{"id":1556572,"date":"2025-09-21T07:51:19","date_gmt":"2025-09-21T11:51:19","guid":{"rendered":"https:\/\/www.practicalecommerce.com\/?p=1556572"},"modified":"2025-09-21T18:34:33","modified_gmt":"2025-09-21T22:34:33","slug":"facial-recognition-bans-spread-globally","status":"publish","type":"post","link":"https:\/\/www.practicalecommerce.com\/facial-recognition-bans-spread-globally","title":{"rendered":"Facial Recognition Bans Spread Globally"},"content":{"rendered":"

A ruling last week in Australia makes using facial recognition to combat fraud almost impossible and is the latest example of global regulators’ growing disapproval of biometric technology in retail environments.<\/p>\n

The Office of the Australian Information Commissioner (OAIC) determined<\/a> that Kmart Australia Limited had violated the country’s Privacy Act 1988 when it used facial recognition to prevent return fraud and theft.<\/p>\n

\"Image

Kmart stores in Australia had used facial recognition technology to catch fraudsters. Image: Wesfarmers.<\/em><\/p><\/div>\n

Kmart and Bunnings<\/h3>\n

At question was a Kmart pilot program that had placed facial recognition technology (FRT) in 28 of the company’s retail locations from June 2020 through July 2022.<\/p>\n

The company created a face print, if you will, of every shopper entering one of the pilot program stores. When a customer returned an item, Kmart’s system would compare that person’s face print to a list of known thieves and fraudsters.<\/p>\n

Kmart argued that the technology aimed to thwart return fraud and protect its employees, which thieves had frequently threatened. Biometrics, however, represent a special category of privacy protection in Australia.<\/p>\n

The case was similar to a November 2024 OAIC determination<\/a> against Bunnings, a home-improvement retailer, for using FRT to identify criminals. Australian conglomerate Wesfarmers Limited owns Kmart Australia, Bunnings, and other retail chains, including Target Australia.<\/p>\n

FRT Challenges<\/h3>\n

The OAIC stated that its finding is not<\/em> a ban on FRT, but its conditions make using the technology challenging, if not impossible.<\/p>\n

For example, an Australian retailer would need consent before employing FRT, and the thieves stealing items to attempt return fraud would almost certainly refuse.<\/p>\n

Kmart had disclosed FRT in a sign at the front of each pilot store, which read, “This store has 24-hour CCTV coverage, which includes facial recognition technology.” But this notice did not establish consent according to the OAIC.<\/p>\n

Asking would-be criminals for permission to use facial recognition has the same effect as banning it, given the current state of the technology.<\/p>\n

GDPR<\/h3>\n

The OAIC’s Kmart decision regarding explicit consent aligns with other privacy regulations and rulings.<\/p>\n

For example, many privacy experts note that Article 9 of the European Union’s General Data Privacy Regulation, which covers the processing of special categories of personal data, requires explicit consent for the use of FRT.<\/p>\n

FTC vs. Rite Aid<\/h3>\n

In the United States, there are instances of rulings against FRT and the use of biometric data.<\/p>\n

In a 2023 determination<\/a>, the U.S. Federal Trade Commission prohibited Rite Aid Pharmacy from using FRT and other automated biometric systems for five years.<\/p>\n

The agency argued that Rite Aid had not taken sufficient measures to prevent false positives and algorithmic racial profiling.<\/p>\n

Illinois BIPA<\/h3>\n

The Illinois Biometric Information Privacy Act was enacted in 2008 and is, perhaps, the most stringent biometric privacy law<\/a> in the nation.<\/p>\n

The BIPA requires businesses to provide written notification of the use of biometric data and obtain shoppers’ written consent. The law permits individuals to sue for violations, and has resulted in many cases against retailers, such as:<\/p>\n