Continuing story Bunnings & ors and facial recognition & privacy violations…as if it is news

June 16, 2022 |

The Choice story regarding some of our biggest retailers using facial recognition in their stores continues to attract media coverage. As well it should. The ABC has undertaken a broad brush review, Renewed calls for national guidelines on using facial recognition technology after CHOICE investigation, regarding the science of facial recognition and the legal regulation, or more accurately the lack thereof. The Conversation weighs in for some analysis with Bunnings, Kmart and The Good Guys say they use facial recognition for ‘loss prevention’. An expert explains what it might mean for you.

The Oz with Faceprint technology: Kmart, Bunnings and The Good Guys are scanning customers’ faces in stores reports on the (usual) call for Federal Government action to ban facial recognition. Bunnings has decided to join the fray and attack the Choice article stating:

We are disappointed by CHOICE’s inaccurate characterisation of Bunnings’ use of facial recognition technology in selected stores. This technology is used solely to keep team and customers safe and prevent unlawful activity in our stores, which is consistent with the Privacy Act.
In recent years, we’ve seen an increase in the number of challenging interactions our team have had to handle in our stores and this technology is an important tool in helping us to prevent repeat abuse and threatening behaviour towards our team and customers.
There are strict controls around the use of the technology which can only be accessed by specially trained team. This technology is not used for marketing, consumer behaviour tracking, and images of children are never enrolled.
We let customers know if the technology is in use through signage at our store entrances and also in our privacy policy, which is available via the homepage of our website.

It is a wholly unconvincing defence of the facial technology and proper notice of the use of the facial recognition technology. It is a weak defence because:

What is the safety issue? It is not terrorism or armed robberty? It is challenging interactions which constitutes abuse and “threatening behaviour”. What exactly does challenging interactions mean. These terms have been misused on occasion by organisations and government to extend to dissent or disagreement of any form. If it is arguments at the check out why is it necessary to obtain facial recognition data of all individuals. With these interactions why isn’t it sufficient to take a picture of the malefactor using a camera or smartphone and then use that as a resource to enforce a banning order, if that is what is anticipated.
What is the threshold for the use of the facial recognition? A prior argument or what? It is all very vague.
how is the technology being used to keep team and customers people safe? If a small proportion of individuals cause a problem how does that justify the hoovering up of thousands of images.
how long are the images kept for? Are they being distributed throughout all Bunnings Stores? Are they provided to Bunnings staff for delivery purposes? It is possible for a customer who engages in “challenging interactions” to order on line and have products delivered.
what are strict controls regarding the use of the technology. It is a statement that means nothing., What is the special training that the team receive before they can access the technology.
how does the Bunnings screen out children? What is the age cut off? How is that determined? By an algorithm or a specially trained staff.
the notice to the customers is a joke. The signage at the store entrance is in small print. Nothing is done to bring that to the customers attention. Similarly burying reference to it in the privacy policy is unsatisfactory, as the Information Commissioner found with 7 Eleven’s notice on web site. How Bunnings can rely on this argument given the Commissioner’s findings last year is quite extraordinary.

The ABC article provides:

Tech and human rights experts have renewed calls for a national framework on the use of facial recognition technology, as one described it as the “wild west of the digital world”.

It’s technology Australians use every day when unlocking their smartphones, but might not realise is in places they don’t expect.

Yesterday, that was thrust into the spotlight when it was revealed major retail chains Bunnings, The Good Guys and Kmart were using facial recognition on customers.

An investigation by CHOICE found the companies were “capturing the biometric data of their customers”, and 76 per cent of shoppers did not know the technology was used in Australian stores.

Bunnings’ chief operating officer Simon McDowell said signs informing customers of the software’s use were located at entrances, saying it to identify “persons of interest” and keep stores safe.

Peter Lewis, from the Australia Institute’s Centre for Responsible Technology, says some retailers might have good intentions in using the technology, but it raises concerns nonetheless.

“What we do know is that this technology is the wild west of the digital world,” he said.

“We know that there are companies that take these images and repackage them and sell them to governments, to other businesses.

“It’s even being used in the war in Ukraine.”

He called on the federal government to adopt the Human Rights Commission’s 2021 recommendation for a moratorium on using facial recognition technology in “high-risk circumstances” until more safeguards are in place.

Edward Santow, a University of Technology Sydney professor and former Human Rights Commissioner, said moratoriums were already in place in some jurisdictions around the world.

That includes San Francisco, where there is a ban on police and city agencies from using facial recognition technology.

In Australia, there is no dedicated law surrounding the use of facial recognition but some protections do exist under privacy laws.

But going forward Mr Santow says Australia should be following the lead of the European Union (EU) in taking a “more nuanced approach” to how the technology can be used.

A draft EU bill would prohibit “harmful” use of the technology and increase privacy protections while allowing low-risk use.

“There are huge gaps in [Australia’s] law, particularly about how it might protect against mass surveillance and error,” Mr Santow said.

“There are some very legitimate uses for [facial recognition] and they should be encouraged.

“But we need to set red lines about the most harmful uses.”

There are three broad types of facial recognition technology, which have differing degrees of accuracy.

The first is facial recognition, which Mr Santow said is the “least sophisticated” and the type used on smartphones.

Next is facial identification, a “much more complicated” form that might be used to identify people in crowds and is “prone to error”.

Facial analysis is the “most experimental” form and equates to “junk science”, according to Mr Santow.

It attempts to judge factors like the mood, age, sex and behaviour of a person based on their face and expressions.

Mr Santow said that form was “really dangerous” because it can give people — like law enforcement — a false sense of confidence.

Studies have also shown a drop in accuracy for facial recognition software when it comes to people of colour and women.

He raised an example overseas where facial recognition technology used by London’s Metropolitan Police wrongly identified 96 per cent of people scanned as suspects, which was revealed in 2019.

The Office of the Australian Information Commissioner (OAIC) found in 2021 that New York-based Clearview AI had breached privacy by scraping Australians’ biometric information from the internet and disclosing it through a facial recognition tool.

Clearview AI obtained the data without consent and did not take reasonable steps to notify those whose data was scraped.

The OAIC also found the Australian Federal Police failed to comply with its privacy obligations by using Clearview AI’s tool on a trial basis between November 2019 and January 2020.

As for how widespread the use of facial recognition technology is in Australia, Mr Santow says “the short answer is we don’t know”.

He said the Choice’s investigation “unmasks” some of the uses in the country, and that consent is one of the most pressing issues.

“One of the things I was pushing [as Human Rights Commissioner] is there should be greater transparency about how facial recognition is used,” he said.

“There’s a world of difference between some sort of fine print … and actually having a meaningful exchange with an individual [so] they have the opportunity to opt out.”

The Australian article provides:

The Federal Government is being urged to temporarily ban facial recognition technology from being used in public after retail giants Kmart, Bunnings and The Good Guys were found scanning the faces of their customers.

But businesses, including shops, should be forced to shut down their use of the “faceprint” technology until safeguards could be put in place, according to the Australia Institute’s Centre for Responsible Technology, echoing a call from the Human Rights Commission.

A Choice study of Australia’s 25 biggest retailers discovered the three major outlets were using in-store video systems to create “faceprints” of customers, even though only two of the retail chains displayed small, physical warnings about the technology to customers, which a spokeswoman called “not nearly enough”.

The revelation comes months after US chain 7-Eleven was found to have breached Australia’s Privacy Act by deploying facial recognition technology in stores without clear customer warnings.

Choice consumer data advocate Kate Bower said the collection of biometric data from consumers in stores was “a completely inappropriate and unnecessary use of the technology”.

“Using facial recognition technology in this way is similar to Kmart, Bunnings or The Good Guys collecting your fingerprints or DNA every time you shop,” Ms Bower said.

“Businesses using invasive technologies to capture their customers’ sensitive biometric information is unethical and is a sure way to erode consumer trust.”

Centre for Responsible Technology director Peter Lewis said the technology had been deployed by the stores without “necessary safeguards and redlines to protect the public” and called on the Federal Government to ban its use while protections were developed.

“It’s not good enough for businesses to say that it is implementing this technology to crack down on theft without the public knowing the way the data is being collected, how it’s being stored, what it’s being used for, and whether it’s being sold on to other parties,” Mr Lewis said.

“We need comprehensive privacy law reform and a pause on implementation of this potentially harmful and invasive technology.”

In a May 2021 report, the Human Rights Commission recommended “a moratorium on the use of facial recognition and other biometric technology” until legal safeguards protecting the public had been introduced.

But Bunnings rebuffed Choice’s report on Wednesday, with chief operating officer Simon McDowell releasing a statement calling the description of its facial recognition technology “inaccurate”.

“This technology is used solely to keep team and customers safe and prevent unlawful activity in our stores, which is consistent with the Privacy Act,” he said.

“There are strict controls around the use of the technology which can only be accessed by specially trained team. This technology is not used for marketing, consumer behaviour tracking, and images of children are never enrolled.”

Mr McDowell said Bunnings also installed warnings at the entrance to its stores and on its website.

In its research, Choice surveyed more than 1000 Australian households and found three in four people were unaware retailers were capturing their “faceprints,” and were concerned about how companies would use or store the information.

Four in every five people surveyed also said retailers should “properly inform” customers that facial recognition technology was being employed in stores.

Ms Bower said Kmart did “display small signs” warning about the use of facial recognition technology at store entrances but the notes were easy for even savvy shoppers to miss.

Kmart’s warning, called “conditions of entry,” warned customers their bags and receipts may be checked and, in its last sentence, told customers stores had “24-hour CCTV coverage, which includes facial recognition technology”.

The Good Guys only revealed its use of “facial and feature recognition technology” in a privacy policy on its website.

“Discreet signage and online privacy policies are not nearly enough to adequately inform shoppers that this controversial technology is in use,” Ms Bower said.

“The technology is capturing highly personal data from customers, including infants and children.”

Choice referred use of the technology to the Office of the Australian Information Commissioner, and an OAIC spokesman said the agency would “consider the information from Choice in line with our regulatory action policy”. .

The latest referral comes after the OAIC’s ruling in November 2021 that convenience store chain 7-Eleven “interfered with the privacy of individuals by collecting facial images and faceprints”.

Customers’ faces were scanned by tablet computers collecting customer feedback in stores, with data shared with a third party, including “non-blurred images”.

The Commissioner found the technology, used in 7-Eleven stores between June 2020 and August 2021, captured customers’ faceprints without their consent, breaching Privacy Act provisions.

The Conversation article provides:

Once the purview of law enforcement and intelligence agencies, facial recognition is now being used to identify consumers in Australian stores.

If you’ve seen the movie Minority Report, you’ll remember how Tom Cruise’s character John Anderton is identified through iris recognition to perform his duties, and later tracked with it when he’s a wanted man. When he replaces his eyes to evade identification, Anderton is bombarded with advertisements targeting his new assumed identity.

This once-futuristic idea from a movie could soon be a reality in our lives. An investigative report published by consumer magazine Choice reveals three major retailers (out of 25 queried), Kmart, Bunnings and The Good Guys, have admitted using facial recognition technology on customers for “loss prevention”.

The companies say they advise consumers of the use of the technology as a condition of entry. But do consumers really know what this entails, and how or where their images could be used or stored?

What is facial recognition and why do we care?

We’ve grown accustomed to our phones and cameras using facial detection software to put our faces into focus. But facial recognition technology takes this a step further by matching our unique identifying information to a stored digital image.

Facial recognition has come a long way. It was initially used in 2001 to identify relationships between gamblers and employees in Las Vegas casinos, where there was suspected collusion.

The United States government would eventually use the same technology to identify the 9/11 hijackers. It’s now widely adopted by law enforcement and intelligence communities.

Currently, software such as Clearview AI and PimEyes are being used in highly sophisticated ways, including by Ukrainian and Russian forces to identify combatants in Ukraine.

But what is this technology doing in Bunnings?

As with its early use in casinos, Kmart, Bunnings and The Good Guys told Choice their facial recognition software is used for “loss prevention”.

Images captured on store surveillance devices and body cameras could be used to identify in-store individuals engaged in theft, or other criminal activities. Real-time identification could allow law enforcement to quickly identify shoppers with unpaid tickets, outstanding warrants, or existing criminal complaints.

Bunnings chief operating officer Simon McDowell told SBS News the technology was used “solely to keep team and customers safe and prevent unlawful activity in our stores”. Both The Good Guys and Kmart told news outlets they were using it for the same reasons, in a select number of stores – and that customers were notified through signage.

Choice confirmed there were some signs disclosing use of the technology – but reported these signs were small and would be missed by most shoppers.

The news has stoked shoppers’ fears of how their image data may be used. As in Minority Report, images captured in a store could theoretically be used for targeted advertising and to “enhance” the shopping experience.

It’s likely images and video collected through standard in-store surveillance are either matched immediately against a remote database using specialised facial recognition software, or analysed against a database of tagged and catalogued images later on. Ideally, the images would be encoded and stored in a file that’s readable only by the algorithm specific to the device or software processor.

Potential for misuse

We have already seen online retailers use this tactic through cookies and linking our purchase history on electronic devices.

We have also seen companies correlate our social media profiles and our other online experiences across various websites. Australian stores employing facial recognition could use collected information internally to track:

- the number of visits by a person
- the times of those visits
- pattern or behavioural analysis (such as a consumer’s reaction to pricing or signage) and
- associations with other shoppers (such as friends, family and anyone else with them).

Retailers could also use this identity data to extract information from social media, where most people have images of themselves uploaded. They could then perform risk analysis based on the credit and financial reporting access of that specific shopper.

Externally, the images and associated consumer information could be merged with financial, economic, social and political data already collected by commercial data aggregators – adding to the already massive data aggregation market.

Current Australian privacy laws require retailers to disclose what data are being collected, retained and protected, as well as how it might be used outside of a loss prevention model.

A Bunnings spokesperson told The Guardian the technology was being used in line with the Australian Privacy Act. Choice has reached out to the Office of the Australian Information Commissioner to determine whether the use of the technology is indeed consistent with the Privacy Act.

What to do?

While the retailers highlighted in Choice’s investigation state consumers must agree to the collection of their images as a condition of entry, the reality is the collection, retention, and use of their images are not usually disclosed in any explicit way.

As far as data collection in retail settings goes, there should be a precondition for all stores to make sure consumers are made aware of:

- the specific information that is collected while they are visiting
- how it might be aggregated and combined with other relevant information from third parties
- how long the images or data will be retained, retrieved, or accessed and by whom, and
- what security precautions are being used to secure the data.

Furthermore, as with their online shopping experience, consumers should be given the option to opt-out of such data collection.

Until then, consumers may try to avoid collection by donning hats, sunglasses and face masks. But considering the rate at which facial recognition technology is advancing – and how large the personal data market has already grown – retail cameras may soon be able to see through these disguises, too.

Meanwhile itnews in AMP Bank introduces new ID verification tech for home loans reports that AMP Bank has introduced facial recognition technology to verify customers applying for home loans through a broker or adviser.

The Bunnings/Kmart and others story continue to get a run with 10Play, SBS’s ‘Creepy and invasive’: Kmart, Bunnings and The Good Guys accused of using facial recognition technology,

Peter A Clarke