The privacy watchdog expects to finalise inquiries it launched into Bunnings and Kmart’s use of facial recognition within months, but has declined to say if the intrusive technology is a breach of Australia’s privacy principles.
Fronting a Senate Estimates hearing on Monday night, Australian Information Commissioner Angelene Falk said the two inquiries she initiated in July are “substantially” advanced and expected to be finalised “in the coming months”.
In June, consumer group Choice uncovered the use of facial recognition by Bunnings, Kmart and The Good Guys without clear notification to customers or explicit consent.
The three companies defended their use of facial recognition, saying it is needed to reduce theft and keep employees safe in stores, and customers were made aware of the practice through physical signage at store and in online privacy policies.
But following public backlash, The Good Guys agreed to pause its use of the technology – a move which spared it from an investigation.
Bunnings and Kmart dug in, and after a formal complaint by Choice to the Office of the Australian Information Commissioner (OAIC), Ms Falk launched investigations.
Privacy experts say the use of facial recognition by the retailers without a proactive agreement from customers is a breach of Australia’s privacy principles. This is because the biometric data is considered sensitive under Australian privacy law.
The retailers need to argue the their use of the technology is proportionate to the business function and privacy impacts.
After a determination against retailer 7-11 in 2021 for its covert use of facial recognition, and findings against Clearview AI for scraping facial images, experts say this will be a hard case for Bunnings and Kmart to make.
Asked on Monday if the use of facial recognition technology by retailers of their customers is a breach of the privacy principle, Ms Falk would not make a definitive statement but agreed it was of concern.
“This is the very issue that’s been traversed in the investigations of Kmart and Bunnings,” Ms Falk told the hearing.
“And the use of facial recognition technology is of concern in that it is an impact on privacy. In terms of the Privacy Act, it should only be used where it’s reasonably necessary for the entities functions and activities. And it’s an issue of proportionality that we’re investigating in these matters.”
The OAIC has a performance metric to finalise Commissioner launched investigations within a year, a mark it has been struggling to hit.
Ms Falk said she expects the investigations to be concluded by June, if not in the “coming months”.
Do you know more? Contact James Riley via Email.