Authors: Sarah Birkett and Alex Moore 

The use of CCTV systems to collect biometric information from individuals in Australia is attracting headlines. The issue relates not to the use of CCTV itself, but rather the collection of biometric information (i.e. electronic copies of faces, fingerprints, voices) via CCTV. Organisations, including retailers, may collect biometric information via CCTV for a variety of reasons, including to build profiles of the individuals entering their stores, identify returning shoppers or to identify specific individuals that have previously been removed from their premises.

Last year the Australian privacy regulator, the Office of the Australian Information Commissioner (OAIC), made a determination against a multinational convenience store operator regarding its large scale collection of sensitive biometric information. The organisation captured images of consumer faces via in-store tablets provided for customers to complete surveys regarding their in-store experience. The OAIC determined that this collection was not reasonably necessary for the purpose of improving and understanding customers’ in-store experience, and that organisation had collected the information without consent. This amounted to two breaches of the Australian Privacy Principles within the Privacy Act 1988 (Cth) (Privacy Act).

More recently, consumer advocate group Choice has announced that, following an investigation into practices in the Australian retail sector, it will refer major national retailers Kmart, Bunnings and the Goods Guys to the OAIC regarding the use of facial recognition technology in their in-store CCTV systems. Choice considers that this information is being collected without sufficient notice to customers and that the information collected is “disproportionate” to the legitimate business functions of the retailers in question. One of the retailers in question, Good Guys, commented that facial recognition was used for security and theft prevention, and also for managing/improving customer experiences.

The OAIC initially responded to Choice’s referral, stating that it would consider the information provided, and noting that retailers need to balance business needs with legal compliance and community expectations and attitudes. In respect of consumer attitudes, we note that a 2020 study commissioned by the OAIC found that a majority of Australians are uncomfortable with their biometric information being collected in retail stores. The OAIC’s full statement is available here.

The OAIC has now opened investigations into both Bunnings’ and Kmart’s use of facial recognition technology (with the Good Guys pausing their use of the technology). Whilst the outcome of these investigations remains to be seen, it is clear that the existing framework in the Privacy Act regarding sensitive personal information applies to biometric information and should be applied carefully.