As you go about your Christmas shopping, it may not surprise you to hear that you’re tracked and monitored in many different ways.
There are the loyalty programmes that build a record of your spending. There are the security cameras that watch you as you move through a store. There’s the online technology that monitors the websites you visit and the things you search for. And then there’s the curious family members trying to figure out what you’ve bought them for Christmas. (Or haven’t bought them). Some of those are more acceptable than others. But there’s piece of tracking technology that the Privacy Commissioner has decided isn’t so acceptable is facial recognition technology (FRT).
FRT is a type of software designed to identify individuals based on their unique facial features. It uses algorithms to analyse and compare an image of a person’s face with a database of existing facial information.
If you’re reading this on a smartphone or laptop, you might have benefited from it just the past few minutes. Many phones and computers now use cameras to recognise their owner and unlock themselves accordingly.
But there are more worrying uses of the technology, and concern about its potential for abuse. Unlike your smartphone, facial recognition databases are often built without people’s knowledge or consent. For example, security cameras collecting information in public at a distance.
Also, the technology is far from perfect. The algorithms are not totally accurate, and appear to struggle to identify people with certain skin tones correctly.
Hence the Privacy Commissioner’s concerns that New Zealand’s existing privacy protections aren’t enough to cover FRT and other forms of biometric data. Following a 2021 position paper and an August 2022 consultation paper which received 100 public submissions, the Commissioner announced last Thursday that a Code of Practice to regulate biometrics is being explored. The next step is targeted engagement with relevant agencies and people in the new year about what might be in such a Code.
FRT surveillance already a reality in New Zealand
While the discussion of a Code of Practice is new in this country, FRT itself is already in use by private businesses. Foodstuffs North Island (New World, Pak ‘n Save, Four Square) revealed in 2018 that it was using it in some North Island stores to battle shoplifting, and in 2020, Stuff reported its use in casinos and The Warehouse.
But it’s Foodstuffs use of the technology that has drawn concern from the Office of the Privacy Commissioner and Consumer NZ. Consumer NZ last month confirmed 29 North Island Foodstuffs stores still use the technology as a crime prevention measure.
“We are seriously concerned that New Zealanders are having their sensitive biometric information collected and analysed while they go about their shopping,” said Consumer NZ chief executive Jon Duffy. “These shoppers may not know it is happening or understand the potential consequences of their data being collected in this way.
“We question whether the collection of customers’ biometric data is proportionate to the risk Foodstuffs is trying to address.
“The use of FRT raises significant privacy and ethical concerns. Aside from our sensitive personal information being captured without our knowledge, we also need to consider how our biometric data is stored once it is collected by a retailer.
“No one is immune from cybercrime and retailers must ensure their security is up to scratch to protect consumers from identity theft.”
Foodstuffs says that the technology is a trial to help keep its staff and customers safe and was working with the Office of the Privacy Commissioner (OPC) on its appropriate use. That included clear signposts at the doors of any supermarkets using the technology, and restricting its use to crime prevention.
The OPC said it recognised the importance of safety but added “it is not clear to our office how facial recognition technology is going to achieve this.”
“As a result, we have been counselling caution given the privacy intrusive nature of facial recognition technology and the inaccuracy and profiling risks involved.
“Any store using facial recognition technology must clearly inform customers about its use. Customers who are concerned about what these stores may hold on them should ask for access to this information. Customers who are concerned that their privacy has been breached or that their request for their information has been inappropriately denied should make a complaint to our office,” it said.
The OPC has asked Foodstuffs to provide details of the 29 stores using the technology, so it could confirm whether the use was consistent with the Privacy Act.
So, while it’s unlikely South Island supermarket shoppers or most businesses need to think about FRT just yet, it’s likely we’ll hear more and more about it in the coming months and years. And even if you’re not dealing in FRT, it’s a good reminder to take care with the information you collect as a business, and the information you give as a consumer. Feel free to run any of those privacy issues by our team in the new year. |
