[vel0city]

Personal information under these laws are defined as:

    age, name, ID numbers, income, ethnic origin, or blood type;
    opinions, evaluations, comments, social status, or disciplinary actions; and
    employee files, credit records, loan records, medical records, existence of a dispute between a consumer and a merchant, intentions (for example, to acquire goods or services, or change jobs).

How does video of people passing by meet such a definition?

[jellicle]

Just to be clear (because the article isn't), what CF did was install a bunch of computerized kiosks to replace the information map kiosks, then when anyone used those kiosks (peering at screen from 2 feet away, tapping at it), a hidden camera (no external indication that there's a camera behind the black glass screen) recorded their face and what store they were looking for. This was intentional to collect and store info about individual mall users.

It wasn't some security camera overlooking the concourse from 30 feet up or anything like that.

[hibbelig]

They stopped a representation that allowed them to identify that the same person visited again. That’s an id number. They guessed age and gender.

[YetAnotherNick]

By ID, gp likely means government id, not identification by face. I can recognise my neighbours, but that doesn't mean I have their personal information.

[hibbelig]

In Europe, data that can be used to identify a person is also protected. For example, IP address plus timestamp is protected. Because you could obtain customer information from the ISP.

That's how I understand things.

[0xCMP]

The intent to buy things in the mall (or not) for one

[nitrogen]

Age and (to a limited extent) ethnic origin can also be inferred from video. So can income and social status, via apparel, posture, etc.