Australian retailer Kmart breaches privacy with facial recognition tech, regulator says
An Australian regulator said on Thursday that Wesfarmers' budget department store Kmart has breached privacy by collecting personal and sensitive information via a facial recognition technology system designed to combat refund fraud.
The Office of the Australian Information Commissioner (OAIC) found that Kmart did not notify shoppers or seek their consent to use the technology to collect their biometric information.
The Australian watchdog said Kmart deployed the technology to capture the details of every customer who entered 28 of its retail stores between June 2020 and July 2022.
According to the OAIC, Kmart argued it was not required to obtain consent because of an exemption in the Privacy Act that applies when organisations believe they need to collect personal information to tackle unlawful activity.
A Kmart spokesperson told Reuters the images from facial recognition technology were only retained if they matched a person reasonably suspected of engaging in refund fraud, while all other images were deleted.
The retailer said it was "disappointed" with the determination and was reviewing its options to appeal.
Facial images and other biometric information are considered sensitive under Australia's privacy laws, and the OAIC determination is instructive for businesses considering the deployment of new technologies like facial recognition.
"Customer and staff safety, and fraud prevention and detection are legitimate reasons businesses might have regard to when considering the deployment of new technologies. However, these reasons are not...a free pass to avoid compliance with the Privacy Act," Privacy Commissioner Carly Kind said in a statement.
The determination is the second issued by the OAIC on the use of facial recognition technology in retail settings. Last year, the regulator found that Wesfarmers-owned home improvement chain Bunnings breached the privacy of thousands of customers by using the tool without gaining consent.
