Privacy regulator receives complaints about Bunnings, Kmart, Good Guys use of facial technology without consent

With Australia’s biggest retailers taking a reputational hit for using facial recognition technology, could there be a lesson for marketers?

Privacy regulation is hitting the headlines - and brand reputations -of Australia’s largest retailers, following consumer group CHOICE’s investigation into The Good Guys, Kmart and Bunnings using facial recognition technology in stores.

The three large retailers have been using facial recognition technology without express consent from customers, prompting CHOICE to report the brands to Australia’s OAIC (Office of the Australian Information Commissioner).

Data collection must meet community expectations

OAIC information commissioner Angelene Falk has already made two rulings that Clearview AI and convenience chain 7-Eleven breached customer privacy using facial recognition technology.

Falk has said businesses who breach community expectations around privacy will be the focus of the OAIC’s targeted work.

“Biometric information is unique to an individual and cannot normally be changed,” Commissioner Falk said.

“Entities must carefully consider whether they need to collect this sensitive personal information, and whether the privacy impacts are proportional to achieving the entity’s legitimate functions or activities.“

"While I accept that implementing systems to understand and improve customers’ experience is a legitimate function for 7-Eleven’s business, any benefits to the business in collecting this biometric information were not proportional to the impact on privacy.”

At the launch of Deloitte’s new 2022 Privacy Index, Falk explained that nearly 9 out of 10 Australians want more control and choice over the use of their personal information.

“Australians saw the biggest risks for privacy as identity and fraud, data security and breaches,” she says.

“Our research tells us only half of Australians feel most organisations they deal with are in fact transparent about the way they use their personal information.”

3 new consumer research pieces marketers should understand

Research and consumer surveys help keep marketers abreast of fast-changing attitudes, which can make or break brand trust in the future.

The GDMA –of which ADMA is Australia’s representative – researched global attitudes to privacy and released its findings in January 2022, concluding:

• There has been 5% lift in the segment of people they call “unconcerned” with attitudes to privacy, rising from 26% in 2017 to 31% in 2021. This is mostly younger age demographics, and the older people are, the more concerned they are with privacy and security of personal information

• More than half of Australians agree or strongly agree that the exchange of personal information is essential for the smooth running of modern society, with a rise in people agreeing it is an ‘actionable asset’ to negotiate better prices and offers with companies

• More than 75% of Australians expect companies to keep improving levels of personalisation without them having to give up more personal information.

Read the full story on the GDMA research at this link.

Deloitte Australia’s Privacy Index 2022 research has run for 8 years, and reveals more than half of Australia’s top 100 brands cross “the creepy line”, failing to offer incentives to their customers to create an account with them.

The Deloitte research - which included a customer survey, analysis of brands’ privacy policies and reports to the OAIC - also found:

• 43% of consumers say they are only happy to share personal information when they are aware of how their information will be used

• Brands that collect data should be increasing transparency with their customers, while also setting privacy as the default and allowing people to ‘opt in’ to share personal information

• Deloitte is also encouraging brands to communicate privacy protections more clearly and empower consumers to optimise their preference centres to allow easy personalisation of services.

Deloitte Italy’s risk advisory partner Tommaso Stranieri spoke at the release of the 2022 Privacy Index and warned marketers that:

“Digital marketing activity must always assume the awareness and will of individuals to be the target of such activities otherwise it may be illegal with significant risk to companies,” he says.

Takeaways for marketers

CHOICE consumer data advocate Kate Bower says marketers need to have a customer-first view of the data they collect.

“That means data should not be understood simply as a resource for the business but as belonging to the customer, or data subject,” she says.

With bigger fines for brands found in breach-as well as the review of Australia’s Privacy Act and development of a new online privacy code expected to be coming soon -it’s a critical time for data-led marketers to think about regulatory needs across their business, not merely what’s happening in the marketing department.

The new Federal Attorney-General Mark Dreyfus told the Australian Financial Review he is committed to enacting privacy changes that he first proposed back in 2013 which generally align data laws with Europe and parts of the United States.

Legal data policy expert, and chair of ADMA’s Regulatory Working Group, Peter Leonard told the AFR Australia needs privacy regulation based on a legal right to privacy rather than merely improving transparency. Even the best marketers and brands need to be wary of how privacy, consent and regulation impacts their brand, even when the data collection is in the name of preventing theft -as the large retailers are saying – rather than for strictly marketing needs.

Update

12 July 2022

The Office of the Australian Information Commissioner (OAIC) has opened investigations into the personal information handling practices of Bunnings Group Limited and Kmart Australia Limited, focusing on the companies’ use of facial recognition technology.