Australia clarifies when retailers can legally use facial recognition

See that dress in the shop window? It sees you. New guidance from the Office of the Australian Information Commissioner (OAIC) addresses the use of facial recognition in high volume, publicly accessible spaces like retail storefronts, adding another dimension to the debate over face biometrics in commercial spaces.

A release says the updates to guidance, which address Australian Privacy Principle (APP) entities considering using facial recognition, add clarity around exceptions to consent obligations in retail settings.

Collecting sensitive information, including biometrics, typically requires express consent. Specifically, in Australia, the collection of sensitive information must meet the requirements of the so-called consent pathway, which says collection must be “reasonably necessary” for one or more of the entity’s functions or activities – and that the individual must consent to the collection. Putting facial recognition technology in the sunglasses on a mannequin posing in the window of Harrods makes it practically impossible to obtain direct consent from every passerby.

The OAIC notes that “retailers will continue to need to make contextual assessments of the legality of using FRT. Accordingly, the guidance now includes a section acknowledging that “there may be practical difficulties with meeting the requirements of the consent pathway to use FRT in spaces typically open for members of the public to enter.”

“The nature of FRT means that it is not often practical to obtain valid consent from individuals whose biometric information might be captured. Entities which are not able to meet the requirements of the consent pathway, including because obtaining consent is unreasonable or impracticable, must not use FRT unless an exception applies.”

The possible routes to an exception deemed to be most relevant to the shopfront question are, one, the so-called authorized by law pathway, wherein “collection of information required or authorized by or under an Australian law or an order of an Australian court or tribunal,” and two, the permitted general situation pathway, “where a ‘permitted general situation’ applies.”

Bunnings decision continues to have ripple effect

The update comes in the wake of the controversy over biometric deployments by hardware and garden center chain Bunnings, which introduced FRT into 62 of its stores between 2018 and 2021. The OAIC says changes implement the findings of the Administrative Review Tribunal (ART) in the 2024 Bunnings case, which “confirmed that there is a high bar for using facial recognition technology in Australia.” One goal is to clarify that “each proposed deployment of FRT will need to be assessed against the requirements of the Act.”

“The Bunnings decision by the ART provided important clarification on certain aspects of the Privacy Act, and this updated guidance incorporates those points of clarification,” says Privacy Commissioner Carly Kind. “A precautionary approach to the deployment of FRT is required under Australian law. This is consistent with the expectations of the Australian community, a significant and growing proportion of whom think facial recognition technology is one of the biggest privacy risks they face today.”

Regardless, according to the Australian Retail Council, some 80 percent of Australian shoppers support the use of facial recognition to prevent violence and identify offenders.

Article Topics

Australia  |  biometrics  |  data protection  |  facial recognition  |  Office of the Information Commissioner (OAIC)  |  retail biometrics