Choice revealed on Tuesday that several major Australian retailers are using face surveillance technology in their stores, to the great surprise of the vast majority of customers.
Face surveillance is an inherently dangerous technology and it has no place in retail stores.
EFA does not believe the use of this technology is necessary or proportionate to address the issues the retailers have used to justify its use. EFA also does not believe the retailers have a lawful basis to be using this technology due to a fundamental misunderstanding of both privacy law and the way facial surveillance technology works.
Until organisations suffer consequences for these kinds of privacy violations, EFA believes the situation will not improve. We endorse the recommendation made by the Australian Law Reform Commission in 2014 that there should be a private right of action (a tort) for serious breach of privacy. We should not have to wait for an underfunded and overwhelmed regulator to one day perhaps consider taking action. We should also be able to take steps individually, and collectively, to address the abuses of power by organisations.
More robust privacy protections are long overdue and it is well past time for the Australian government to act.
Contacting Bunnings
EFA Chair Justin Warren contacted Bunnings to learn more about what they were doing and why.
He initially called their contact centre, but they were unable to provide more information than prepared talking points. He learned that Bunnings had been receiving many calls from concerned Australians after the media coverage of the issue. He then sent an email to the Bunnings privacy team:
Hello!
It seems we’re not alone in being surprised by the news today that Bunnings is using facial surveillance on its customers.
I have some questions, on behalf of our members:
– Is Bunnings aware of the 7-Eleven case in which the OAIC found 7-Eleven stores’ use of facial surveillance was unlawful? (https://www8.austlii.edu.au/cgi-bin/viewdoc/au/cases/cth/AICmr/2021/50.html)
– On what basis does Bunnings believe the use of facial surveillance in its stores is lawful?
– Did Bunnings seek legal advice regarding the legality of using facial surveillance before implementing the system? Is so, would Bunnings be able to publicly share that advice?
– On what basis does Bunnings believe members of the public have provided informed consent for the use of facial surveillance?
I would also like to request access to my personal information held by Bunnings, as required by Australian Privacy Principle 12. I wish to receive access via electronic means, by email.
Bunnings Reply
Bunnings replied a day later and failed to answer any of our questions.
Hi Justin,
Thanks for your feedback. We have also seen the recent media reporting regarding the use of facial recognition in our stores and are separately raising our concerns regarding the accuracy of this reporting directly with the outlets involved. In particular, this reporting suggests that facial recognition is applied to all customers. This is simply not the case, as detailed below.
The safety of our team and customers is at the core of what we do and we have several measures in place in our stores to help keep our team and customers safe.
At selected stores, our CCTV systems utilise facial recognition technology, which is used to support the safety of our team and customers against repeat violent or threatening behaviour, and to prevent unlawful behaviour in our stores. Images are only uploaded to this system following a particular individual being formally banned from one of our stores, or after them being suspected of engaging in unlawful or threatening conduct in our stores. The facial recognition technology checks for matches against these uploaded images, and where there isn’t a match then no action occurs. No data relating to anyone other than these uploaded images are stored in the system.
In recent years, we’ve seen an increase in the number of challenging interactions our team have had to handle in our stores and this technology is an important tool in helping us to prevent repeat abuse of team and customers.
We let customers know if the technology is in use through signage at our store entrances and also in our privacy policy, which is available on our website. Our use is solely for the purpose of preventing threatening situations and theft, which is consistent with the Privacy Act. This technology is not used for any other purpose, including marketing or behavioural insights.
It’s really important to us that we do everything we can to ensure a safe and supportive environment for our team and customers in our stores, and we believe this technology is an important measure that helps us achieve this outcome.
Kind Regards
Bunnings Privacy Team
A Fundamental Misunderstanding
The Bunnings reply highlights a fundamental misunderstanding about an important aspect of how facial surveillance technology works.
If Bunnings wishes to check if a customer is—or is not—on their list of “formally banned from one of our stores, or after them being suspected of engaging in unlawful or threatening conduct in our stores” it must:
- Take a picture of each customer.
- Compute a ‘faceprint’ from the image.
- Compare the faceprint with the faceprints recorded in the system.
It is not possible to not surveil people with one of these systems. They are designed specifically to perform mass-surveillance.
It appears that Bunnings has fundamentally misunderstood both privacy law and the technology it is using. These mistakes place all of us at risk. Privacy harms from mass surveillance are not merely individual; they are also communal.
We know this kind of technology is embedded with serious algorithmic bias, especially when identifying or misidentifying non-white faces. So people with darker skin tones would be more likely to be misidentified – this is racial bias. In an environment where Aboriginal and Torres Strait Islander peoples are over-policed and over-represented in prison systems, we can only expect that racial bias to be amplified by the use of facial recognition technology.
Further Back and Forth
Justin replied to Bunnings, pointing out that they had not actually answered any of his questions.
Firstly, you have not answered my questions.
Secondly, you appear to have fundamentally misunderstood the technology you are using.
In order to check if my face matches, or does not match, the faceprint of a person you have recorded in your system as someone “formally banned from one of our stores, or after them being suspected of engaging in unlawful or threatening conduct” you must a) capture an image of my face, b) generate a faceprint from the image, c) check to see if it matches any of the faceprints in your system.
It is possible that this is a mistake based on ignorance, but it might also be a deliberate falsehood, and based on the reaction to the revelation you’re doing this, I am inclined towards the latter.
Finally, I shall restate my questions:
- Is Bunnings aware of the 7-Eleven case in which the OAIC found 7-Eleven stores’ use of facial surveillance was unlawful? (https://www8.austlii.edu.au/cgi-bin/viewdoc/au/cases/cth/AICmr/2021/50.html)
- On what basis does Bunnings believe the use of facial surveillance in its stores is lawful?
- Did Bunnings seek legal advice regarding the legality of using facial surveillance before implementing the system? Is so, would Bunnings be able to publicly share that advice?
- On what basis does Bunnings believe members of the public have provided informed consent for the use of facial surveillance?
Bunnings responded:
Hi Justin
We’re sorry we weren’t able to resolve this for you in the first instance.
We can clarify that faceprint matches only occur for uploaded images, as you have queried. No faceprints for anyone other than these uploaded images are retained.
As to the balance of your questions, Bunnings has carefully considered this particular application of facial recognition technology and is comfortable that this use is undertaken in accordance with the requirements of the Privacy Act. This consideration has extended to reviewing the OAIC’s previous determinations regarding other businesses’ use of facial recognition technology for other purposes.
Kind Regards
Bunnings Privacy Team
Missing the Point
Bunnings has, once again, missed the point here.
The issue is not so much that faceprints are not retained, but that they are made at all.
What Bunnings is doing is akin to fingerprinting every customer, and then taking the piece of paper the fingerprints are on and checking it against a list of fingerprints they have in a file. The fact they then throw away that piece of paper isn’t the problem, it’s that they took the customer’s fingerprints in the first place.
In fact, what Bunnings is doing is worse because the faceprints are created surreptitiously and without explicit customer consent.
Bunnings does not appear to understand the way this technology works. Or they do and are being deliberately misleading about it in order to attempt to justify this outrageous behaviour. EFA also believes Bunnings has fundamentally misunderstood privacy law and the lessons to be learned from the OAIC decision against 7-Eleven.
It appears that it will take an external intervention to resolve this matter, so EFA looks forward to seeing the results of an OAIC investigation.
That’s the best we can hope for until Australia passes more rigorous privacy laws that would allow us to individually take action against organisations that do this.
EFA will continue to follow up this issue with the retailers and with the privacy regulator.