Yes, you do, because while a shopping mall might be considered a "public space," it is private property owned by a private organization. In Canada the PIPEDA [1] covers this federally, though the law is written such that it is a backstop, and provinces are free to enact their own "substantially similar" (or stricter) laws if they choose. For example, in Alberta the PIPA [2] covers these issues.
And as the article states, both federal and provincial privacy commissioners found CF in violation of those laws.
[1] https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-can...
[2] https://www.alberta.ca/personal-information-protection-act-o...
age, name, ID numbers, income, ethnic origin, or blood type;
opinions, evaluations, comments, social status, or disciplinary actions; and
employee files, credit records, loan records, medical records, existence of a dispute between a consumer and a merchant, intentions (for example, to acquire goods or services, or change jobs).
How does video of people passing by meet such a definition?That's how I understand things.
It wasn't some security camera overlooking the concourse from 30 feet up or anything like that.