British Columbia’s privacy commissioner says Canadian Tire stores that used facial recognition technology didn’t adequately notify their customers and didn’t get consent to collect the personal information.

Michael McEvoy’s report says even if the four stores he investigated had obtained permission, they were still required to show a reasonable purpose for collecting the information, which the investigation found they didn’t do.

Twelve Canadian Tire stores were using the technology for about three years, saying it was needed for theft and staff safety, but the systems were removed and the information destroyed when the commissioner notified the chain that four stores were under investigation.

McEvoy says highly sensitive biometric information was captured by the systems between 2018 and 2021, and the stores would have had to make a compelling case to show it was reasonable to collect the precise mathematical rendering of each person’s face.

He says the stores contravened the Personal Information Protection Act and he has made recommendations to the government and the stores.

McEvoy says the stores need to develop and maintain a robust privacy management plan, while the B.C. government should change the laws that regulate the sale of biometric technology and create additional obligations for organizations that use it.

The commissioner says it’s ironic that there are regulations for those who sell and install old closed-circuit television systems, but not for those who deploy the even more invasive facial recognition technology.

“I recognize retailers face a challenging environment, however they have to carefully consider the privacy rights of their customers before buying and installing new technologies that gather very sensitive personal information,” he said in a statement.