Australia’s Privacy Commissioner Carly Kind found the company had collected personal and sensitive information from customers over a period of two years under the guise of trying to identify people committing refund fraud.
The technology was used at 28 of its stores around the country.
However, Kind found Kmart did not adequately inform shoppers of the technology being used or seek consent to use facial recognition technology to collect their personal information, which is in breach of the Privacy Act.
Kmart had argued that it was not required to obtain consent because of an exemption in the Privacy Act that applies when organisations reasonably believe that they need to collect personal information to tackle unlawful activity or serious misconduct.
Kind disagreed in the finding handed down today.
“The sensitive biometric information of every individual who entered a store was indiscriminately collected by the facial recognition technology system,” her finding read.
“There were other less privacy-intrusive methods available to Kmart to address refund fraud.”
Kind also found the fact the technology collected the data of thousands of customers not suspected of retail fraud meant the collection of information was “a disproportionate interference with privacy.”
“I do not consider that the respondent (Kmart) could have reasonably believed that the benefits of the facial recognition technology system in addressing refund fraud proportionately outweighed the impact on individuals’ privacy,” Kind added.
The finding ends a three-year investigation by the Privacy Commissioner, with the ruling stating Kmart had been cooperating with authorities.
Kmart said they were disappointed by the finding, arguing their trial of facial recognition technology was limited and used to quell theft and anti-social behaviour against staff in store.
The company also said it took measures to protect the privacy of customers.
“We implemented controls to protect the privacy of our customers. Images were only retained if they matched an image of a person of interest reasonably suspected or known to have engaged in refund fraud,” a Kmart spokesperson told 9News.
“All other images were deleted, and the data was never used for marketing or any other purposes.”
