The recent appeal decision by the Administrative Review Tribunal was to allow Bunnings to continue use of facial recognition technology (FRT). However, the Tribunal based the decision on a unique reason for the use of FRT, which fell within a statutory exception.
Those factors were:
1. store layout ie a vehicle can be driven into many Bunnings stores
2. the type of goods sold could be used as weapons in-store ie a drill or a screw driver
3. the retailer established a serious problem with violence and theft being committed by repeat offenders.
However, the decision will not usually be applicable to most retail businesses and is therefore, not a green light for retailers to use FRT.
The other parts of the Privacy Commissioner’s ruling were upheld.
The Tribunal agreed with the Commissioner that Bunnings breached APP 5.1 and APP 1.3 by failing to take reasonable steps to notify individuals whose sensitive information was collected in its Privacy Collection notice and Privacy Policy.
The use of FRT involves the collection of sensitive information and the Tribunal also observed that “represents a serious intrusion of privacy”. In those circumstances, they noted Bunnings should have conducted a formal, structured and documented privacy risk assessment of the FRT system, which they did not conduct.
We don’t know anyone who wants to see retail workers harmed at work by criminal behaviour.
There’s also a mountain of research showing Australians do not want their data collected without their knowledge or consent and that they want organisations to do more to protect the data held.
So, the need for privacy and security can create complex tensions. However, the Tribunal’s reasons for decision set a high bar for the use of FRT.
Should you need to review your privacy governance and ensure compliance, please let us know; we regularly develop and update privacy policies and privacy impact assessments for our clients.