Australian retailers Kmart, Bunnings, and the Good Guys are testing the use of facial recognition in their stores with limited consent from customers.

According to a report from consumer group Choice, people are oblivious to the fact biometric data may be gathered while they buy homewares, with 76 per cent of respondents to a survey saying they were unaware Australian stores were starting to use facial recognition.

Signage is part of the problem, said Professor Mark Andrejevic from Monash University – an academic who has a background in public attitudes toward data collection.

“The first concern is notice and consent,” he said.

“It's not in highly visible forms of public notification that would invite people to understand what's taking place.”

Kmart stores where facial recognition is in use, for example, have a mention of it tacked onto the end of a small, printed ‘Conditions of entry’ sign at the entry point that says staff can check your bags in-store.

“This store has 24 hour CCTV coverage, which includes facial recognition technology,” a sign at a Kmart store in Marrickville read, as shared by Choice.

Convenience store chain 7-Eleven was found to be in breach of the Australian Privacy Principles after it took pictures of customers’ faces when filling out in-store surveys.

The images were used by a third party to create faceprints of individuals in order to filter out inauthentic survey responses.

In that instance, the Information Commissioner said 7-Eleven failed to adequately notify customers about collecting biometric data, despite having in-store notices that said “by entering the store you consent to facial recognition cameras capturing and storing your image”.

A sign outside a Kmart store. Image: Choice

Biometric information is classed as “sensitive” under the Privacy Act meaning its collection is protected by a strict set of laws that also covers health data and details about a person’s race or sexual orientation.

Sensitive information cannot be legally collected without consent – but there are some “permitted general situations” such as if the entity collecting information “has reason to suspect that unlawful activity” related to its functions “is being or may be engaged in”.

The entity must also believe that the collection of sensitive information is “necessary … to take appropriate action”.

Kmart and Bunnings, both owned by Wesfarmers, claim in their privacy policies that facial images are only used for “loss prevention or store safety purposes”, while the Good Guys adds that faceprints could also be used for “managing/improving customer experience”.

Choice said it intends on referring the three retailers to the Information Commissioner.

There are fears this technological incursion could lead to facial recognition being used to analyse people for advertising and other purposes.

“We don't have a clear set of regulations or guidelines on the appropriate use of the technology,” Professor Andrejevic. “That leaves it pretty wide open.

“Stores may be using it for the purposes of security now, but down the road, they may also include terms of use that would say that they can use it for marketing purposes.”

Ed Santow, former Human Rights Commissioner and now a professor at the University of Technology Sydney, shared Andrejevic’s concerns about the retailers’ use of facial recognition.

“Even if that technology was perfectly accurate, and it’s not, but even if it were, it also takes us into the realm of mass surveillance,” he said.

“I think there will be great concern in the Australian community about walking down that path.”