OAIC opens probe into Bunnings, Kmart over facial recognition

Bunnings and Kmart Australia’s use of facial recognition to analyse CCTV footage will be probed by Australia’s privacy watchdog after a CHOICE investigation of the country’s 25 largest retailers.

The Office of the Australian Information Commissioner (OAIC) opened an investigation into the personal information handling by the two retailers owned by Wesfarmers on Tuesday.

The investigation will focus on the “companies’ use of facial recognition technology”, the privacy watchdog said.

Bunnings and Kmart, as well as The Good Guys, were referred to the OAIC by Choice two weeks ago for potential breaches of the Privacy Act.

It followed a self-initiated investigation by the consumer group that found all three retailers had been analysing CCTV footage to create profiles or ‘face prints’ of their customers without consent.

Bunnings’ COO Simon McDowell has previously said the technology was used only for security after an “increase in the number of challenging interactions our team have had to handle”.

The OAIC also said it has “commenced preliminary inquiries” with The Good Guys which “paused its use of facial recognition technology” in the wake of the CHOICE investigation.

The Good Guys took the decision “pending any clarification from the OAIC regarding the use of this technology”.

In a statement, Bunnings told iTnews that they were aware of "OAIC's investigation into the use of facial recognition technology in our stores and we will cooperate with them".

"As we’ve previously explained, this technology is used solely to help keep team and customers safe and prevent unlawful activity in our stores and we have strict controls around its use," the spokesperson said.

Kmart provided a similar statement, noting that its "trial of the use of this technology in some stores was for limited purposes, including loss prevention, and we have strict controls around its use".

Privacy commissioner Angelene Falk last month said it is “important that all retail stores, when they are deciding whether to use technology to collect personal information, consider the impact on privacy, the community’s expectations and the need to comply with privacy law”.

“The Privacy Act generally requires retailers to only collect sensitive biometric information if it’s reasonably necessary for their functions or activities, and where they have clear consent,” she said at the time.

“While deterring theft and creating a safe environment are important goals, using high privacy impact technologies in stores carries significant privacy risks.

“Retailers need to be able to demonstrate that it is a proportionate response to collect the facial templates of all of their customers coming into their stores for this purpose.”

Last year, the OAIC ordered the Australian arm of 7-Eleven to destroy faceprints collected at 700 convenience stores on iPads set up to run customer surveys.

Updated at 9:26am on July 13 to include statements from Bunnings and Kmart