Kmart and Bunnings will continue to use controversial facial recognition technology in-store, despite another major retailer abandoning it due to an ongoing privacy investigation.
Choice filed a complaint with the Office of the Australian Information Commissioner earlier this month after revealing retailers’ use of facial recognition.
Choice said most Australian shoppers were unaware of using the technology, with some telling the group they found it “creepy and invasive”.
Also included in Choice’s complaint was electronics retailer The Good Guys, who confirmed on Tuesday that it would suspend technology trials at two Melbourne stores during the investigation.
However, Kmart and Bunnings have doubled down on their programs, with a leading cyber intelligence expert thrashing them for a “lack of disclosure.”
Tweet from @choiceaustralia
no way out
Representatives of Bunnings and Kmart, both owned by Wesfarmers, told news gear on Wednesday that they would continue to use facial recognition technology in their stores.
Both companies have previously said they believe its use is legal.
On Wednesday, they declined to answer repeated questions about which stores had the technology, how long it had been used, and where data was stored.
Dr. Dennis Desmond, a cyber intelligence lecturer at the University of the Sunshine Coast, said it was disturbing that customers could not opt out of such data collection.
“The problem I have with using those technologies is… a lack of disclosure to the individuals captured on video or still in a store [about] storing the data [and] how the data is actually used,” he said.
“I think it’s incredibly sensitive. And I think customers should have the option to unsubscribe, or at least have their data deleted when they leave the store.”
‘Not necessary
The Good Guys said it planned to use the data to “assess incidents of theft and for the safety and well-being of customers and team members”.
Bunnings and Kmart’s privacy policies note that facial recognition is for “loss prevention or store security purposes.”
Dr. Desmond said he saw “no need” for retailers to use facial recognition analytics to prevent theft.
“Historically… if there is an incident, [footage] is handed over to law enforcement officers, who would then identify the perpetrators,” he said.
“I’m not sure if it’s up to individual retailers to identify criminals and perpetrators. That is a law enforcement function.
“While they certainly want to be able to collect the evidence, there’s no need for them to actually perform identity resolution or facial recognition on that data.”
dr. Desmond says concerns about the use of facial recognition technology by retailers are “absolutely” justified.
Painting a bigger picture
dr. Desmond said the data collected by such technology could be used for everything from tracking consumer behavior to tailoring marketing.
“Technology has advanced to the point where it is being used by some organizations to identify the frequency of shopping [and] marketing by identifying which aisles people actually go through and what products they look at,” he said.
He said the data could be linked to other customer information, such as payment methods and mobile phone details.
“It could be used for various applications, even affecting whether or not to grant loans or health insurance.” [by identifying] risky behavior,” he says.
Representatives from Kmart and Bunnings declined to comment on data sharing with third parties.
Dr. Desmond said both companies’ connections with other companies needed to be looked at more closely to understand what else the data could be used for.
“It’s hard to say unless you really look at the company’s contract connections with other companies or whether they disclose data-sharing processes and procedures,” he said.
Exceed the law
In response to Choice’s complaint, the OAIC investigates whether Kmart, Bunnings, and The Good Guys violated the 1988 Privacy Act.
Dr. Desmond said it was “typical” for technology to transcend legal and policy frameworks.
“It is only when the public raises the alarm and raises concerns about privacy and personal rights that changes in policy and legislation occur,” he said.
While the technology could be ahead of its time, Dr. Desmond said retailers had questions about collecting, storing, and using customer data.
“Is it stored locally? Is it stored off-site? How is it transferred? Is it stored in an encrypted format? Or is it in plain digital text or binary that could potentially be violated? If Is it shared? How is it shared? How often?
“Data is of great value. And keeping this aggregated data that has been analyzed and packaged is an absolute gold mine for criminals and nation-states.”
Just the beginning
This kind of technology may soon become the norm in public places – unless legislation prohibits its entry into force.
“We will continue to see the use of advanced technologies, including artificial intelligence, machine learning, and different types of collection and reporting until we see legislation that specifically prohibits the collection, sharing,g, and retention of that type of data,” said Dr. Desmond.
