Kmart facial recognition cameras break privacy laws, watchdog finds

Kmart has broken privacy laws by using facial recognition cameras on customers, the Privacy Commissioner has found.

The retail giant used the cameras for two years until mid-2022, capturing the facial data of hundreds of thousands of people.

The cameras were placed at entrances and return counters in 28 stores across the country to detect refund fraud.

In a decision released Thursday, Privacy Commissioner Carly Kind said Kmart tried to argue the cameras were legal because of an exemption in the Privacy Act, which applies when organisations reasonably believe that they need to collect personal information to tackle unlawful activity or serious misconduct.

Ms Kind said people’s right to privacy outweighed Kmart’s arguments.

Kmart’s facial recognition technology cameras “indiscriminately” collected sensitive biometric data of every person who entered a store, the Commissioner said.

“There were other less privacy intrusive methods available to Kmart to address refund fraud,” she said.

“Deploying the (facial recognition technology) system to prevent fraud was of limited utility.

“Considering that the FRT system impacted on the privacy of many thousands of individuals not suspected of refund fraud, the collection of biometric information on Kmart customers was a disproportionate interference with privacy.”

Kmart owner Wesfarmers has been approached for comment.

The surveillance scheme began in mid-2020, and ran in 28 stores across the country except in Tasmania and the Northern Territory.

The database would crosscheck facial data with a database of known or suspected refund fraudsters.

Kmart has been ordered not to reinstate the technology, and will have to publish a statement on its website within 30 days explaining its use of the technology and the regulator’s finding against it.

More to come