Camera test

Bunnings, Kmart in a test case for biometrics

The technology used by retailers compares photos of people entering the store with a database of shoppers the retailer considers problematic and removes photos of the vast majority that are not.

Express consent

At the heart of the matter is consent and how explicit and active it should be. In a previous decision involving 7-Eleven, Privacy Commissioner Angelene Falk found that the convenience store chain did not obtain implied or expressed consent. This is despite a notice in stores stating that the retailer was using CCTV and upon entering the store someone “has consented to facial recognition cameras capturing and storing your image”.

This is a precedent because notification is not necessarily consent. Consent is a mainstay of today’s privacy regime, despite a broad consensus that few people actually read privacy policies, let alone understand them.

It is also relevant whether the use of the invasive technology is proportionate to the claimed aim. In the case of 7-Eleven, biometric data was used to ensure there were no duplicates of people completing a survey in-store and to compile a demographic profile of survey respondents.

Falk had no trouble finding this an insufficient objective. But the current case against major retailers will force him to question whether preventing theft is a sufficient goal.

She takes on two of the biggest retail groups in the country – Wesfarmers and the JB Hi-Fi group – who will no doubt come armed with lawyers at 10 paces.

More broadly, the case once again highlights how outdated and inscrutable Australia’s digital regulations are. There are five different legislative regimes, and each state has its own, but different, rules regarding the use of CCTV.

In 2020, former ASIO and Defense Chief Dennis Richardson, in a 1,300-word report, found current laws to be complex, inconsistent, outdated and inflexible.

But Home Affairs’ attempt to shore up the surveillance regime failed when its proposed new regime was rejected out of hand by the bipartisan Joint House Committee on Intelligence and Security.

Home Affairs was looking to create a nationwide license photo database, so police could easily check if a suspect had previous convictions in other states. Where the new minister, Clare O’Neil, takes this reform bill is being watched closely.

As the case against the big retailers suggests, the privacy implications of new technologies need to be considered thoughtfully, comprehensively and well-debated.

There have been more than 100 one-off amendments to the phone interception regime, a classic case where failure to fundamentally update legislation leads to heartache down the road as authorities play mole on bad actors.