In-Store Surveillance, Biometric Analysis And Privacy Rights

• Published date: 31 December 2021
• Subject Matter: Privacy, Data Protection, Privacy Protection
• Law Firm: Davies Collison Cave
• Author: Mr Gordon Hughes

Key points

In-store notices stating that patrons are "under surveillance" may be insufficient to comply with the store's privacy obligations, particularly if biometric analysis of facial images is involved.

The collection of biometric information requires customer consent and must be "reasonably necessary" for the store's functions or activities.

A general notification that patrons are "under surveillance" may not provide adequate notice, or elicit effective consent, for the purposes of the Privacy Act 1988.

The existence of a privacy policy will not necessarily satisfy the notification requirements set out in Australian Privacy Principle 5.

With the increasing use of biometric analysis in connection with the monitoring of customer behaviour, businesses should give careful consideration to their in-store "surveillance" signs.

The issue

It is commonplace for stores to install CCTV for security reasons, and to utilise image-capturing devices for a range of other purposes.

Businesses need to ensure that in monitoring individuals in this manner, they comply with applicable Australian data protection laws.

Commonly, stores will post a notice in a public area, alerting patrons that the premises are under surveillance. Properly displayed, these notices may be effective from a privacy perspective if the function of CCTV surveillance is merely to provide real-time security observation of individuals' movements within the store in order, for example, to guard against shoplifting.

Much depends, however, on how the captured images are used. When biometric analysis is involved, for example, some in-store surveillance notices may prove to be inadequate.

Biometric identification, in this context, involves the capturing of physical characteristics, such as facial features, and then matching that data against other stored information in order to identify a known individual, or to ascertain whether images of two unnamed individuals in fact involve the same person.

Surveillance of this nature raises a number of issues under the Privacy Act 1988:

• Is the collection of "personal information" involved If so, and assuming the business has an annual turnover of $3m or more, the information must be handled in accordance with the Australian Privacy Principles.
• If "personal information" is involved, does that information also fall into the category of "sensitive information"? If so, then the consent of the individual is required as a condition of collection. Furthermore, the collection of that information must be "reasonably necessary" for one or more of the store's functions or activities.
• If the collection of personal information (including sensitive information) is involved, does the method of collection comply with Australian Privacy Principle (APP) 3, and has the individual been provided with adequate notice as to the purpose of collection and associated matters prescribed by APP 5?

There is no question that CCTV security footage which identifies an individual entering a store will constitute the "collection" of personal information for the purposes of APP 3.¹ CCTV is not, however, the only means by which facial images may be captured, nor are facial images necessarily collected only for security purposes. Captured images may be used for specific individual identification through the generation of encrypted algorithmic representations of the customers' faces, or "faceprints".

Such were the issues considered in a matter recently before the Privacy Commissioner, 7-Eleven Stores Pty Ltd [2021] AICmr 50. The Commissioner was required to determine whether the store had interfered with customers' privacy through the use of a facial recognition tool in connection with a customer survey and feedback mechanism. The technology, incorporated within a tablet, was deployed over a 2-month...