Facial recognition technology at Kmart, Bunnings and the Goodguys..Serious privacy concerns. It highlights the inadequacy of privacy legislation & poor regulation of what there is.
June 15, 2022 |
Choice has published the findings of its investigations of retailers using facial recognition with Kmart, Bunnings and The Good Guys using facial recognition technology in stores. The Australian has picked up on that story with Faceprint technology: Kmart, Bunnings and The Good Guys are scanning customers’ faces in stores.
Both stories cover a disturbing pattern of organisations deploying privacy instrusive technology without any real restrictions or regulation. As the stories make clear the compliance with the Privacy Act 1988 as to collection of personal information is either buried in on line privacy statements or small inconspicuous written notices under the heading conditions of entry off to the side of the entrance of Kmart stores. This is arrogance writ large. Kmart has undergone a box ticking exercise. And the excuses used by Bunnings, that facial recognition technology is to “..to help identify persons of interest who have previously been involved in incidents of concern in our stores,” and that it is “..an important measure that helps us to maintain a safe and secure environment for our team and customers.” is, if true, a wholly disproportionate response to a problem that could be dealt with in other ways. More to the point it is a cynical justification. Nowdays all sorts of intrusive steps are taken under the rubric of safety and security, whether the steps are justified or not. That tends to avoid close scrutiny. It is quite fraudulent but, so far, effective.
The choice report provides:
Major Australian retailers Kmart, Bunnings and The Good Guys are using facial recognition technology in stores, raising concerns among privacy experts.
The use of this developing technology, which captures and stores unique biometric information such as facial features (known as a ‘faceprint’), would come as news to most customers.
We asked 25 leading Australian retailers whether they use facial recognition technology, and analysed their privacy policies. Based on the policies and the responses we received, Kmart, Bunnings and The Good Guys appear to be the only three that are capturing the biometric data of their customers.
Most privacy policies are online
“Most of these privacy policies you have to search for online, and they’re often not easy to find,” says CHOICE consumer data advocate Kate Bower. “But because we’re talking about in-person retail shops, it’s likely that no one is reading a privacy policy before they go into a store.”
CHOICE staff members also visited some of these stores in person as part of the investigation. Bower says the Kmart and Bunnings stores they visited had physical signs at the store entrances informing customers about the use of the technology, but the signs were small, inconspicuous and would have been missed by most shoppers. The collection of biometric data in such a manner may be in breach of the Privacy Act.
Shoppers in the dark
Between March and April 2022, CHOICE canvassed more than 1000 Australians in a nationally representative survey to gauge consumer awareness of facial recognition technology.
The results indicate that most people are in the dark. More than three in four respondents (76%) said they didn’t know retailers were using facial recognition.
Those who suspected it was being used wrongly named Coles and Woolworths as the most likely culprits.
‘Creepy and invasive’
This lack of awareness doesn’t mean people aren’t concerned. Most survey respondents (83%) say retail stores should be required to inform customers about the use of facial recognition before they enter the store, and 78% expressed concern about the secure storage of faceprint data. Nearly two thirds of respondents (65%) are concerned about stores using the technology to create profiles of customers that could cause them harm.
Some survey respondents describe facial recognition technology as “creepy and invasive”. Others say they consider it “unnecessary and dangerous” and wouldn’t want to enter a store that’s using it.
Facial recognition on the rise
Mark Andrejevic, professor of media studies at Monash University and a member of the ARC Centre of Excellence for Automated Decision-Making and Society, tells CHOICE that the use of facial recognition by retailers is in its early stages in Australia. But he predicts it will increase as the technology becomes cheaper and more effective.
We don’t have a clear set of regulations or guidelines on the appropriate use of the technology
Professor Mark Andrejevic, Monash University
“The first concern is notice and consent, it’s not in highly visible forms of public notification that would invite people to understand what’s taking place,” says Andrejevic.
“I think the other set of concerns is we don’t have a clear set of regulations or guidelines on the appropriate use of the technology. That leaves it pretty wide open. Stores may be using it for the purposes of security now, but down the road, they may also include terms of use that would say that they can use it for marketing purposes.”
‘Great concern’
Edward Santow is a professor at the University of Technology Sydney who focuses on the responsible use of technology. As a former Australian Human Rights Commissioner, he also led work on artificial intelligence. Santow says facial recognition technology raises serious questions for our society.
“Even if that technology was perfectly accurate, and it’s not, but even if it were, it also takes us into the realm of mass surveillance,” he says. “And I think there will be great concern in the Australian community about walking down that path.”
Bunnings responds
Simon McDowell, Bunnings’ chief operating officer, tells CHOICE that facial recognition is one of several measures the retailer has in place to prevent theft and anti-social behaviour.
“At selected stores our CCTV systems utilise facial recognition technology, which is used to help identify persons of interest who have previously been involved in incidents of concern in our stores,” he says.
This technology is an important measure that helps us to maintain a safe and secure environment for our team and customers
Simon McDowell, Bunnings chief operating officer
“We let customers know about our use of CCTV and facial recognition technology through signage at our store entrances and also in our privacy policy, which is available on our website.
“It’s really important to us that we do everything we can to discourage poor behaviour in our stores, and we believe this technology is an important measure that helps us to maintain a safe and secure environment for our team and customers.”
No word from Kmart or The Good Guys
Kmart and The Good Guys didn’t respond to our questions about their reasons for using facial recognition technology. The Good Guys’ privacy policy claims the use of the technology is for the purposes of security, theft prevention, and managing and improving the customer experience.
Breach of the Privacy Act?
CHOICE’s Kate Bower says the Privacy Act considers biometric information such as unique faceprints sensitive data, and that a higher standard is applied to it than to other types of personal information.
“It requires that your collection of that information has to be suitable for the business purpose that you’re collecting it for, and that it can’t be disproportionate to the harms involved,” she says.
We believe that these retail businesses are disproportionate in their over collection of this information, which means that they may be in breach of the Privacy Act
Kate Bower, CHOICE consumer data advocate
“We also believe that these retail businesses are disproportionate in their over collection of this information, which means that they may be in breach of the Privacy Act. We intend to refer them to the Information Commissioner on that basis.”
Bower adds that, irrespective of whether the retailers are in breach of the Act or not, clearer and stronger regulations are needed around customer consent and how retailers obtain and use facial recognition data.
Opportunity to strengthen protection
The Attorney General is currently carrying out a five-year review of the Privacy Act. Bower says it’s an opportunity to strengthen measures around the capture and use of consumer data, including biometric data.
Professor Santow agrees that more work needs to be done. “Certainly in Europe, there are stronger border privacy protections, and there are proposals in place to go further,” he says.
Andrejevic says he’s concerned that the public remains largely unaware of what’s going on regarding the capture and use of their personal data. “When I look at the Australian context, I see the creeping use of the technology without widespread public discussion,” he says.
The Australian article starts with reporting on the Choice story and then refers to the Information Commissioners determination in Information Commissioner issues determination into 7- Eleven Stores Pty Ltd [2021] AICmr 50 (29 September 2021) which I have posted on.
The Australian article provides:
Retail giants Kmart, Bunnings and The Good Guys are scanning their customers’ faces in stores, a new investigation has revealed, even though most consumers have no idea facial recognition technology is being deployed.
A Choice study of Australia’s 25 biggest retailers found the three major outlets were using in-store video systems to create “faceprints” of customers, even though only two of the retail chains displayed small, physical warnings about the technology to customers, which a spokeswoman called “not nearly enough”.
The revelation comes months after US chain 7-Eleven was found to have breached Australia’s Privacy Act by deploying facial recognition technology in stores without clear customer warnings.
Choice consumer data advocate Kate Bower said the collection of biometric data from consumers in stores was “a completely inappropriate and unnecessary use of the technology”.
“Using facial recognition technology in this way is similar to Kmart, Bunnings or The Good Guys collecting your fingerprints or DNA every time you shop,” Ms Bower said.
“Businesses using invasive technologies to capture their customers’ sensitive biometric information is unethical and is a sure way to erode consumer trust.”
Choice also surveyed more than 1000 Australian households and found three in four people were unaware retailers were capturing their “faceprints,” and were concerned about how companies would use or store the information.
Four in every five people surveyed also said retailers should “properly inform” customers that facial recognition technology was being employed in stores.
Ms Bower said Kmart and Bunnings did “display small signs” warning about the use of facial recognition technology at store entrances but the notes were easy for even savvy shoppers to miss.
Kmart’s warning, called “conditions of entry,” warned customers their bags and receipts may be checked and, in its last sentence, told customers stores had “24-hour CCTV coverage, which includes facial recognition technology”.
The Good Guys only revealed its use of “facial and feature recognition technology” in a privacy policy on its website.
“Discreet signage and online privacy policies are not nearly enough to adequately inform shoppers that this controversial technology is in use,” Ms Bower said.
“The technology is capturing highly personal data from customers, including infants and children.”
Choice referred use of the technology to the Office of the Australian Information Commissioner, and an OAIC spokesman said the agency would “consider the information from Choice in line with our regulatory acton policy”. .
The latest referral comes after the OAIC’s ruling in November 2021 that convenience store chain 7-Eleven “interfered with the privacy of individuals by collecting facial images and faceprints”.
Customers’ faces were scanned by tablet computers collecting customer feedback in stores, with data shared with a third party, including “non-blurred images”.
The Commissioner found the technology, used in 7-Eleven stores between June 2020 and August 2021, captured customers’ faceprints without their consent, breaching Privacy Act provisions.
The coverage has been quite extensive with Channel Nines Kmart, Bunnings and The Good Guys’ use of facial recognition technology on unsuspecting customers raises concerns, ABC’s CHOICE raises concern over Bunnings, Kmart and the Good Guys use of facial recognition technology, Gizmodo’s Kmart, Bunnings and the Good Guys Have Been Using Facial Recognition in Stores All Along (If You Read the Fine Print) and SBS’s ‘Creepy and invasive’: Kmart, Bunnings and The Good Guys accused of using facial recognition technology.
The lack of adequate regulation and enforcement of existing laws remains a public policy failure in Australia. The Information Commissioner entered into a MOU in relation to National Facial Biometric Matching Capability in 2017. But that has nothing to do with the rapid uptake of this technology by the private sector. There is some reference to the technology in the guidelines to the Australian Privacy Principles but nothing specific to its use. The UK information Commissioner released specific guidelines regarding the use of Video surveillance, which is a step in the right direction but not nearly enough. In 2019 the Information Commissioner undertook an investigation on how the police used live facial recognition technology. As a result the Commisioner issued an opinion.
The statement from the ICO provides:
In October 2019 we concluded our investigation into how police use live facial recognition technology (LFR) in public places. Our investigation found there was public support for police use of LFR but also that there needed to be improvements in how police authorised and deployed the technology if it was to retain public confidence and address privacy concerns. We set out our views in a formal Opinion for police forces.
The Metropolitan Police Service (MPS) has incorporated the advice from our Opinion into its planning and preparation for future LFR use. Our Opinion acknowledges that an appropriately governed, targeted and intelligence- led deployment of LFR may meet the threshold of strict necessity for law enforcement purposes. We have received assurances from the MPS that it is considering the impact of this technology and is taking steps to reduce intrusion and comply with the requirements of data protection legislation. We expect to receive further information from the MPS regarding this matter in forthcoming days. The MPS has committed to us that it will review each deployment, and the ICO will continue to observe and monitor the arrangements for, and effectiveness of, its use.
This is an important new technology with potentially significant privacy implications for UK citizens. We reiterate our call for Government to introduce a statutory and binding code of practice for LFR as a matter of priority. The code will ensure consistency in how police forces use this technology and to improve clarity and foreseeability in its use for the public and police officers alike. We believe it’s important for government to work with regulators, law enforcement, technology providers and communities to support the code.
Facial recognition remains a high priority for the ICO and the public. We have several ongoing investigations. We will be publishing more about its use by the private sector later this year.