The use of CCTV systems to collect biometric information from individuals in Australia is attracting headlines. The issue relates not to the use of CCTV itself, but rather the collection of biometric information (i.e. electronic copies of faces, fingerprints, voices) via CCTV. Organisations, including retailers, may collect biometric information via CCTV for a variety of reasons, including to build profiles of the individuals entering their stores, identify returning shoppers or to identify specific individuals that have previously been removed from their premises.
Last year the Australian privacy regulator, the Office of the Australian Information Commissioner (OAIC), made a determination against the convenience store operator 7-Eleven regarding its large scale collection of sensitive biometric information. 7-Eleven captured images of consumer faces via in-store tablets provided for customers to complete surveys regarding their experience with 7-Eleven. The OAIC determined that this collection was not reasonably necessary for the purpose of improving and understanding customers’ in-store experience, and that 7-Eleven had collected the information without consent. This amounted to two breaches of the Australian Privacy Principles within the Privacy Act 1988 (Cth) (Privacy Act).
More recently, consumer advocate group Choice has announced that, following an investigation into practices in the Australian retail sector, it will refer major national retailers Kmart, Bunnings and the Goods Guys to the OAIC regarding the use of facial recognition technology in their in-store CCTV systems. Choice considers that this information is being collected without sufficient notice to customers and that the information collected is “disproportionate” to the legitimate business functions of the retailers in question. One of the retailers in question, Good Guys, commented that facial recognition was used for security and theft prevention, and also for managing/improving customer experiences.
The OAIC has responded to Choice’s referral, stating that it will consider the information provided. The OAIC noted that retailers need to balance business needs with legal compliance and community expectations and attitudes. In respect of consumer attitudes, we note that a 2020 study commissioned by the OAIC found that a majority of Australians are uncomfortable with their biometric information being collected in retail stores. The OAIC’s full statement is available here.
The OAIC has now opened investigations into both Bunnings’ and Kmart’s use of facial recognition technology (with the Good Guys pausing their use of the technology). Whilst the outcome of these investigations remains to be seen, it is clear that the existing framework in the Privacy Act regarding sensitive personal information applies to biometric information and should be applied carefully.
