Retail giant Kmart has been found to have breached privacy laws by employing facial recognition technology (FRT) on its customers, according to a determination by the privacy commissioner. The investigation revealed that over a two-year period ending in July 2022, Kmart collected facial data from “tens or hundreds of thousands” of customers at store entrances and return counters as part of an initiative to combat refund fraud.
Facial recognition technology operates by mapping an individual’s unique facial features and comparing them against a database of stored images. While major retailers and public venues argue that FRT can be instrumental in identifying repeat offenders and preventing crime, privacy commissioner Carly Kind concluded that Kmart’s application of the technology was excessive and lacked customer consent.
“The sensitive information of every customer who entered a relevant store was indiscriminately collected by the FRT system,” Ms. Kind stated.
How Kmart Implemented Facial Recognition Technology
Kmart’s “pilot program” commenced in mid-2020 and expanded to 28 stores across all Australian states and territories, excluding the Northern Territory and Tasmania. The system cross-referenced customer facial data with a database of individuals known or suspected to have engaged in refund fraud.
In its defense, Kmart claimed that it was not required to obtain consent due to an exemption in the Privacy Act, which allows the collection of personal information when an organization reasonably believes it is necessary to prevent unlawful activity. However, Ms. Kind refuted this argument, asserting that Kmart could have adopted more effective and proportionate security measures than FRT, which she described as only “partially suitable” for fraud prevention.
“[It was] also minimal with respect to [Kmart’s] annual revenue, which was $9.2 billion in the 2020 financial year,” Ms. Kind noted.
Measured against the impact on customers, Ms. Kind described Kmart’s indiscriminate collection of biometric data as “disproportionate.” She highlighted the potential harms associated with FRT, including the risks of commercial surveillance, discrimination, and unlawful or arbitrary arrest.
As a result of the findings, Kmart has been ordered to cease the practice and is required to publish a statement on its website within 30 days, detailing its use of FRT and the regulator’s decision against it.
Facial Recognition Technology in Australian Retail
This ruling marks the second time in less than a year that the privacy commissioner has reached a similar conclusion regarding an Australian retailer’s use of FRT. In October 2024, the commissioner found that Bunnings had also violated the Privacy Act with its deployment of FRT in 62 stores, although the circumstances differed from Kmart’s case. The decision regarding Bunnings is currently under review by the Administrative Review Tribunal.
“These two decisions do not impose a ban on the use of FRT,” Ms. Kind clarified. “Customer and staff safety, and fraud prevention and detection, are legitimate reasons businesses might have regard to when considering the deployment of new technologies. However, these reasons are not, in and of themselves, a free pass to avoid compliance with the Privacy Act.”
The privacy commissioner acknowledged that Kmart halted its use of FRT when the investigation commenced in July 2022 and had cooperated throughout the process.
Kmart’s Response and Potential Appeal
Kmart expressed disappointment with the privacy commissioner’s determination and is currently evaluating its options for appeal. A company spokesperson highlighted the challenges faced by retailers, noting the increasing incidents of theft and associated anti-social behavior or violence against staff and customers.
“Images were only retained if they matched an image of a person of interest reasonably suspected or known to have engaged in refund fraud,” the spokesperson explained. “All other images were deleted, and the data was never used for marketing or any other purposes.”
Kmart remains committed to exploring tools to reduce crime in its stores, aiming to ensure the safety of both team members and customers.
