Written by: Haim Ravia, Dotan Hammer
The Australian Information Commissioner (AIC), Carly Kind, found that Kmart Australia Limited interfered with individuals’ privacy by using a Facial Recognition Technology (FRT) system in 28 retail stores between June 2020 and July 2022 to detect and prevent store refund fraud.
The Commissioner substantiated multiple breaches of the Australian Privacy Act 1988:
- Kmart collected the sensitive information of all individuals entering the relevant stores without consent. This sensitive information included facial images and generated metadata/biometric information used for automated verification/identification. Kmart attempted to rely on a ‘permitted general situation’ exception, arguing the collection was necessary to take appropriate action against unlawful activity (refund fraud). However, the Commissioner ruled the collection was not necessary because the use of FRT was not proportional. The privacy impact on potentially “tens or even hundreds of thousands of individuals” whose sensitive information was indiscriminately collected outweighed the limited benefits—the amount of fraud prevented was small compared to the estimated value of unlawful activity and Kmart’s massive revenue.
- Kmart failed to take reasonable steps to notify individuals about the collection of their sensitive information, the purpose (detecting refund fraud), and the consequences (e.g., being denied a refund). Store signage and privacy policies were found to be inadequate or implemented too late.
- Kmart failed to maintain a clearly expressed and up-to-date privacy policy that specified the kinds of personal information collected (metadata and biometric information) and how it was collected via the FRT system.
As remedies, the Australian privacy commissioner declared that Kmart must not repeat or continue the infringing acts. Kmart was ordered to publish an apology and a detailed statement about its FRT use on its website and in stores for at least 30 days. Kmart must also retain all remaining FRT data for 12 months for compliance before destroying it.
Click here to read the Australian Privacy Commissioner’s decision against Kmart Australia Limited.
