Facial Recognition In Retail: Privacy Lessons From The Kmart Decision

The Privacy Commissioner has handed down her decision following an investigation into Kmart's use of facial recognition technology (FRT), finding that the retailer collected sensitive biometric data from store visitors without adequate consent. The decision follows an earlier investigation into Bunnings, also part of the Wesfarmers stable, concerning its use of FRT.

Between June 2020 and July 2022, Kmart trialled FRT in 28 stores in an attempt to identify those committing refund fraud. The Commissioner found that:

• Kmart did not have adequate consent from visitors to collect their personal and sensitive information, including biometric facial images
• without the required consent, no applicable exception to the collection and use of the information applied under the Privacy Act