)
Kmart Australia has landed in the same hot water as Bunnings late last year after the Privacy Commissioner found the retail group breached the privacy of customers when it deployed facial recognition technology to identify people committing refund fraud between 2020 and 2022.
Privacy Commissioner Carly Kind says Kmart had breached the law by not seeking consent when collecting “personal and sensitive information” of its customers as it captured the faces of every person who entered 28 of its retail stores, as well as those who presented at a returns counter.
In a determination published today, the Privacy Commissioner notes that the biometric information collected by Kmart enjoys higher protections under the Privacy Act.
While Kmart argued that it was not required to obtain consent because of an exemption in the Privacy Act when tackling unlawful activity or serious misconduct, the Privacy Commissioner focused on assessing whether Kmart met the conditions for relying on this exemption.
Among the findings, the Privacy Commissioner says that the sensitive biometric information of every individual who entered a store was indiscriminately collected by the facial recognition technology (FRT) system, that it was a disproportionate interference with privacy and that deploying the FRT system to prevent fraud was of “limited utility”.
The commissioner also found there were other “less privacy intrusive methods” available to Kmart to address refund fraud.
“Understanding how FRT accords with the protections contained in Privacy Act requires me to balance the interests of individuals in having their privacy protected, on the one hand, and the interests of entities in carrying out their functions or activities, on the other,” says Kind.
“Relevant to a technology like facial recognition is also the public interest in protecting privacy.”
Among the factors considered by the Privacy Commissioner were the estimated value of fraudulent returns against Kmart’s total operations and profits, the limited effectiveness of the FRT system, and the extent of the privacy impacts in collecting the sensitive information of every individual who entered the relevant stores.
“I do not consider that the respondent (Kmart) could have reasonably believed that the benefits of the FRT system in addressing refund fraud proportionately outweighed the impact on individuals’ privacy,” says Kind.
The latest finding by the Privacy Commissioner follows a ruling in October last year that Bunnings had breached the Privacy Act during a trial of FRT at 63 stores in Victoria and NSW between 2018 and 2021, during which it is said to have captured the faces of “hundreds of thousands” of customers. Both Bunnings and Kmart are owned by Wesfarmers (ASX: WES).
“These two decisions do not impose a ban on the use of FRT,” says Kind.
“The human rights to safety and privacy are not mutually exclusive; rather, both must be preserved, upheld and promoted.
“Customer and staff safety, and fraud prevention and detection, are legitimate reasons businesses might have regard to when considering the deployment of new technologies.
“However, these reasons are not, in and of themselves, a free pass to avoid compliance with the Privacy Act.”
Kmart has been under investigation by the Office of the Australian Information Commissioner (OAIC) since July 2022, when the retailer stopped operating its FRT system.
The OAIC says that Kmart cooperated throughout its investigation.
)
