Finally! This month, Australia’s Privacy Commissioner Carly Kind ruled that Bunnings’ facial recognition system violated the privacy of millions of Australians.
The OAIC found that the use of facial recognition was also found to be disproportionate to the risk of violence or theft in retail stores. Electronic Frontiers Australia welcomes the decision as a step in the right direction.
We hope this ruling will send a loud message to other retailers and corporations: stay away from facial recognition. And to our fellow Australians, let’s use this saga to interrogate what these powerful systems mean for our privacy.
However, there’s more to the story, and EFA is here to break it down. This ruling isn’t the end of it. Whether you’re new to the topic or already up to speed, stick around—and maybe share this blog with a friend or two. This is a big deal. Unlike other types of data, our faces cannot be encrypted. Once your biometric data is taken, it’s game over. Corporations will insist that facial recognition is necessary to combat theft, but we know its applications could, and will, extend far beyond that—to marketing, profiling, or even more malicious uses.
Let’s get one thing clear: an invasion of privacy is an invasion of privacy, no matter the intent.
Let’s start with the good news. The Privacy Commissioner considered the Australian Privacy Principle (APP) 3, which states that data from facial scanning can only be collected if it is necessary and proportionate. It must not be used if the purpose—such as preventing shoplifting, as Bunnings claims—can be achieved through less intrusive means.
Facial recognition is obviously the most intrusive option. Why? Because it treats every person walking onto the store as a suspect first until it is ‘confirmed’ they are not. Where is the presumption of innocence? Alternatives like anti-theft gates, staff training, and employing security guards could do the job without violating customer privacy. But alas, these methods cost more money. As soon as profit margins come into the play, dignity in a democracy is too high a price for Bunnings to pay
What the Bunnings Scandal Says About Our Privacy Laws
Unfortunately, it took the Office of the Australian Information Commissioner (OAIC) over two years to investigate this issue. That’s frustratingly slow. Plus, to add insult to injury the decision on Kmart’s use of facial recognition is still pending. The OAIC’s delays undermine trust in the system and makes us question if the government really takes our privacy seriously, at all?
Not to sound like a broken record, but why the delay? Back in November 2023, EFA complained about issues of OAIC efficiency in a blog post. In the 2023 Budget, $17.8 million out of a $45.2 million allocation was set aside to support its privacy-related activities.
Secondly, the ruling doesn’t appear to have had much of an impact on Bunnings. The company seems hellbent on manipulating the privacy debate in their favour. It has released video footage of store assaults and robberies, announced plans to appeal the privacy commissioner’s findings and, if successful, intends to roll out facial recognition technology across all its stores.
This is obviously shifty, but tells us that Bunnings still doesn’t fully understand—or likely chooses to ignore—the implications of the ruling. It also means that we all need to keep educating ourselves—and sharing blogs like this one with others.
The release of video footage proves a key point: sophisticated CCTV systems alone don’t deter theft or bad behaviour in stores, and neither will facial recognition technology. A better approach would be to redirect funds from this costly rollout into hiring more security guards, which also creates employment opportunities.
Bunnings should not be treating every shopper like a suspect just to identify a small minority of bad actors. Citizens are not suspects—this is at the heart of the message EFA was founded on. If you agree with us, please consider making a donation or becoming a member so you can help shape the direction of our organisation.
(Image credit: Flickr)