Kmart breaches privacy laws with facial recognition cameras in Australia
Australia's Privacy Commissioner found that Kmart breached privacy laws by using facial recognition cameras in 28 stores from mid-2020 to mid-2022 to detect refund fraud, capturing facial data from hundreds of thousands of customers without consent. The regulator determined that less intrusive methods existed and that the indiscriminate collection of biometric data from all customers was a disproportionate interference with privacy rights.
What happened
Kmart deployed facial recognition technology cameras at entrances and return counters in 28 Australian stores from mid-2020 to mid-2022 to detect refund fraud. The system captured facial data of hundreds of thousands of customers without their knowledge.
Reported impact
The facial recognition technology indiscriminately collected sensitive biometric data from every person entering a store, including those not suspected of refund fraud. Privacy Commissioner Carly Kind found that the technology's impact on the privacy of many thousands of individuals outweighed Kmart's fraud prevention objectives.
Index analysis
Privacy Commissioner Kind noted that less privacy-intrusive methods were available to address refund fraud and that deploying facial recognition technology to prevent fraud was of limited utility. The database would cross-check facial data with records of known or suspected refund fraudsters.
Governance controls
Kmart attempted to argue the cameras were legal under a Privacy Act exemption that permits collection of personal information to address unlawful activity or serious misconduct. Commissioner Kind rejected this argument, finding that people's right to privacy outweighed Kmart's arguments. Kmart has been ordered not to reinstate the technology and must publish a statement on its website within 30 days explaining its use and the regulator's findings.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.