Australia’s OAIC Rules Kmart Misused Facial Recognition Tech

URGENT UPDATE: Australia’s Office of the Australian Information Commissioner (OAIC) has just ruled that Kmart violated privacy laws by improperly using facial recognition technology (FRT) to collect customers’ biometric data. This landmark decision comes as authorities emphasize the need for a high bar for consent when employing surveillance technologies in retail environments.

On Thursday, October 5, 2023, the OAIC confirmed that Kmart’s FRT system, aimed at identifying individuals committing refund fraud, breached the Australian Privacy Act by failing to secure proper consent from shoppers. This ruling marks the second significant finding against Kmart, following a similar verdict in October 2024, where the company was cited for using facial recognition-equipped CCTV cameras to monitor behavior in-store.

Privacy Commissioner Carly Kind highlighted that both rulings reaffirm the necessity for retailers to obtain explicit consent when collecting sensitive personal information. She stated, “The effect of this determination is… to clarify the threshold for reliance on the exemptions in the Privacy Act in relation to the need to gain consent for the collection of sensitive information. It is a high bar that must be cleared, and for good reason.”

This ruling has immediate implications for Kmart and potentially other retailers. The OAIC found that Kmart recorded the faces of everyone entering its 28 retail stores from June 2020 to July 2022, raising serious privacy concerns. According to the Commissioner, the indiscriminate collection of biometric data cannot be justified as Kmart did not demonstrate that the benefits of using FRT to combat refund fraud outweighed the invasion of customers’ privacy.

While Kmart faces significant repercussions, other retailers, such as Bunnings, continue to advocate for the use of facial recognition. Bunnings, criticized for its own facial recognition practices, reported that 78 percent of nearly 11,000 respondents in a poll supported its FRT implementation, citing it as a crucial tool for safety. The company previously shared footage of staff abuse to bolster its claims for the technology’s necessity and is currently appealing OAIC’s decision regarding its use of facial recognition.

As the retail landscape evolves, the OAIC’s recent decision underscores a critical moment in the dialogue surrounding privacy and technology. Kmart’s ongoing challenges may serve as a precedent for how other companies approach biometric data collection and consumer consent.

The OAIC’s rulings signal a tightening of regulations surrounding facial recognition technology in Australia, with potential ripple effects across the globe. Retailers must now navigate the complexities of privacy laws while ensuring customer safety, leading to a critical reassessment of how such technologies are implemented in stores.

Stay tuned for further developments as the implications of this ruling unfold in the retail sector.