Three major retailers in Australia are using facial recognition technology, often without shoppers realising.
Need to know
- Kmart, Bunnings and The Good Guys are using facial recognition technology in retail stores
- Despite some limited signage in some stores, customers remain largely unaware of the practice
- Privacy experts are raising the alarm and CHOICE says they may be in breach of the Privacy Act
Major Australian retailers Kmart, Bunnings and The Good Guys are using facial recognition technology in stores, raising concerns among privacy experts.
The use of this developing technology, which captures and stores unique biometric information such as facial features (known as a ‘faceprint’), would come as news to most customers.
We asked 25 leading Australian retailers whether they use facial recognition technology, and analysed their privacy policies. Based on the policies and the responses we received, Kmart, Bunnings and The Good Guys appear to be the only three that are capturing the biometric data of their customers.
Most privacy policies are online
“Most of these privacy policies you have to search for online, and they’re often not easy to find,” says CHOICE consumer data advocate Kate Bower. “But because we’re talking about in-person retail shops, it’s likely that no one is reading a privacy policy before they go into a store.”
CHOICE staff members also visited some of these stores in person as part of the investigation. Bower says the Kmart and Bunnings stores they visited had physical signs at the store entrances informing customers about the use of the technology, but the signs were small, inconspicuous and would have been missed by most shoppers. The collection of biometric data in such a manner may be in breach of the Privacy Act.
Shoppers in the dark
Between March and April 2022, CHOICE canvassed more than 1000 Australians in a nationally representative survey to gauge consumer awareness of facial recognition technology.
The results indicate that most people are in the dark. More than three in four respondents (76%) said they didn’t know retailers were using facial recognition.
Those who suspected it was being used wrongly named Coles and Woolworths as the most likely culprits.
‘Creepy and invasive’
This lack of awareness doesn’t mean people aren’t concerned. Most survey respondents (83%) say retail stores should be required to inform customers about the use of facial recognition before they enter the store, and 78% expressed concern about the secure storage of faceprint data. Nearly two thirds of respondents (65%) are concerned about stores using the technology to create profiles of customers that could cause them harm.
Some survey respondents describe facial recognition technology as “creepy and invasive”. Others say they consider it “unnecessary and dangerous” and wouldn’t want to enter a store that’s using it.
Facial recognition on the rise
Mark Andrejevic, professor of media studies at Monash University and a member of the ARC Centre of Excellence for Automated Decision-Making and Society, tells CHOICE that the use of facial recognition by retailers is in its early stages in Australia. But he predicts it will increase as the technology becomes cheaper and more effective.
We don’t have a clear set of regulations or guidelines on the appropriate use of the technology
Professor Mark Andrejevic, Monash University
“The first concern is notice and consent, it’s not in highly visible forms of public notification that would invite people to understand what’s taking place,” says Andrejevic.
“I think the other set of concerns is we don’t have a clear set of regulations or guidelines on the appropriate use of the technology. That leaves it pretty wide open. Stores may be using it for the purposes of security now, but down the road, they may also include terms of use that would say that they can use it for marketing purposes.”
‘Great concern’
Edward Santow is a professor at the University of Technology Sydney who focuses on the responsible use of technology. As a former Australian Human Rights Commissioner, he also led work on artificial intelligence. Santow says facial recognition technology raises serious questions for our society.
“Even if that technology was perfectly accurate, and it’s not, but even if it were, it also takes us into the realm of mass surveillance,” he says. “And I think there will be great concern in the Australian community about walking down that path.”
Bunnings responds
Simon McDowell, Bunnings’ chief operating officer, tells CHOICE that facial recognition is one of several measures the retailer has in place to prevent theft and anti-social behaviour.
“At selected stores our CCTV systems utilise facial recognition technology, which is used to help identify persons of interest who have previously been involved in incidents of concern in our stores,” he says.
This technology is an important measure that helps us to maintain a safe and secure environment for our team and customers
Simon McDowell, Bunnings chief operating officer
“We let customers know about our use of CCTV and facial recognition technology through signage at our store entrances and also in our privacy policy, which is available on our website.
“It’s really important to us that we do everything we can to discourage poor behaviour in our stores, and we believe this technology is an important measure that helps us to maintain a safe and secure environment for our team and customers.”
No word from Kmart or The Good Guys
Kmart and The Good Guys didn’t respond to our questions about their reasons for using facial recognition technology. The Good Guys’ privacy policy claims the use of the technology is for the purposes of security, theft prevention, and managing and improving the customer experience.
Breach of the Privacy Act?
CHOICE’s Kate Bower says the Privacy Act considers biometric information such as unique faceprints sensitive data, and that a higher standard is applied to it than to other types of personal information.
“It requires that your collection of that information has to be suitable for the business purpose that you’re collecting it for, and that it can’t be disproportionate to the harms involved,” she says.
We believe that these retail businesses are disproportionate in their over collection of this information, which means that they may be in breach of the Privacy Act
Kate Bower, CHOICE consumer data advocate
“We also believe that these retail businesses are disproportionate in their over collection of this information, which means that they may be in breach of the Privacy Act. We intend to refer them to the Information Commissioner on that basis.”
Bower adds that, irrespective of whether the retailers are in breach of the Act or not, clearer and stronger regulations are needed around customer consent and how retailers obtain and use facial recognition data.
Opportunity to strengthen protection
The Attorney General is currently carrying out a five-year review of the Privacy Act. Bower says it’s an opportunity to strengthen measures around the capture and use of consumer data, including biometric data.
Professor Santow agrees that more work needs to be done. “Certainly in Europe, there are stronger border privacy protections, and there are proposals in place to go further,” he says.
Andrejevic says he’s concerned that the public remains largely unaware of what’s going on regarding the capture and use of their personal data. “When I look at the Australian context, I see the creeping use of the technology without widespread public discussion,” he says.