Posted on Leave a comment

Australia’s privacy watchdog has launched an investigation into two retail giants over their use of facial recognition technology.

Hardware firm Bunnings and department store Kmart collect customers’ “faceprints” in some locations.

Consumer advocacy group Choice says the technology is unethical, invasive and being used without proper consent or reasoning.

Both retailers defended its use as an anti-theft and safety measure.

The Australian Information Commissioner said her office had opened an investigation to determine whether they had breached privacy laws.

Australian retailers can only collect sensitive biometric information if “reasonably necessary” for their operations and they have “clear consent”, Angelene Falk said.

“While deterring theft and creating a safe environment are important goals, using high privacy impact technologies in stores carries significant privacy risks,” Commissioner Falk said last month, after the use of the technology was first revealed.

“Retailers need to be able to demonstrate that it is a proportionate response.”

Last year, she found convenience store chain 7-Eleven had interfered with customers’ privacy by collecting faceprints in a similar case.

The watchdog said it was also “conducting inquiries” about another retail company, The Good Guys, which has paused its use of facial recognition technology.

The Australian Human Rights Commission has called for a ban on the technology until Australia has specific laws to regulate its use. It followed police in Western Australia using it for Covid isolation checks.

■ The nation where your ‘faceprint’ is already being tracked

■ Facebook to end use of facial recognition software

Choice said Bunnings and Kmart were only disclosing their use of the technology in small “conditions of entry” notices at the front of stores, and in privacy policies online.

The consumer group surveyed more than 1,000 households and found more than 75% had no idea the technology was in use.

“Using facial recognition technology in this way is similar to Kmart, Bunnings or The Good Guys collecting your fingerprints or DNA every time you shop,” said Choice’s Kate Bower.

Bunnings said its use of the technology had been inaccurately characterised and there were strict controls around its use.

The data collected is not used for marketing purposes, it says, and the only images retained are of people banned from stores or those suspected of illegal or threatening conduct.

“In recent years, we’ve seen an increase in the number of challenging interactions our team have had to handle in our stores and this technology is an important tool in helping us to prevent repeat abuse and threatening behaviour towards our team and customers,” said chief operating officer Simon McDowell.

A spokesperson for Kmart also said the technology was on “trial” to prevent theft and was subject to strict controls.

Posted on Leave a comment

Singapore will be the first country in the world to use facial verification in its national identity scheme.

The biometric check will give Singaporeans secure access to both private and government services.
The government’s technology agency says it will be “fundamental” to the country’s digital economy.
It has been trialled with a bank and is now being rolled out nationwide. It not only identifies a person but ensures they are genuinely present.
“You have to make sure that the person is genuinely present when they authenticate, that you’re not looking at a photograph or a video or a replayed recording or a deepfake,” said Andrew Bud, founder and chief executive of iProov, the UK company that is providing the technology.

The technology will be integrated with the country’s digital identity scheme SingPass and allows access to government services.
“This is the first time that cloud-based face verification has been used to secure the identity of people who are using a national digital identity scheme,” said Mr Bud.
Verification or recognition?
Both facial recognition and facial verification depend on scanning a subject’s face, and matching it with an image in an existing database to establish their identity.
The key difference is that verification requires the explicit consent of the user, and the user gets something in return, such as access to their phone or their bank’s smartphone app.

Facial recognition technology, by contrast, might scan the face of everyone in a train station, and alert the authorities if a wanted criminal walks past a camera.
“Face recognition has all sorts of social implications. Face verification is extremely benign,” said Mr Bud.
Privacy advocates, however, contend that consent is a low threshold when dealing with sensitive biometric data.
“Consent does not work when there is an imbalance of power between controllers and data subjects, such as the one observed in citizen-state relationships,” said Ioannis Kouvakas, legal officer with London-based Privacy International.
Business or government?
In the US and China, tech companies have jumped on the facial verification bandwagon.
For example, a range of banking apps support Apple Face ID or Google’s Face Unlock for verification, and China’s Alibaba has a Smile to Pay app.
Many governments are already using facial verification too, but few have considered attaching the technology to a national ID.
In some cases that’s because they don’t have a national ID at all. In the US, for example, most people use state-issued drivers’ licences as their main form of identification.
China hasn’t attempted to link facial verification to its national ID, but last year enacted rules forcing customers to have their faces scanned when they buy a new mobile phone, so that they could be checked against the ID provided.
Nevertheless, facial verification is already widespread in airports, and many government departments are using it, including the UK Home Office and National Health Service and the US Department of Homeland Security.
How will it be used?
Singapore’s technology is already in use at kiosks in branches of Singapore’s tax office, and one major Singapore bank, DBS, allows customers to use it to open an online bank account.
It is also likely to be used for verification at secure areas in ports and to ensure that students take their own tests.
It will be available to any business that wants it, and meets the government’s requirements.
“We don’t really restrict how this digital face verification can be used, as long as it complies with our requirements,” said Kwok Quek Sin, senior director of national digital identity at GovTech Singapore.
“And the basic requirement is that it is done with consent and with the awareness of the individual.”
GovTech Singapore thinks the technology will be good for businesses, because they can use it without having to build the infrastructure themselves.
Additionally, Mr Kwok said, it is better for privacy because companies won’t need to collect any biometric data.
In fact, they would only see a score indicating how close the scan is to the image the government has on file.