What happened

Kmart used facial recognition across 28 stores across Australia to combat refund fraud. Operating between June 2020 and July 2022, the system captured facial images of every person entering the stores and anyone approaching returns counters, creating biometric templates that were compared against a database of individuals suspected of fraudulent returns. 

While images that did not match suspected fraudsters were automatically deleted, the system indiscriminately collected sensitive biometric information from potentially hundreds of thousands of innocent customers without their knowledge or consent.

The Office of the Australian Information Commissioner (OAIC) determined that Kmart breached multiple provisions of the country's Privacy Act 1988, including failing to obtain consent for collecting sensitive information, inadequate notification to customers, and maintaining insufficient privacy policies. 

The Commissioner found that the privacy invasion was disproportionate to the limited benefits achieved, as the fraud detected was minimal compared to Kmart's overall operations and revenue. 

Why it happened

Kmart implemented the facial recognition system as part of its strategy to address rising retail theft and refund fraud, which the company argued was necessary to protect staff and customers from increasingly violent incidents. 

The retailer attempted to justify the collection under an exemption in the Privacy Act that allows organisations to collect personal information without consent when addressing unlawful activity or serious misconduct. 

However, the Privacy Commissioner rejected this defence, finding that Kmart could not reasonably believe the facial recognition system was necessary because less privacy-intrusive alternatives were available, such as enhanced staff training for document checks or relocating returns counters.

The Commissioner emphasised that the collection lacked proportionality and transparency, fundamental requirements under Australian privacy law.

The decision requires Kmart to publish an apology and detailed statement on its website, retain all facial recognition data for 12 months for compliance purposes before destruction, and permanently cease using the system in its previous form.