> In Canada, do you even really have a right to privacy when in public spaces like a shopping mall?
Yes, you do, because while a shopping mall might be considered a "public space," it is private property owned by a private organization. In Canada the PIPEDA [1] covers this federally, though the law is written such that it is a backstop, and provinces are free to enact their own "substantially similar" (or stricter) laws if they choose. For example, in Alberta the PIPA [2] covers these issues.
And as the article states, both federal and provincial privacy commissioners found CF in violation of those laws.
Personal information under these laws are defined as:
age, name, ID numbers, income, ethnic origin, or blood type;
opinions, evaluations, comments, social status, or disciplinary actions; and
employee files, credit records, loan records, medical records, existence of a dispute between a consumer and a merchant, intentions (for example, to acquire goods or services, or change jobs).
How does video of people passing by meet such a definition?
Just to be clear (because the article isn't), what CF did was install a bunch of computerized kiosks to replace the information map kiosks, then when anyone used those kiosks (peering at screen from 2 feet away, tapping at it), a hidden camera (no external indication that there's a camera behind the black glass screen) recorded their face and what store they were looking for. This was intentional to collect and store info about individual mall users.
It wasn't some security camera overlooking the concourse from 30 feet up or anything like that.
By ID, gp likely means government id, not identification by face. I can recognise my neighbours, but that doesn't mean I have their personal information.
In Europe, data that can be used to identify a person is also protected. For example, IP address plus timestamp is protected. Because you could obtain customer information from the ISP.
Yes, you do, because while a shopping mall might be considered a "public space," it is private property owned by a private organization. In Canada the PIPEDA [1] covers this federally, though the law is written such that it is a backstop, and provinces are free to enact their own "substantially similar" (or stricter) laws if they choose. For example, in Alberta the PIPA [2] covers these issues.
And as the article states, both federal and provincial privacy commissioners found CF in violation of those laws.
[1] https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-can...
[2] https://www.alberta.ca/personal-information-protection-act-o...