Incident 258: Australian Retailers Reported to Have Captured Face Prints of Their Customers without Consent, Potentially in Violation of Australian Privacy Act
Suggested citation format
Major Australian retailers have been secretly capturing the faces of their customers without their knowledge, a consumer group investigation has found.
The Choice investigation examined 25 of the country’s biggest retailers and revealed Bunnings, The Good Guys and Kmart have been analysing CCTV footage to create profiles or “face prints” of their customers, including children, without their knowledge.
Based on the results of the investigation, the three retailers seem to be the only ones using facial recognition technology. Bunnings and The Good Guys acknowledged it was in place in its stores while Kmart failed to respond to Choice’s request for confirmation.
Consumer group data advocate Kate Bower said almost 80 per cent of Australians were not aware retailers were capturing their facial features in this way and that it was similar to “collecting your fingerprints or DNA every time you shop”.
“Businesses using invasive technologies to capture their customers’ sensitive biometric information is unethical and is a sure way to erode consumer trust,” she said.
Bunnings chief operating officer Simon McDowell said the technology was only used to keep staff and customers safe and appropriate notice had been provided.
“We’ve seen an increase in the number of challenging interactions our team have had to handle … This technology is an important tool in helping us to prevent repeat abuse of our team and customers,” he said.
“There are strict controls around the use of the technology which can only be accessed by specially trained team.”
McDowell disagreed with Choice’s determination the company had breached the Privacy Act and said images of children are not stored.
“Our use is solely for the purpose of preventing threatening situations and theft, which is consistent with the Privacy Act.
A spokeswoman for The Good Guys said the “face and feature recognition technology” is a trial and limited to two stores for now.
But Choice said this style of communication was insufficient.
“Discreet signage and online privacy policies are not nearly enough to adequately inform shoppers that this controversial technology is in use. The technology is capturing highly personal data from customers, including infants and children,” she said.
Choice has referred the offending retailers to the Office of the Australian Information Commissioner to investigate potential breaches of the Privacy Act and is lobbying the government to implement a regulatory framework to protect consumers from harmful and unfair practices.
“With the government currently undergoing a review of the Privacy Act, now is the perfect time to strengthen measures around the capture and use of consumer data, including biometric data,” Bower said.
Kmart has been approached for comment.
OAIC launches commission-initiated investigation into Kmart and Bunnings' use of facial recognition
The Office of the Australian Information Commissioner has opened investigations into the personal information handling practices of Bunnings Group Limited and Kmart Australia Limited, focusing on the companies' use of facial recognition technology, according to a media release on the OAIC website. It says "the investigations follow a report from consumer advocacy group CHOICE about the retailers' use of facial recognition technology."
CHOICE welcomes the Commissioner-initiated investigation as a big step forward in protecting Australian consumers from the harms of unnecessary and invasive facial recognition technology.
The Good Guys puts facial recognition on hold
The Good Guys has paused the use of facial recognition technology in its stores while the Office of the Australian Information Commission (OAIC) investigates the complaint made by CHOICE.
"The Good Guys today confirmed it will pause the trial of the upgraded security system with the optional facial recognition technology," said a spokesperson for the appliance retailer. "The decision was made to pause the trial at this time pending any clarification from the OAIC regarding the use of this technology."
- Kmart, Bunnings and The Good Guys are using facial recognition technology in retail stores
- Despite some limited signage in some stores, customers remain largely unaware of the practice
- Privacy experts are raising the alarm and CHOICE says they may be in breach of the Privacy Act
Major Australian retailers Kmart, Bunnings and The Good Guys are using facial recognition technology in stores, raising concerns among privacy experts.
The use of this developing technology, which captures and stores unique biometric information such as facial features (known as a 'faceprint'), would come as news to most customers.
We asked 25 leading Australian retailers whether they use facial recognition technology, and analysed their privacy policies. Based on the policies and the responses we received, Kmart, Bunnings and The Good Guys appear to be the only three that are capturing the biometric data of their customers.
Privacy policies not easy to find
CHOICE staff members also visited some of these stores in person as part of the investigation.
Bower says the Kmart and Bunnings stores they visited had physical signs at the store entrances informing customers about the use of the technology, but the signs were small, inconspicuous and would have been missed by most shoppers.
The collection of biometric data in such a manner may be in breach of the Privacy Act.
Shoppers in the dark
Between March and April 2022, CHOICE canvassed more than 1000 Australians in a nationally representative survey to gauge consumer awareness of facial recognition technology.
The results indicate that most people are in the dark. More than three in four respondents (76%) said they didn't know retailers were using facial recognition.
Those who suspected it was being used wrongly named Coles and Woolworths as the most likely culprits.
'Creepy and invasive'
This lack of awareness doesn't mean people aren't concerned. Most survey respondents (83%) say retail stores should be required to inform customers about the use of facial recognition before they enter the store, and 78% expressed concern about the secure storage of faceprint data.
Almost two thirds of respondents (65%) are concerned about stores using the technology to create profiles of customers that could cause them harm.
Some survey respondents describe facial recognition technology as "creepy and invasive". Others say they consider it "unnecessary and dangerous" and wouldn't want to enter a store that's using it.
Signage at the Kmart store in Marrickville, New South Wales.
Facial recognition on the rise
Mark Andrejevic, professor of media studies at Monash University and a member of the ARC Centre of Excellence for Automated Decision-Making and Society, tells CHOICE that the use of facial recognition by retailers is in its early stages in Australia. But he predicts it will increase as the technology becomes cheaper and more effective.
We don't have a clear set of regulations or guidelines on the appropriate use of the technology
Professor Mark Andrejevic, Monash University
"The first concern is notice and consent, it's not in highly visible forms of public notification that would invite people to understand what's taking place," says Andrejevic.
Edward Santow is a professor at the University of Technology Sydney who focuses on the responsible use of technology. As a former Australian Human Rights Commissioner, he also led work on artificial intelligence. Santow says facial recognition technology raises serious questions for our society.
"Even if that technology was perfectly accurate, and it's not, but even if it were, it also takes us into the realm of mass surveillance," he says. "And I think there will be great concern in the Australian community about walking down that path."
Simon McDowell, Bunnings' chief operating officer, tells CHOICE that facial recognition is one of several measures the retailer has in place to prevent theft and anti-social behaviour.
"At selected stores our CCTV systems utilise facial recognition technology, which is used to help identify persons of interest who have previously been involved in incidents of concern in our stores," he says.
This technology is an important measure that helps us to maintain a safe and secure environment for our team and customers
Simon McDowell, Bunnings chief operating officer
"It's really important to us that we do everything we can to discourage poor behaviour in our stores, and we believe this technology is an important measure that helps us to maintain a safe and secure environment for our team and customers."
No word from Kmart or The Good Guys
Breach of the Privacy Act?
CHOICE's Kate Bower says the Privacy Act considers biometric information such as unique faceprints sensitive data, and that a higher standard is applied to it than to other types of personal information.
"It requires that your collection of that information has to be suitable for the business purpose that you're collecting it for, and that it can't be disproportionate to the harms involved," she says.
We believe that these retail businesses are disproportionate in their over collection of this information, which means that they may be in breach of the Privacy Act
Kate Bower, CHOICE consumer data advocate
"We also believe that these retail businesses are disproportionate in their over collection of this information, which means that they may be in breach of the Privacy Act. We intend to refer them to the Information Commissioner on that basis."
Bower adds that, irrespective of whether the retailers are in breach of the Act or not, clearer and stronger regulations are needed around customer consent and how retailers obtain and use facial recognition data.
Opportunity to strengthen protection
The Attorney General is currently carrying out a five-year review of the Privacy Act. Bower says it's an opportunity to strengthen measures around the capture and use of consumer data, including biometric data.
Professor Santow agrees that more work needs to be done. "Certainly in Europe, there are stronger border privacy protections, and there are proposals in place to go further," he says.
Andrejevic says he's concerned that the public remains largely unaware of what's going on regarding the capture and use of their personal data. "When I look at the Australian context, I see the creeping use of the technology without widespread public discussion," he says.