This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Australian retailers Bunnings, Kmart, and The Good Guys were found to be using facial recognition technology to capture and store biometric 'face prints' of customers without their knowledge or explicit consent. The practice was identified by consumer advocacy group CHOICE, leading to public outcry and an investigation by the Office of the Australian Information Commissioner (OAIC) into potential breaches of the Privacy Act. Following the investigation, The Good Guys paused their use of the technology, while privacy experts and consumer groups highlighted the invasive nature of the surveillance and the lack of clear regulatory frameworks.
Major Australian retailers reportedly analyzed in-store footage to capture facial features of their customers without consent, which was criticized by consumer groups as creepy and invasive.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The deployment of facial recognition across major retail chains was criticized by experts as creating a system of mass surveillance.
The incident primarily involves the unauthorized collection and storage of sensitive biometric 'faceprints' from customers without their explicit consent.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The privacy risks and unauthorized data collection were caused by the intentional decision of the retailers' management to deploy facial recognition technology in their stores.
Added categories peak at 2: Minor (Psychological Harm, Indirect)
Major Australian retailers deployed facial recognition technology to capture biometric data of customers without explicit consent. While raising significant privacy and mass surveillance concerns for millions of citizens, the incident remains a domestic regulatory issue with minor direct national security implications.
The facial recognition system automatically analyzes CCTV footage in real-time to detect, capture, and match customer faces against databases without direct human intervention for each scan.
High Risk: The system involves real-time biometric identification and facial recognition in public commercial spaces, which is classified as high risk due to its significant implications for fundamental rights and privacy.
The AI system was explicitly deployed to capture and analyze unique facial features to create biometric 'faceprints' for customer identification and store surveillance.
The reports provide clear, consistent details about the retailers involved, the nature of the technology deployed, the public reaction, and the regulatory investigations. The facts are well-documented by a reputable consumer advocacy group and major news outlets.
Retailers interpret the technology as a standard, non-invasive security tool for loss prevention, whereas consumer advocates and experts interpret it as invasive mass surveillance.
Technology
Biometric Faceprint Capture
Technology captures and stores unique biometric data from retail customers.
Potential Match Inaccuracy
Facial recognition technology is not perfectly accurate, risking errors.
Data Inputs
Overcollection of Sensitive Data
Retailers collect sensitive biometric faceprints from all entering customers.
Capture of Children's Biometrics
Systems capture highly personal facial data from infants and children.
Human Factors
Low Consumer Awareness
Over 75 percent of customers were unaware that FRT was active in stores.
Unread Privacy Policies
Customers do not search for or read online privacy policies before shopping.
Process and Methods
Inconspicuous Store Signage
Entrance signs informing customers of FRT were small and easily missed.
Inadequate Disclosure Processes
Relying on hard-to-find online policies rather than active notification.
Management
Prioritizing Security Over Privacy
Retailers prioritized loss prevention over customer privacy and consent.
Creeping Use Without Discussion
Deploying invasive surveillance without widespread public consultation.
Regulatory Environment
Lack of Clear FRT Regulations
No clear regulations or guidelines exist on the appropriate use of FRT.
Weak Biometric Consent Laws
Current laws do not sufficiently protect consumers from invasive data capture.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
