Australia's privacy laws aren't keeping up with the growing uses of facial recognition technology and new specific fit-for-purpose legislation is needed, according to academics and advocates.
"Australian privacy law is a bit like Swiss cheese," says former Australian human rights commissioner and UTS industry professor Edward Santow. "So there are so many gaps in that law and it doesn't effectively protect people from harmful uses of facial recognition.
"The law was never crafted with widespread facial recognition use in mind and we need a specific law to address it."
The law was never crafted with widespread facial recognition use in mind and we need a specific law to address it
Edward Santow, former Australian human rights commissioner and UTS professor
In June, a CHOICE investigation revealed that three major retailers, Kmart, Bunnings Warehouse and The Good Guys, were all using facial recognition technology, largely without customers' knowledge or consent.
Following the public outcry that surrounded the investigation, all three retailers eventually agreed to "pause" their use of the technology while the Office of the Australian Information Commissioner (OAIC) investigated the legality of its use. The OAIC investigation is ongoing.
Lack of legal certainty
Kate Bower, consumer data advocate at CHOICE, says a dedicated facial recognition technology law, like the one being proposed by Santow and UTS, would give certainty to businesses about legal uses of the technology.
"The law in its current state isn't doing the job in terms of telling retailers and other types of businesses who want to use this intrusive technology what's allowed and what isn't," she says.
The message is clear from consumers that they don't want facial recognition to be used in these stores, and that they want it to be regulated as a matter of urgency
Kate Bower, consumer data advocate
"The message is clear from consumers that they don't want facial recognition to be used in these stores, and that they want it to be regulated as a matter of urgency."
A CHOICE survey of more than 1000 people conducted between March and April this year found that almost eight in 10 respondents (76%) agreed to the statement: "Regulation is needed to protect consumers from harms caused by facial recognition use in retail settings".
A risk-based approach
Santow says that the innovative law being proposed by him and his colleagues at the Human Technology Institute (HTI) would take a "human rights risk-based" approach with different tiers of regulation for the different uses of the technology.
He says the law would treat the use of facial recognition technology by retail stores as "high-risk" and would prohibit its use, unless specific exemptions were sought from the regulator.
"The foundation of the law is a human rights one, it says some uses of facial recognition are harmful and should be subject to much stricter regulation, but it also acknowledges that in some settings it is reasonable and should be encouraged," he adds.
Urgent action needed, says CHOICE
Santow says, "We have seen some companies pulling back from their research and use of facial recognition because of concerns that the law doesn't provide enough protection to citizens. At the same time, we have seen other companies enter the facial recognition market, companies which are much less concerned with upholding the basic rights of consumers."
The proposal calls on the federal Attorney General Mark Dreyfus to introduce a law regulating facial recognition technology as a matter of urgency.
Bower says the use of facial recognition technology in Australia will only keep growing – so the time to regulate the space is now.
We'd really urge the federal government to take this opportunity to act to protect the safety and privacy of Australians
Kate Bower, CHOICE
"This type of technology is proliferating, it's been used in all kinds of settings and every day we're hearing about new instances where it's popping up," she says. "We've seen it in retail, we have heard about it with pubs and clubs.
"At the moment, the settings are unclear and that just leads to more intrusion of people's privacy, more harm and more likelihood that innocent people will be falsely identified using the technology and excluded from services to which they would otherwise have access.
"We'd strongly urge the federal government to take this opportunity to act to protect the safety and privacy of Australians."
Stock images: Getty, unless otherwise stated.
