Australian retailers show support for facial recognition in government consultation

Australia is convulsed as it seeks to strike a balance between competing concerns. Navigating the terrain of technological progress, privacy and citizens’ rights, security and crime, and between different commercial interests is a tricky feat. The ongoing regulatory framework being forged is of great interest to policymakers and stakeholders the world over in these burgeoning legal areas.

The Australian government is exploring areas of reform in supporting an outcomes-based approach to privacy, unlocking the benefits of consumer data, digital financial reporting and AI productivity potential. This is where facial recognition technology, under the AI umbrella, has featured in consultative submissions from interested parties as the government seeks feedback.

The Australian Retailers Association (ARA) and the National Retail Association (NRA) have welcomed the Australian government’s efforts to modernize AI governance and reform the Privacy Act, which include facial recognition technology.

However, the organizations, which are proposing to amalgamate into the Australian Retail Council (ARC), say that reforms must support both innovation and consumer protection. Many retailers are small to mid-sized businesses that rely on third-party AI solutions and lack the scale or technical control to meet overly prescriptive obligations.

If regulators fail to account for this reality, they risk placing disproportionate burdens on businesses that are end-users rather than developers of AI models, the associations say. Their response was in reply to the government’s call for feedback regarding Pillar 3: “Harnessing data and digital technology.”

In addition, they say uncertainty around consent, exemptions and procedural requirements in the Privacy Act has hindered the use of FRT in retail settings. They argue that by classifying biometric data as sensitive information, the Act offers no clear framework for the lawful collection and use of facial images, leaving retailers unable to follow the example of counterparts in the UK and New Zealand.

“The ARA and NRA strongly support the responsible adoption of FRT as part of a comprehensive strategy to reduce retail crime and improve staff and customer safety,” the joint statement said.

They argue that an outcomes-based approach to privacy regulation would better balance protection and innovation, calling on regulators to provide clear guidance and interpretation of new technologies rather than imposing strict mandates. This includes retail-specific issues including biometric technologies, data use and consent.

One of the ARA and NRA’s recommendations centers on SMEs. The associations believe that  small and medium-sized retailers should not shoulder the same regulatory load as large tech firms or AI developers. “Simplified compliance options, template tools, and targeted support must be made available, particularly for businesses that use third-party AI products without the ability to access or alter system design,” they said.

They point to how smaller retailers often lack in-house privacy or legal teams and depend on off-the-shelf AI tools. The proposed removal of the small business exemption, they warn, would saddle low-risk operators with significant compliance costs just as international regulators are simplifying requirements. Without clear expectations around consent, proportionality and oversight, they argue, these businesses face a chilling effect on innovation even in cases where public safety benefits are strong.

Australian hardware retailer Bunnings supported ARA and NRA’s submission to the consultation. The group is seeking a meeting with the government to discuss outcomes-based regulation and enabling ethical use of tools such as facial recognition, and the need for a nationally consistent privacy regime.

The Woolworths Group did not mention FRT and leaned heavily in support of AI and the AI industry more generally in its submission. One of Australia’s largest private sector employers, the group, like other retailers, referred to EU regulations that apply to specific applications of technology, rather than the technology itself. Both Woolworths’ and the ARA/NRA submissions mention the EU AI Act, with the latter pointing to the Act’s four-tier risk classification as a model for international best practice.

In Bunnings’ submission, it refers to the recent determination by the Office of the Australian Information Commissioner (OAIC) which found Bunnings Group breached Australian privacy laws by collecting face biometrics at store locations without the consent of those being recorded. Bunnings disputes the finding that it breached privacy laws and has lodged a challenge with the Administrative Review Tribunal.

“Privacy must be considered in the context of an employer’s strict liability and an occupier’s legal obligations to maintain a safe place of work and business,” it said in its submission.

Bunnings brought up the New Zealand Privacy Commissioner’s recent review of Foodstuffs North Island’s trial of FRT. The review acknowledged the privacy concerns, but found that with proper safeguards the risks become acceptable and that the system effectively reduced incidents of serious retail crime. The Commissioner concluded that, in this context, the use of FRT was lawful, proportionate and justified.

Previously, legal experts have observed how it is easier to deploy FRT in New Zealand compared to Australia due to differences in law. Campbell Featherston, a partner at law firm Dentons New Zealand, has said the absence of consent under Australian law means that it is “very difficult” for Bunnings to roll out FRT, while the need for consent doesn’t apply in New Zealand. Featherston said that it wouldn’t surprise him if the privacy law had to change in Australia, such as removing the need for consent to accommodate the use of FRT.

The difference is exemplified in growing use of FRT in New Zealand with Spark New Zealand the latest to initiate trials of FRT in its retail stores. Pointing to increases in “customer aggression” in its stores over the past few years, Rebecca Holdsworth, One NZ’s head of privacy and responsible AI, said use of FRT with “the right settings with the right controls” can provide positive safety benefits while not impeding the privacy of customers.

Spark is among a number of major New Zealand retailers that’ll implement biometric surveillance in their stores “to reduce harm and proactively combat retail crime.” However, use of such technology is a bigger concern among New Zealand’s indigenous population. A survey prepared for the Office of the Privacy Commissioner found that 57 percent of Māoris were concerned over potential bias shown by FRT, compared to 48 percent for all, with 49 percent of Maāoris concerned over its use in retail settings, versus 41 percent for all.

New Zealand’s upcoming biometrics rulebook has also faced criticism from the country’s indigenous groups.

As for Australia, the next phase of consultation will open after the interim reports are released in July and August, when the government will call for written submissions on its draft recommendations.

Article Topics

Australia  |  biometrics  |  facial recognition  |  New Zealand  |  Office of the Information Commissioner (OAIC)  |  retail biometrics