The ugly Facial recognition technology (FRT) has come under fire lately on numerous fronts. According to a statement from Privacy Commissioner Carly Kind, the retail behemoth contravened the privacy act. As we found in our 2022 investigation, Kmart utilized facial recognition technology (FRT) at their store entrances and return counters. That resulted in the collection of tens or hundreds of thousands of customers’ facial data within a two-year period, ending in July 2022. The stated purpose of this surveillance was to prevent refund fraud.
Kmart’s actions have crossed an important line, raising troubling questions about privacy. The retailer argued that it was not required to get customer permission for biometric data collection. They focused their argument on an exemption in the Privacy Act. This partial exemption permits organizations to account for collecting personal information if they have a reasonable belief that collection is needed to detect or prevent criminal activity. Ms. Kind dismissed this defense, finding that the steps Kmart did take were excessive in relation to their objectives.
Disproportionate Measures
Ms. Kind enjoined Kmart’s use of facial recognition technology in no uncertain terms, calling the deployment an overreach. She contended that other, less invasive, security measures would have accomplished preventing fraud just as well. She emphasized the potential harms associated with FRT, which include risks of commercial surveillance and discrimination, alongside unlawful or arbitrary arrests.
“The sensitive information of every customer who entered a relevant store was indiscriminately collected by the FRT system,” – Carly Kind, Privacy Commissioner.
Ms. Kind pointed out that this technology only caught a tiny percentage of fraudulent events. She reassured them that the real effect of it was very limited.
“The number of fraudulent incidents detected … and the value of fraud prevented … was small,” – Carly Kind, Privacy Commissioner.
As Kmart’s spokesperson was recently quoted as saying, theft and anti-social behaviour are increasing within their stores. They noted that these hurdles are what’s confronting most retailers today.
“Like most other retailers, Kmart is experiencing escalating incidents of theft in stores which are often accompanied by anti-social behaviour or acts of violence against team members and customers,” – Kmart spokesperson.
Implications for Retailers
This is not the first time the Privacy Commissioner has criticized a major retailer’s use of FRT. In October 2024, Bunnings lost a comparable case brought against its use of facial recognition across 62 stores. Ms. Kind highlighted how these particular cases differ. Yet, they present a continuing challenge around the balance retailers must strike between deploying security measures and protecting customer privacy.
“These two decisions do not impose a ban on the use of FRT,” – Carly Kind, Privacy Commissioner.
Ms. Kind noted that improving customer and staff safety and preventing fraud are strong motivators for adopting new technologies. Despite her praise for innovation, she highlighted the need for companies to respect privacy laws.
“However, these reasons are not, in and of themselves, a free pass to avoid compliance with the Privacy Act,” – Carly Kind, Privacy Commissioner.
Future Considerations
These findings highlight the importance for retailers to be mindful of their surveillance practices and the implications of their use. As technology changes, the ethical concerns around its implementation have to change with them. Kmart’s failure should act as an example to other retailers considering making a similar move.
