Australian home hardware retail giant Bunnings Warehouse breached Australia's Privacy Act with its use of facial recognition technology, an official investigation has found.
The probe into Bunnings and Kmart was launched by the Office of the Australian Information Commissioner (OAIC) following a CHOICE investigation into the companies in July 2022.
Our investigation found that the popular retailers, along with The Good Guys, were capturing biometric information on customers through facial recognition technology in stores, largely without customers' knowledge or consent. The Good Guys immediately paused their trial of the technology following CHOICE's report.
Our story generated considerable customer backlash against the companies and gave rise to the OAIC investigation. Just over a month later, in July 2022, both Bunnings and Kmart announced they would halt their use of facial recognition technology while the OAIC investigation was ongoing.
On Tuesday, Privacy Commissioner Carly Kind found that Bunnings Group Limited had breached Australia's Privacy Act. There was no further information about the investigation into Kmart.
Facial recognition information collected without consent
Kind says the facial recognition cameras which were in use in 63 Bunnings stores in Victoria and New South Wales between November 2018 and November 2021 likely captured the faces of hundreds of thousands of customers.
"Facial recognition technology, and the surveillance it enables, has emerged as one of the most ethically challenging new technologies in recent years," Commissioner Kind says.
"We acknowledge the potential for facial recognition technology to help protect against serious issues, such as crime and violent behaviour. However, any possible benefits need to be weighed against the impact on privacy rights, as well as our collective values as a society … Just because a technology may be helpful or convenient, does not mean its use is justifiable."
Just because a technology may be helpful or convenient, does not mean its use is justifiable
OAIC Commissioner Carly Kind
Kind went on to say that Bunnings collected the sensitive facial recognition information without consent and failed to take responsible steps to notify the individuals that their personal information was being collected.
"Individuals who entered the relevant Bunnings stores at the time would not have been aware that facial recognition technology was in use and especially that their sensitive information was being collected, even if briefly," says Kind.
The Commissioner says Bunnings acted cooperatively throughout the investigation and that OAIC has made various orders including that the company must not repeat or continue the acts that led to the privacy breach in the first place.
"This decision should serve as a reminder to all organisations to proactively consider how the use of technology might impact privacy and to make sure privacy obligations are met," she says.
Landmark ruling highlights outdated privacy laws
CHOICE senior campaigns and policy advisor Rafi Alam says he hoped the landmark decision from OAIC would provide much needed guidance on the use of facial recognition technology.
"We know the Australian community has been shocked and angered by the use of facial recognition technology in a number of settings, including sporting and concert venues, pubs and clubs, and big retailers like Bunnings. We hope that today's decision from the Information Commissioner will put businesses on notice when it comes to how they're using facial recognition," says Alam.
"While the decision from the OAIC is a strong step in the right direction, there is still more to be done. Australia's current privacy laws are confusing, outdated and difficult to enforce. CHOICE first raised the alarm on Bunnings' use of facial recognition technology over two years ago, and in the time it took to reach today's determination the technology has only grown in use," says Alam.
CHOICE first raised the alarm over two years ago, and in the time it took to reach today's determination the technology has only grown in use
CHOICE senior campaigns and policy advisor Rafi Alam
Alam adds that CHOICE is continuing to call for a specific, fit-for-purpose law to protect consumers from the harms that can occur without proper and clear regulation of facial recognition technology.
Bunnings has the right to appeal and seek a review of the determination and told CHOICE on Tuesday they would formally do so before the Administrative Review Tribunal.
"FRT (facial recognition technology) was an important tool for helping to keep our team members and customers safe from repeat offenders. Safety of our team, customers and visitors is not an issue justified by numbers. We believe that in the context of the privacy laws, if we protect even one person from injury or trauma in our stores the use of FRT has been justifiable," Mike Schneider, Bunnings managing director says.
Stock images: Getty, unless otherwise stated.
