Major Australian retailers Kmart, Bunnings and The Good Guys are using facial recognition technology in stores, raising concerns among privacy experts. 

The use of this developing technology, which captures and stores unique biometric information such as facial features (known as a 'faceprint'), would come as news to most customers.

We asked 25 leading Australian retailers whether they use facial recognition technology, and analysed their privacy policies. Based on the policies and the responses we received, Kmart, Bunnings and The Good Guys appear to be the only three that are capturing the biometric data of their customers. 

Privacy policies not easy to find

"Most of these privacy policies you have to search for online, and they're often not easy to find," says CHOICE consumer data advocate Kate Bower. "But because we're talking about in-person retail shops, it's likely that no one is reading a privacy policy before they go into a store." 

CHOICE staff members also visited some of these stores in person as part of the investigation. 

Bower says the Kmart and Bunnings stores they visited had physical signs at the store entrances informing customers about the use of the technology, but the signs were small, inconspicuous and would have been missed by most shoppers. 

The collection of biometric data in such a manner may be in breach of the Privacy Act.

Shoppers in the dark 

Between March and April 2022, CHOICE canvassed more than 1000 Australians in a nationally representative survey to gauge consumer awareness of facial recognition technology. 

The results indicate that most people are in the dark. More than three in four respondents (76%) said they didn't know retailers were using facial recognition. 

Those who suspected it was being used wrongly named Coles and Woolworths as the most likely culprits.  

'Creepy and invasive'

This lack of awareness doesn't mean people aren't concerned. Most survey respondents (83%) say retail stores should be required to inform customers about the use of facial recognition before they enter the store, and 78% expressed concern about the secure storage of faceprint data. 

Almost two thirds of respondents (65%) are concerned about stores using the technology to create profiles of customers that could cause them harm. 

Some survey respondents describe facial recognition technology as "creepy and invasive". Others say they consider it "unnecessary and dangerous" and wouldn't want to enter a store that's using it.  

Signage at the Kmart store in Marrickville, New South Wales.

Facial recognition on the rise 

Mark Andrejevic, professor of media studies at Monash University and a member of the ARC Centre of Excellence for Automated Decision-Making and Society, tells CHOICE that the use of facial recognition by retailers is in its early stages in Australia. But he predicts it will increase as the technology becomes cheaper and more effective. 

We don't have a clear set of regulations or guidelines on the appropriate use of the technology

Professor Mark Andrejevic, Monash University

"The first concern is notice and consent, it's not in highly visible forms of public notification that would invite people to understand what's taking place," says Andrejevic. 

"I think the other set of concerns is we don't have a clear set of regulations or guidelines on the appropriate use of the technology. That leaves it pretty wide open. Stores may be using it for the purposes of security now, but down the road, they may also include terms of use that would say that they can use it for marketing purposes." 

'Great concern'

Edward Santow is a professor at the University of Technology Sydney who focuses on the responsible use of technology. As a former Australian Human Rights Commissioner, he also led work on artificial intelligence. Santow says facial recognition technology raises serious questions for our society. 

"Even if that technology was perfectly accurate, and it's not, but even if it were, it also takes us into the realm of mass surveillance," he says. "And I think there will be great concern in the Australian community about walking down that path."

Bunnings responds 

Simon McDowell, Bunnings' chief operating officer, tells CHOICE that facial recognition is one of several measures the retailer has in place to prevent theft and anti-social behaviour. 

"At selected stores our CCTV systems utilise facial recognition technology, which is used to help identify persons of interest who have previously been involved in incidents of concern in our stores," he says. 

This technology is an important measure that helps us to maintain a safe and secure environment for our team and customers

Simon McDowell, Bunnings chief operating officer

"We let customers know about our use of CCTV and facial recognition technology through signage at our store entrances and also in our privacy policy, which is available on our website. 

"It's really important to us that we do everything we can to discourage poor behaviour in our stores, and we believe this technology is an important measure that helps us to maintain a safe and secure environment for our team and customers." 

No word from Kmart or The Good Guys

Kmart and The Good Guys didn't respond to our questions about their reasons for using facial recognition technology. The Good Guys' privacy policy claims the use of the technology is for the purposes of security, theft prevention, and managing and improving the customer experience. 

Breach of the Privacy Act? 

CHOICE's Kate Bower says the Privacy Act considers biometric information such as unique faceprints sensitive data, and that a higher standard is applied to it than to other types of personal information. 

"It requires that your collection of that information has to be suitable for the business purpose that you're collecting it for, and that it can't be disproportionate to the harms involved," she says. 

We believe that these retail businesses are disproportionate in their over collection of this information, which means that they may be in breach of the Privacy Act

Kate Bower, CHOICE consumer data advocate

"We also believe that these retail businesses are disproportionate in their over collection of this information, which means that they may be in breach of the Privacy Act. We intend to refer them to the Information Commissioner on that basis." 

Bower adds that, irrespective of whether the retailers are in breach of the Act or not, clearer and stronger regulations are needed around customer consent and how retailers obtain and use facial recognition data. 

Opportunity to strengthen protection

The Attorney General is currently carrying out a five-year review of the Privacy Act. Bower says it's an opportunity to strengthen measures around the capture and use of consumer data, including biometric data. 

Professor Santow agrees that more work needs to be done. "Certainly in Europe, there are stronger border privacy protections, and there are proposals in place to go further," he says. 

Andrejevic says he's concerned that the public remains largely unaware of what's going on regarding the capture and use of their personal data. "When I look at the Australian context, I see the creeping use of the technology without widespread public discussion," he says.  

Stock images: Getty, unless otherwise stated.

Join the conversation

To share your thoughts or ask a question, visit the CHOICE Community forum.

Visit CHOICE Community