Australia’s privacy watchdog has warned retailers that the tribunal decision overturning her ruling against facial recognition at Bunnings is not a green light for widespread biometric surveillance in stores.
Privacy Commissioner Carly Kind said retailers using AI-enabled facial surveillance must still prove they have strong privacy safeguards, that the technology addresses serious safety risks, and that its use is strictly limited to crime prevention.
The warning follows a decision by the Administrative Review Tribunal (ART) that overturned Kind’s earlier ruling that Bunnings’ use of biometric matching was unlawful.
Although Kind confirmed she would not appeal the ruling, she signalled closer scrutiny ahead, flagging incoming “specific updates to existing guidance” and changes to “our regulatory application of the law”.
The comments raise compliance questions for dozens of shopping malls and thousands of retailers using facial detection systems – including those analysing shoppers’ faces for advertising.
“Crime prevention” not a blanket excuse
Kind said ART did not rule that retail crime prevention alone was a permissible exception for using the “highly privacy-invasive tool”.
Instead, the tribunal relied heavily on Bunnings’ “unique threats”, including the “size and layout of its stores” and potential offenders’ access to axes, screwdrivers and other products that could be used as weapons.
Kind also stressed that ART did not overturn her finding that consumers’ facial data is sensitive information.
Nor did it reject her view that processing facial data for “milliseconds” before deleting it does not mean a retailer has not “collect[ed]” it.
That means “the Privacy Act’s safeguards apply” when there is no permissible exception.
The clarification raises compliance questions for two parts of the retail sector: businesses using facial recognition for crime prevention without Bunnings’ strict safeguards, and those collecting facial data for advertising.
Thousands of AI SmartScreens analyse faces
Across Australia, facial analytics SmartScreens are installed in shopping centres, supermarkets, petrol stations, liquor stores and gyms.
These systems analyse consumers’ demographics, mood, location and time data to improve targeted advertising.
Even if biometric identifiers are deleted after processing, operators may still legally be collecting facial data – particularly if the information could be re-identified.
None of the SmartScreen operators or software providers contacted by Information Age responded to requests for comment.
VMO operates more than 1,200 facial analytics SmartScreens at sites including BP, Ampol, Caltex, Reddy Express, shopping centres, gyms and Coles.
The network targets demographic-based audiences with brands such as White Claw, KFC, Gatorade, juice brands, and various betting apps.
By combining facial analytics with shopping centres’ “location”, gyms’ “membership” and "Caltex’s transactional data", VMO says it uses “machine learning techniques to… create a prediction model of specific audiences.”
Meanwhile Westfield operates more than 1,650 facial analytics SmartScreens across 42 shopping centres.
The system predicts target audiences for brands including Stella Artois, Johnnie Walker, BWS, Bonds, Samsung, Disney, Foxtel and Mazda “to influence every customer journey.”
Malls’ FRT tracks associates
Retail facial recognition is also being deployed for broader surveillance purposes.
According to video management systems vendor Milestone Systems, a “busy suburban shopping centre” in Western Sydney – with a retail mix similar to Carnes Hill Marketplace – uses facial recognition from Vix Vizion.
In a customer case study, the companies said that “in addition to identifying troublesome individuals, the system can also recognise and track known associates of repeat offenders.”
Neither company responded to requests for comment.
Advocacy group Digital Rights Watch told Information Age it “agreed with the Privacy Commissioner that the ART’s decision is not a green light for deployment of biometric technologies.”
Deputy chair Tom Sulston said it was time for Attorney-General Michelle Rowland to introduce stronger laws.
“We need to go to the shops without having our biometric information collected by big corporations.”
