Kmart and Bunnings have temporarily halted their use of facial recognition in stores pending an investigation from the Office of the Australian Information Commissioner (OAIC).

It was last month revealed that Wesfarmers-owned Kmart and Bunnings, and whitegoods retailer the Good Guys, quietly began using facial recognition in some stores without express consent from their customers.

While the Good Guys said it would pause a trial of the controversial technology, Bunnings and Kmart initially dug in their heels before this week admitting facial recognition systems had been turned off as the OAIC conducts its investigation.

Kate Bower, a consumer data advocate with consumer group Choice, said Kmart and Bunnings’s decisions to halt the use of facial recognition was “a win for consumers”.

“We know this is what customers have been asking for,” Bower told Information Age.

“We have been overwhelmed by the response from consumers who said facial recognition crosses the line.”

Of the 16,000 respondents to a recent Choice poll, 80 per cent said they wanted Kmart and Bunnings to dump facial recognition technology altogether.

Bower said the public backlash should “send a clear message to all retailers” that Australians don’t want invasive surveillance technology as part of their shopping experience.

“Australians might be okay with CCTV cameras in stores and loyalty programs gathering data about their shopping behaviour, but it's quite clear that biometric surveillance is a step too far,” she said.

Bunnings and Kmart have continued to defend the use of facial recognition for “preventing criminal activity”, with a Kmart spokesperson saying its facial recognition use was “appropriate” and “subject to strict controls”.

Faceprints

In an emailed statement, Bunnings managing director Mike Schneider reiterated that the hardware chain was only collecting biometric information about its customers to enforce bans.

“Facial recognition gives us a chance to identify when a banned person enters a store so we can support our team to handle the situation before it escalates,” he said.

“For absolute clarity, an individual’s image is only retained by the system if they are already enrolled in the database of individuals who are banned or associated with crime in our stores.

“We don’t use it for marketing or customer behaviour tracking, and we certainly don’t use it identify regular customers who enter our stores.”

But Justin Warren, chair of digital rights advocacy group Electronic Frontiers Australia, maintains Schneider’s position – that these types of surveillance systems are okay to use since they only store images of “the known bad” in a database – fundamentally misrepresents the way the technology works.

“The system wants to know if the person it just took a photo of matches someone in the database,” he told Information Age.

“The only way to do that is to scan people’s faces and create a faceprint – otherwise, what are you matching against the database?”

Faceprints, mathematical representations of faces that can be used as unique identifiers, are a form biometric data that is classed as ‘sensitive information’ under the Privacy Act.

Sensitive information

Other forms of sensitive information include data about a person’s race, health, and their political or religious affiliations.

Because of its nature, sensitive information is controlled more strictly than non-sensitive information and must be collected consensually unless in certain prescribed circumstances.

To continue using their facial recognition systems, Bunnings and Kmart will need to argue that indiscriminately collecting biometric data without customers’ informed consent is necessary and proportionate for the purposes of store security and enforcing bans.

Bower is hopeful the OAIC will make a “strong determination” against the retailers.

“There are less invasive options for store security like hiring more security guards and using CCTV footage,” she told Information Age.

Warren said the community backlash ought to be enough reason for the retailers to permanently bin their facial recognition technology and not just pause it “when a regulator gets involved”.

“We should expect corporations in Australia to act in line with community expectations in order to maintain their social license and continue operating here,” he said.

“If companies are not okay with that higher standard, they are free to leave this country.”

On Sunday, Choice published a statement agreed to by 17 major Australian retailers, including supermarket giants Coles and Woolworths, which simply reads: “We are not using facial recognition in stores and we have no plans to introduce it”.