OAIC launches commission-initiated investigation into Kmart and Bunnings' use of facial recognition
The Office of the Australian Information Commissioner has opened investigations into the personal information handling practices of Bunnings Group Limited and Kmart Australia Limited, focusing on the companies' use of facial recognition technology, according to a media release on the OAIC website. It says "the investigations follow a report from consumer advocacy group CHOICE about the retailers' use of facial recognition technology."
CHOICE welcomes the Commissioner-initiated investigation as a big step forward in protecting Australian consumers from the harms of unnecessary and invasive facial recognition technology.
The Good Guys puts facial recognition on hold
The Good Guys has paused the use of facial recognition technology in its stores while the Office of the Australian Information Commission (OAIC) investigates the complaint made by CHOICE.
"The Good Guys today confirmed it will pause the trial of the upgraded security system with the optional facial recognition technology," said a spokesperson for the appliance retailer. "The decision was made to pause the trial at this time pending any clarification from the OAIC regarding the use of this technology."
Need to know
- Kmart, Bunnings and The Good Guys are using facial recognition technology in retail stores
- Despite some limited signage in some stores, customers remain largely unaware of the practice
- Privacy experts are raising the alarm and CHOICE says they may be in breach of the Privacy Act
Major Australian retailers Kmart, Bunnings and The Good Guys are using facial recognition technology in stores, raising concerns among privacy experts.
The use of this developing technology, which captures and stores unique biometric information such as facial features (known as a 'faceprint'), would come as news to most customers.
We asked 25 leading Australian retailers whether they use facial recognition technology, and analysed their privacy policies. Based on the policies and the responses we received, Kmart, Bunnings and The Good Guys appear to be the only three that are capturing the biometric data of their customers.
Privacy policies not easy to find
CHOICE staff members also visited some of these stores in person as part of the investigation.
Bower says the Kmart and Bunnings stores they visited had physical signs at the store entrances informing customers about the use of the technology, but the signs were small, inconspicuous and would have been missed by most shoppers.
The collection of biometric data in such a manner may be in breach of the Privacy Act.
Shoppers in the dark
Between March and April 2022, CHOICE canvassed more than 1000 Australians in a nationally representative survey to gauge consumer awareness of facial recognition technology.
The results indicate that most people are in the dark. More than three in four respondents (76%) said they didn't know retailers were using facial recognition.
Those who suspected it was being used wrongly named Coles and Woolworths as the most likely culprits.
'Creepy and invasive'
This lack of awareness doesn't mean people aren't concerned. Most survey respondents (83%) say retail stores should be required to inform customers about the use of facial recognition before they enter the store, and 78% expressed concern about the secure storage of faceprint data.
Almost two thirds of respondents (65%) are concerned about stores using the technology to create profiles of customers that could cause them harm.
Some survey respondents describe facial recognition technology as "creepy and invasive". Others say they consider it "unnecessary and dangerous" and wouldn't want to enter a store that's using it.
Signage at the Kmart store in Marrickville, New South Wales.
Facial recognition on the rise
Mark Andrejevic, professor of media studies at Monash University and a member of the ARC Centre of Excellence for Automated Decision-Making and Society, tells CHOICE that the use of facial recognition by retailers is in its early stages in Australia. But he predicts it will increase as the technology becomes cheaper and more effective.
We don't have a clear set of regulations or guidelines on the appropriate use of the technologyProfessor Mark Andrejevic, Monash University
"The first concern is notice and consent, it's not in highly visible forms of public notification that would invite people to understand what's taking place," says Andrejevic.
Edward Santow is a professor at the University of Technology Sydney who focuses on the responsible use of technology. As a former Australian Human Rights Commissioner, he also led work on artificial intelligence. Santow says facial recognition technology raises serious questions for our society.
"Even if that technology was perfectly accurate, and it's not, but even if it were, it also takes us into the realm of mass surveillance," he says. "And I think there will be great concern in the Australian community about walking down that path."
Simon McDowell, Bunnings' chief operating officer, tells CHOICE that facial recognition is one of several measures the retailer has in place to prevent theft and anti-social behaviour.
"At selected stores our CCTV systems utilise facial recognition technology, which is used to help identify persons of interest who have previously been involved in incidents of concern in our stores," he says.
This technology is an important measure that helps us to maintain a safe and secure environment for our team and customersSimon McDowell, Bunnings chief operating officer
"It's really important to us that we do everything we can to discourage poor behaviour in our stores, and we believe this technology is an important measure that helps us to maintain a safe and secure environment for our team and customers."
No word from Kmart or The Good Guys
Breach of the Privacy Act?
CHOICE's Kate Bower says the Privacy Act considers biometric information such as unique faceprints sensitive data, and that a higher standard is applied to it than to other types of personal information.
"It requires that your collection of that information has to be suitable for the business purpose that you're collecting it for, and that it can't be disproportionate to the harms involved," she says.
We believe that these retail businesses are disproportionate in their over collection of this information, which means that they may be in breach of the Privacy ActKate Bower, CHOICE consumer data advocate
"We also believe that these retail businesses are disproportionate in their over collection of this information, which means that they may be in breach of the Privacy Act. We intend to refer them to the Information Commissioner on that basis."
Bower adds that, irrespective of whether the retailers are in breach of the Act or not, clearer and stronger regulations are needed around customer consent and how retailers obtain and use facial recognition data.
Opportunity to strengthen protection
The Attorney General is currently carrying out a five-year review of the Privacy Act. Bower says it's an opportunity to strengthen measures around the capture and use of consumer data, including biometric data.
Professor Santow agrees that more work needs to be done. "Certainly in Europe, there are stronger border privacy protections, and there are proposals in place to go further," he says.
Andrejevic says he's concerned that the public remains largely unaware of what's going on regarding the capture and use of their personal data. "When I look at the Australian context, I see the creeping use of the technology without widespread public discussion," he says.
CHOICE Consumer Pulse March 2022 is based on a survey of 1034 Australian households. Quotas were applied for representations in each age group, as well as genders and location, to ensure coverage in each state and territory across metropolitan and regional areas. Fieldwork was done between 22 March and 7 April 2022.
Stock images: Getty unless otherwise stated.