Faceprint technology: Bunnings and Kmart under investigation for scanning customers’ faces

Bunnings and Kmart will face a probe into the use of facial recognition technology after Australia’s privacy watchdog confirmed it had “opened investigations”.

Bunnings and Kmart will face a full probe into their stores’ use of facial recognition technology after Australia’s privacy watchdog confirmed it had “opened investigations” into their use of customers’ personal information on Tuesday.

Australian Information Commissioner Angelene Falk initiated investigations into both retail giants following a Choice study in June that found customers’ were being profiled by facial recognition technology in stores.

The Good Guys were also discovered to be using “faceprints” of customers, though the company said it had “paused the trial of upgraded security system with the optional facial recognition technology” in two Melbourne stores following a public backlash.

A spokesman from the Office of the Australian Information Commissioner said it “commenced preliminary inquiries” into The Good Guys, and would look into “the personal information handling practices” of both Bunnings and Kmart.

In a statement, Bunnings chief operating officer Simon McDowell said the company was aware of the investigation and would “co-operate” with the authority.

“As we’ve previously explained, this technology is used solely to help keep team and customers safe and prevent unlawful activity in our stores and we have strict controls around its use,” Mr McDowell said.

Choice consumer data advocate Kate Bower welcomed the investigations, saying it could help the retail giants to “read the room” when it came to using and warning consumers about facial recognition technology.

“We know this investigation struck a nerve with the Australian community, who have expressed significant concern about the use of facial recognition technology in Bunnings and Kmart stores,” she said.

“We look forward to the outcome of OAIC’s investigation. This could set the standard for how businesses treat customers and their data.”

A Kmart store in Marrickville, NSW, shows a small warning about the use of facial recognition technology. Picture: Choice

The Federal Government was last month urged to temporarily ban facial recognition technology from being used in public after the retail giants were found scanning the faces of their customers.

But businesses, including shops, should be forced to shut down their use of the “faceprint” technology until safeguards could be put in place, according to the Australia Institute’s Centre for Responsible Technology, echoing a call from the Human Rights Commission.

A Choice study of Australia’s 25 biggest retailers discovered the three major outlets were using in-store video systems to create “faceprints” of customers, even though only two of the retail chains displayed small, physical warnings about the technology to customers, which a spokeswoman called “not nearly enough”.

The revelation comes months after US chain 7-Eleven was found to have breached Australia’s Privacy Act by deploying facial recognition technology in stores without clear customer warnings.

Choice consumer data advocate Kate Bower said the collection of biometric data from consumers in stores was “a completely inappropriate and unnecessary use of the technology”.

“Using facial recognition technology in this way is similar to Kmart, Bunnings or The Good Guys collecting your fingerprints or DNA every time you shop,” Ms Bower said.

“Businesses using invasive technologies to capture their customers’ sensitive biometric information is unethical and is a sure way to erode consumer trust.”

Centre for Responsible Technology director Peter Lewis said the technology had been deployed by the stores without “necessary safeguards and redlines to protect the public” and called on the Federal Government to ban its use while protections were developed.

“It’s not good enough for businesses to say that it is implementing this technology to crack down on theft without the public knowing the way the data is being collected, how it’s being stored, what it’s being used for, and whether it’s being sold on to other parties,” Mr Lewis said.

“We need comprehensive privacy law reform and a pause on implementation of this potentially harmful and invasive technology.”

In a May 2021 report, the Human Rights Commission recommended “a moratorium on the use of facial recognition and other biometric technology” until legal safeguards protecting the public had been introduced.

Bunnings is one of three retail chains found to be using facial recognition technology in stores. Picture: NCA NewsWire/David Mariuz

But Bunnings rebuffed Choice’s report, with chief operating officer Simon McDowell releasing a statement calling the description of its facial recognition technology “inaccurate”.

“This technology is used solely to keep team and customers safe and prevent unlawful activity in our stores, which is consistent with the Privacy Act,” he said.

“There are strict controls around the use of the technology which can only be accessed by specially trained team. This technology is not used for marketing, consumer behaviour tracking, and images of children are never enrolled.”

Mr McDowell said Bunnings also installed warnings at the entrance to its stores and on its website.

In its research, Choice surveyed more than 1000 Australian households and found three in four people were unaware retailers were capturing their “faceprints,” and were concerned about how companies would use or store the information.

Four in every five people surveyed also said retailers should “properly inform” customers that facial recognition technology was being employed in stores.

Ms Bower said Kmart did “display small signs” warning about the use of facial recognition technology at store entrances but the notes were easy for even savvy shoppers to miss.

Kmart’s warning, called “conditions of entry,” warned customers their bags and receipts may be checked and, in its last sentence, told customers stores had “24-hour CCTV coverage, which includes facial recognition technology”.

The Good Guys only revealed its use of “facial and feature recognition technology” in a privacy policy on its website.

“Discreet signage and online privacy policies are not nearly enough to adequately inform shoppers that this controversial technology is in use,” Ms Bower said.

“The technology is capturing highly personal data from customers, including infants and children.”

Choice referred use of the technology to the Office of the Australian Information Commissioner, and an OAIC spokesman said the agency would “consider the information from Choice in line with our regulatory action policy”. .

The latest referral comes after the OAIC’s ruling in November 2021 that convenience store chain 7-Eleven “interfered with the privacy of individuals by collecting facial images and faceprints”.

Customers’ faces were scanned by tablet computers collecting customer feedback in stores, with data shared with a third party, including “non-blurred images”.

The Commissioner found the technology, used in 7-Eleven stores between June 2020 and August 2021, captured customers’ faceprints without their consent, breaching Privacy Act provisions.

Originally published as Faceprint technology: Bunnings and Kmart under investigation for scanning customers’ faces