So, it turns out that some of your favourite shops have been somewhat secretly recording your biometric data when you enter them. Yeah.
Australian consumer group CHOICE has referred three of the country’s biggest retailers to the Office of the Australian Information Commissioner (OAIC), asking them to investigate possible Privacy Act breaches.
Bunnings, Kmart, and The Good Guys are the three stores that CHOICE found to be using facial recognition technology to record customer information. The company surveyed 25 leading Aussie retailers about their use of the controversial technology and found that these three are the only ones to be doing so.
On July 12, OAIC declared that they were opening an investigation into both Bunnings and Kmart’s use of facial recognition technology. However, they are only doing some preliminary inquiries into The Good Guys’ actions. According to OAIC, this is because there are public reports out there that state this company has put a pause on using facial recognition technology.
Facial recognition captures and stores unique biometric information like your facial features, which are as unique as a fingerprint. Technically, it’s legal for them to do so, as you tacitly accept the store’s terms of entry by entering the premises. They also have this information laid out online, as Kate Bower, CHOICE consumer data advocate explained.
“Most of these privacy policies you have to search for online, and they’re often not easy to find,” she said.
“But because we’re talking about in-person retail shops, it’s likely that no one is reading a privacy policy before they go into a store.”
CHOICE has also said that they visited stores in-person during their investigation and found that Bunnings and Kmart have physical signs at the door that alert people to the use of the technology.
However, they also say that the signs are small, inconspicuous and would have been missed by most shoppers. Because biometric data is being collected like this, it may be in breach of the Privacy Act.
A CHOICE survey on the matter found that 76% of respondents didn’t know stores are using technology in this way. However, “this lack of awareness doesn’t mean people aren’t concerned,” CHOICE said.
Most survey respondents (83%) said retail stores should be required to inform customers about the use of facial recognition before they enter the store, and 78% expressed concern about the secure storage of faceprint data. Nearly two thirds of respondents (65%) are concerned about stores using the technology to create profiles of customers that could cause them harm.
Some survey respondents describe facial recognition technology as “creepy and invasive”. Others say they consider it “unnecessary and dangerous” and wouldn’t want to enter a store that’s using it.
Mark Andrejevic, professor of media studies at Monash University has said that the use of facial recognition by retailers is in its early stages in Australia but he predicts it will increase as the technology becomes cheaper and more effective.
“We don’t have a clear set of regulations or guidelines on the appropriate use of the technology,” Andrejevic said.
“That leaves it pretty wide open. Stores may be using it for the purposes of security now, but down the road, they may also include terms of use that would say that they can use it for marketing purposes.”
“The first concern is notice and consent, it’s not in highly visible forms of public notification that would invite people to understand what’s taking place.”
Bunnings’ chief operating officer Simon McDowell told CHOICE that the technology was used to “identify persons of interest who have previously been involved in incidents of concern in our stores”.
“This technology is an important measure that helps us to maintain a safe and secure environment for our team and customers,” he said.
Edward Santow, a professor at the University of Technology Sydney who focuses on the responsible use of technology, has said that facial recognition technology raises serious moral questions.
“Even if that technology was perfectly accurate, and it’s not, but even if it were, it also takes us into the realm of mass surveillance,” he says.
“And I think there will be great concern in the Australian community about walking down that path.”
It could be a hot minute until OAIC releases what its investigation uncovers. This organisation will also be leaving us all out of the loop until it’s over. As OAIC has stated, “In line with the OAIC’s Privacy regulatory action policy, no further comment will be made while the investigation is ongoing.” We’ll let you know if any more info about this subject gets dropped.
Read more stories from The Latch and subscribe to our email newsletter.