close
close

Association-anemone

Bite-sized brilliance in every update

Bunnings broke privacy laws with facial recognition technology, commissioner says
asane

Bunnings broke privacy laws with facial recognition technology, commissioner says

The lowest prices were just the start for hundreds of thousands of Australians whose facial data was recorded by Bunnings without their consent.
The Office of the Australian Information Commissioner (OAIC) ​​has ruled that the retail giant breached privacy laws when it used facial recognition technology linked to CCTV (FRT) to capture the face of every person who entered 63 stores in NSW and Victoria in the three years to November 2021.
Bunnings chief executive Mike Schneider said the company had launched the technology to tackle shoplifting and violence in its stores and would appeal the ruling.
“FRT has been trialled in a limited number of Bunnings stores in Victoria and NSW between 2018 and 2021, with strict controls over its use, with the sole and clear intention of keeping team members and customers safe and preventing activities illegal,” Schneider said in a statement. statement.

About 70 percent of the incidents were caused by “the same group of people,” the company said.

“FRT has provided the fastest and most accurate way to identify these individuals and quickly remove them from our stores.”
In her ruling, Privacy Commissioner Carly Kind acknowledged the technology’s potential to protect against crime and violent behaviour.
“However, any possible benefits must be weighed against the impact on privacy rights as well as our collective values ​​as a society,” she said.

The determination found that Bunnings took customers’ private information without consent, took no steps to notify them and left gaps in its privacy policy.

Rear view of a man wearing a high visibility orange shirt in a Bunnings story

Bunnings has used facial recognition technology in its stores. Source: AAP / /

Kind said the technology was an intrusive option that interfered with the privacy of all customers, not just high-risk individuals.

“Individuals who entered the relevant Bunnings stores at the time would not have been aware that facial recognition technology was in use and especially that their sensitive information was being collected, even if briefly,” she said.
“We cannot change our face. The Privacy Act recognizes this by classifying our facial image and other biometric information as sensitive information that has a high level of privacy protection, including that consent is generally required for it to be collected.”
Bunnings was ordered not to repeat or continue the practice and must destroy all personal and sensitive information it collected through the FRT within one year.
Against a backdrop of rapid technological change, the determination followed a two-year investigation and was a landmark ruling for Australian privacy laws.

“Facial recognition technology, and the surveillance it enables, has emerged as one of the most ethically challenging new technologies in recent years,” Kind said.

The OAIC said the decision should be a reminder to companies about their confidentiality obligations and published a for companies considering using facial recognition technology.
Consumer advocate CHOICE, which raised the alarm about Bunnings’ practices more than two years ago, said the technology had grown in use since then.
“While the decision by the Information Commissioner’s Office is a strong step in the right direction, there is still much more to be done,” said Rafi Alam, campaign and policy adviser at CHOICE.

“CHOICE continues to call for a specific, fit-for-purpose law that holds businesses accountable as soon as they breach customer privacy.”