obligations. The harm has already occurred as personal data was collected and stored improperly, and the privacy commissioners' investigation confirms the breach.

The event explicitly involves an AI system (facial recognition technology) used to analyze biometric data of individuals. The use of this AI system directly led to a violation of privacy laws and fundamental rights due to the lack of informed consent and improper data handling. The harm is realized as it involves breaches of privacy and personal data protection laws, which fall under violations of human rights and legal obligations. Therefore, this qualifies as an AI Incident.

The event describes Cadillac Fairview's use of facial recognition AI systems in mall directories to collect biometric information from millions of shoppers without meaningful consent, which constitutes a violation of privacy rights and applicable laws protecting personal data. The AI system's use directly led to harm in the form of privacy violations and potential exposure of sensitive biometric data, fulfilling the criteria for an AI Incident under violations of human rights and legal obligations. The company's failure to obtain proper consent and the storage of biometric data with third parties further supports this classification.

The event explicitly involves an AI system (facial recognition technology) used without consent to collect and analyze biometric data from millions of individuals, constituting a violation of privacy rights and applicable laws. This meets the criteria for an AI Incident because the AI system's use directly led to a breach of fundamental rights (privacy and data protection). The harm is realized, as confirmed by the investigation and regulatory concern, not merely potential. Therefore, this event is classified as an AI Incident.

The event explicitly involves an AI system analyzing images to infer personal information such as age and gender, which qualifies as AI system involvement. The use of this AI system without consent constitutes a violation of privacy rights, a breach of obligations under applicable law protecting fundamental rights. The harm is realized as personal data was collected without permission, and there is a credible risk of identity theft and misuse of biometric data. Therefore, this qualifies as an AI Incident due to the direct and indirect harm caused by the AI system's use in collecting personal data without consent.

The event explicitly involves an AI system (facial recognition technology) used to collect and analyze biometric data without consent, which is a violation of privacy rights and applicable laws. The commissioners' investigation confirms that personal information was collected and retained improperly, constituting a breach of fundamental rights. The harm is realized, not just potential, as millions of images were collected and analyzed without meaningful consent. The company's subsequent removal of the technology and data deletion is a response but does not negate the incident. Therefore, this qualifies as an AI Incident due to direct harm to individuals' privacy rights caused by the AI system's use.

The event explicitly involves an AI system (facial recognition technology) used to collect and analyze biometric data without consent, which is a violation of privacy rights and applicable laws. The commissioners' investigation confirms that personal information was collected and analyzed, constituting a breach of rights. The harm is realized, not just potential, as millions of images were collected and analyzed without meaningful consent. Therefore, this qualifies as an AI Incident due to violation of human rights and privacy laws caused by the AI system's use.

The event explicitly involves an AI system (facial recognition technology) used to analyze biometric data without proper consent, violating privacy laws. The collection and storage of sensitive biometric information without adequate controls constitute a breach of legal obligations and human rights related to privacy. The harm has already occurred as per the investigation findings, making this an AI Incident rather than a hazard or complementary information. The company's later disabling of the system and data deletion is a response but does not negate the incident.

The event explicitly involves the use of facial-recognition AI technology to collect biometric data without meaningful consent, violating privacy laws and rights. The AI system's use directly led to harm in the form of unauthorized data collection and potential privacy breaches. The involvement of AI in the development and use phases, combined with the realized harm to individuals' privacy rights, meets the criteria for an AI Incident under the OECD framework.

The event explicitly involves the use of facial recognition AI technology to analyze biometric data without consent, which is a violation of privacy rights and applicable laws protecting personal information. The collection and analysis of sensitive biometric data without meaningful consent is a clear breach of fundamental rights, fulfilling the criteria for harm under (c) violations of human rights or breach of obligations under applicable law. The harm is realized, not just potential, as millions of images were collected and analyzed. The company's subsequent removal of cameras and deletion of data is a response but does not negate the incident. Hence, this is classified as an AI Incident.

The event explicitly involves an AI system (facial-recognition technology) used to analyze shoppers' images without consent, which is a violation of privacy laws and fundamental rights. The misuse of biometric data and failure to obtain meaningful consent directly caused harm to individuals' privacy rights, fitting the definition of an AI Incident under violations of human rights or breach of legal obligations. The company's actions and the privacy commissioners' findings confirm the realized harm rather than a potential risk, so this is classified as an AI Incident.

The event explicitly involves the use of facial recognition AI systems to collect and analyze biometric data without meaningful consent, which is a violation of privacy rights and legal protections. The unauthorized storage of sensitive biometric data in a centralized database by a third party increases the risk of misuse or data breaches, constituting harm to individuals' rights. The company's lack of awareness and refusal to commit to obtaining express consent further compounds the issue. Therefore, this qualifies as an AI Incident due to violations of human rights and legal obligations related to biometric data privacy.

The event explicitly mentions the use of facial-recognition technology, which is an AI system, to analyze shoppers' age and gender by collecting facial images. The collection and storage of biometric data without meaningful consent constitutes a violation of privacy rights, which falls under violations of human rights or breach of applicable law protecting fundamental rights. The harm has already occurred as personal biometric data was collected and stored improperly, making this an AI Incident rather than a hazard or complementary information. The company's removal of cameras and refusal to commit to future consent protocols is a response but does not negate the incident classification.

The event describes the use of an AI system (camera with demographic inference capabilities) that collected sensitive biometric information without proper consent, leading to a privacy violation. The federal privacy commissioner confirmed the breach, and the company has ceased using the technology but is under investigation. The harm is a violation of privacy rights, a breach of applicable law protecting fundamental rights, which fits the definition of an AI Incident. The AI system's use directly led to this harm, even if no physical injury occurred. Hence, the classification as AI Incident is appropriate.

The event involves an AI system (facial recognition software AVA) used to analyze biometric data (age and sex) from customers without their consent, which is a violation of privacy rights protected by law. The unauthorized collection and processing of biometric data constitute a breach of obligations under applicable law protecting fundamental rights. The harm (privacy violation) has already occurred, making this an AI Incident. The company's cessation of the practice and data deletion are responses but do not negate the incident itself.

The event explicitly involves an AI system—facial recognition technology—used to analyze images of people's faces. The use was without meaningful consent, constituting a violation of privacy rights, which falls under harm category (c) regarding violations of human rights or legal protections. The collection and storage of sensitive biometric data without consent and the risk of unauthorized use or data breaches represent direct harm caused by the AI system's deployment. Therefore, this qualifies as an AI Incident.

The article explicitly states that Cadillac Fairview used facial recognition technology (an AI system) to collect and analyze biometric data without consent, violating privacy laws and fundamental rights. The harm is realized as it involves unauthorized collection and storage of sensitive biometric data, which is a violation of human rights and legal protections. The AI system's use directly led to this breach, fulfilling the criteria for an AI Incident under violations of human rights and legal obligations.

The event involves the use of an AI system (facial recognition technology) whose deployment led to the collection of sensitive biometric data without valid consent, violating privacy laws and fundamental rights. The harm is realized, not just potential, as privacy commissioners have confirmed the breach and legal non-compliance. The AI system's use directly caused this harm, fulfilling the criteria for an AI Incident under violations of human rights and legal obligations. The event is not merely a potential risk or a complementary update but a confirmed incident of harm due to AI system use.