A Canadian real estate company already under investigation for using facial recognition technology in malls may also be tracking the movement of shoppers using mobile phones.

A former employee of Cadillac Fairview told CBC News he was aware of at least one of the company's Canadian shopping centres that had a system installed to track cellphone movement throughout the mall to collect market research data.

CBC News has agreed to keep the former employee's identity confidential. He worked directly for Cadillac Fairview in security for more than three years, and was responsible for providing access for the system's installation in 2016.

He said he was told the system would monitor and note where each device, such as a cellphone, went within the centre, and how long it remained in any particular location, "whether you were just walking through the mall or whether you're spending hours there dropping thousands upon thousands of dollars."

Real estate company refused to confirm

Cadillac Fairview did not respond to repeated questions from CBC News about whether this system is still installed in its shopping centres and where it is used in Canada.

The company's online privacy policy says some properties are equipped with sensors and cameras used to monitor foot traffic patterns that could predict "demographic information" about visitors during a shopping centre visit.

It also mentions tracking foot traffic using information such as a MAC address — a unique number that identifies any device capable of connecting to Wi-Fi.

This mall directory at Chinook Centre in Calgary has a camera embedded within it, as circled in red on the left. Cadillac Fairview says it has stopped using facial recognition software on these directories for now. (Anis Heydari/CBC)

Cadillac Fairview had already acknowledged it uses facial recognition software and cameras in mall directories to track shoppers' ages and genders without telling them.

The admission came after a patron noticed software running on one of the directories at Calgary's Chinook Centre and posted an image to social media site Reddit.

In an earlier email to CBC News on that issue, Cadillac Fairview's director of corporate communications, Janine Ramparas, said the company was suspending use of those mall directory cameras in response to recently announced privacy commissioner investigations.

'They can combine the information and identify you'

Privacy experts told CBC News this type of tracking technology has existed and been in use for years.

"When a person enters any property, they can be tracked by the signal and the unique identifications of their cellphone," said Sharon Polsky, president of the Privacy and Access Council of Canada.

Her organization had previously asked Alberta's privacy commissioner to investigate whether Cadillac Fairview's use of facial recognition was violating laws.

'When a person enters any property, they can be tracked by the signal and the unique identifications of their cellphone,' says Sharon Polsky of the Privacy and Access Council of Canada. (Anis Heydari/CBC)

"They can track exactly where you go, how long you stand in front of a shop window, how long you're in front of a particular display," said Polsky.

The privacy advocate said it would be possible for facial recognition data to be cross-referenced with location tracking data in the future, if a company chooses to do so.

"Don't forget that Person X is holding Phone Y," said Polsky. "Because the information is available elsewhere, they can combine the information and identify you."

It's nobody's business where you go and what stores you shop at. - Ann Cavoukian ​, Privacy by Design Centre of Excellence at Ryerson University

Other experts say there could be unintended consequences from these technologies. They include Ann Cavoukian, Ontario's former privacy commissioner who now leads the Privacy by Design Centre of Excellence at Ryerson University in Toronto.

"You might think no big deal, just counting footsteps, counting how many people are here and what stores, etc.," said Cavoukian.

Ann Cavoukian, former privacy commissioner for Ontario, says being able to opt in and out of whether you are tracked on a property is key. (Andy Hincenbergs/CBC)

"But when you link that with people's individual mobile phones, which are linked to their identity, and you're watching their movements — you're tracking their movements throughout the mall and add facial recognition to that. I mean it's nobody's business where you go and what stores you shop at."

Mall signage does not provide details

Experts like Cavoukian say being able to opt in and out of whether you are tracked on a property is key.

"I may not have a problem with people accessing that information about me, but others might. That's why you have to be the one to decide who has access to your information. It's gotta be on a consent basis."

This directory in Chinook Centre was using facial recognition technology. The mall says it has suspended use of that technology for now. (Sarah Rieger/CBC)

Signage outside Cadillac Fairview shopping centres in Calgary did not mention location tracking or facial recognition specifically, but there is notice that the premises is video recorded for "safety and security."

If location tracking is taking place, there's no discernible information about it.

Entrances to both Calgary's Market Mall and Chinook Centre did not provide information on how to consent or opt out of possible location tracking within the premises, and on multiple visits to both Calgary properties, CBC News was unable to locate public information on location tracking posted inside or outside the mall.

Signage on the doors to the Chinook Centre doesn't reference location tracking potentially happening inside. (Anis Heydari/CBC)

Cadillac Fairview's privacy policy says it does not consider tracking your location throughout the mall to be "personal information, unless you have specifically identified yourself to us and provided consent."

According to Cavoukian, that may have been true in the past, but new technologies change things, especially given Cadillac Fairview's recent admission of using facial recognition in its facilities.

"The difference with the old-fashioned guy at the front of the store clicking is … he gets a count of the people who walked in, walked out," said Cavoukian.

"With these new technologies, you can make inferences about individuals on a personally identifiable basis, and when you add facial recognition to that, that's the most sensitive form of personal information."