Bunnings eyes push for legislative changes after breaching privacy rules with facial recognition technology

Bunnings has not ruled out campaigning for legislative changes to allow retailers to use facial recognition technology to fight rising theft and violence in Australian stores. The hardware giant on Monday suggested on Tuesday that wrongdoers were being protected over staff and customers after the national Privacy Commissioner found the group breached privacy rules by trialling facial recognition at some of its stores. Managing director Mike Schneider said the technology, which used CCTV to check everyone entering the stores against a database of banned customers, should be an important tool in combating the rising incidence of theft and violent and aggressive behaviour across the retail sector. “Almost every day somewhere in my network I’m getting an incidence report about a team member or a customer who’s been attacked or abused,” he said, noting that reports of abuse, threats and assaults in Bunnings stores increased 50 per cent last year alone. “And when you’re employing the team we have with an age profile from school kids to senior citizens, it’s a really confronting and sad reality.” However, Privacy Commissioner Carly Kind found that while Bunnings’ concerns were understandable, “deploying facial recognition technology was the most intrusive option, disproportionately interfering with the privacy of everyone who entered its stores, not just high-risk individuals”. She also pointed “governance shortcomings” at the hardware giant, finding Bunnings “failed to take reasonable steps to implement practices, procedures and systems required to comply with the Privacy Act”.. Commissioner Kind said Bunnings collected individuals’ sensitive information without consent, failed to take reasonable steps to notify individuals that their personal information was being collected, and did not include required information in its privacy policy. Bunnings has admitted that when it started using the facial recognition technology, customers were not told. It was only when the trial was underway that changes were made to its “conditions of entry” signs at each store and its privacy policy amended to inform customers. However, the data was never used for marketing purposes or to track customer behaviour, and unless matched to someone in the banned database, was always deleted within four milliseconds. It defended its risk governance, saying that prior to the commencement of the trial, it undertook “detailed technical, commercial and legal reviews of issues relating to the use of the FRT, in particular assessing issues relating to privacy and data security”. “Bunnings is confident that our internal policies, training and processes that we had in place to govern our use of FRT adequately addressed our privacy and data security obligations.” The group, owned by WA conglomerate Wesfarmers and with nearly 300 stores turning over a combined $19 billion a year, said it would seek a review of the decision with the Australian Review Tribunal. Mr Schneider said the trial of the technology at 68 stores in Victoria and New South Wales between November 2018 and November 2021 was aimed at identifying “a small number of known and repeat offenders”. He insisted customers’ privacy was not compromised. “We had hoped that based on our submissions, the Commissioner would accept our position that the use of FRT appropriately balanced our privacy obligations and the need to protect our team, customers, and suppliers against the ongoing and increasing exposure to violent and organised crime, perpetrated by a small number of known and repeat offenders,” Mr Schneider said. The trial “was never about convenience or saving money but was all about safeguarding our business and protecting our team, customers, and suppliers from violent, aggressive behaviour, criminal conduct and preventing them from being physically or mentally harmed by these individuals”. “We know that some 70 per cent of incidents are caused by the same group of people. “While we can physically ban them from our stores, with thousands of daily visitors, it is virtually impossible to enforce these bans. “FRT provided the fastest and most accurate way of identifying these individuals and quickly removing them from our stores.” Commissioner Kind acknowledged the potential for facial recognition technology to help protect against serious issues, but “any possible benefits need to be weighed against the impact on privacy rights, as well as our collective values as a society”. “Facial recognition technology may have been an efficient and cost effective option available to Bunnings at the time in its well-intentioned efforts to address unlawful activity,” she said. “However, just because a technology may be helpful or convenient, does not mean its use is justifiable. “Individuals who entered the relevant Bunnings stores at the time would not have been aware that facial recognition technology was in use and especially that their sensitive information was being collected, even if briefly.” The use of FRT by Bunnings had not been a secret, with the Privacy Commissioner launching its probe in 2022 after concerns were raised by consumer advocacy group CHOICE.