TRANSCRIPT
Every day, hundreds of customers across Australia visit Kmart, known for its affordable household products.
But some may have had their faces recorded by the retailer without their knowledge, according to the findings by the national privacy regulator.
The Office of the Australian Information Commissioner found that between June 2020 and July 2022, Kmart had used facial recognition technology at the entrances and returns counters of 28 of its retail stores.
Facial Recognition Technology is a form of biometric technology.
It captures a digital image of a person's face and converts it into a biometrical template.
Kmart says it was using technology to address refund fraud, arguing that it doesn't need to obtain the consent of customers because it believes the exemption of addressing unlawful activity or serious misconduct applies, under the Privacy Act.
In a statement, Privacy Commissioner Carly Kind says the assessment she makes is complex.
"Understanding how FRT (Facial Recognition Technology) accords with the protections contained in Privacy Act requires me to balance the interests of individuals in having their privacy protected, on the one hand, and the interests of entities in carrying out their functions or activities, on the other. Relevant to a technology like facial recognition, is also the public interest in protecting privacy."
Professor Edward Santow is the director of policy and governance at the Human Technology institute at the University of Technology Sydney.
He says the privacy commissioner's findings have significant implications.
"This is a landmark determination. The privacy commissioner accepted retailers like Kmart can take robust action to prevent fraud and theft in their stores, but they have to do so in a way to respect people's basic rights to privacy."
Kmart claims from August 2024 to March 2025 alone, refund-related customer threatening incidents increased by 85 per cent.
But Professor Santow says the privacy commissioner's finding shows Kmart should prioritise other approach to stop fraud, before adopting facial recognition technology.
"There are real concerns with using facial recognition to prevent people from engaging in shoplifting and fraud, and I think what this determination shows is that before jumping to use that technology - there are whole bunch of other things that companies can do to address the legitimate concern about fraud and theft in stores. And they do those things first, because they don't necessarily have the same level of impact on people's right to privacy."
Kmart is the second retailer that the privacy commissioner has found illegally used facial recognition technology in its stores.
Last year, Bunnings was found to have breached privacy laws by using facial recognition technology in 63 stores in Victoria and New South Wales over three years until 2021.
The determination is now under review by the Administrative Review Tribunal.
Ms Kind also says even though they reached similar conclusions between Kmart and Bunnings, the two decisions don't impose a ban on the use of facial recognition technology.
She says while it's reasonable for businesses to deploy new technology to protect their workers' safety, they still have to comply with privacy law.
Lizzie O'Shea is the founder of Digital Right Watch.
She notes that facial recognition technology is one of the least favoured measures by the general public.
"Most Australian do not like this technology, the vast majority of Australians are of the view that they shouldn't have handed over their sensitive personal information in order to access retail services."
Kmart says the privacy commissioner's decision is disappointing, and it's reviewing appeal options.
Ms O'Shea says it's also time for the government to update the Privacy Act.
"Our Privacy Act is well overdue for reform. It doesn't speak specifically about this kind of technology. And there's an argument that it could be updated to better regulate the use of facial recognition technology. I think that would be a sensible move and in the interim, we probably need to have retail industry stop using it, until there's a clear guidance in law that says you can."
