Australian privacy watchdog clarifies rules on facial recognition in retail

As noted by Biometric Update, new guidance from the Office of the Australian Information Commissioner (OAIC) addresses the use of facial recognition technology in high-volume, publicly accessible spaces like retail storefronts, adding complexity to the ongoing debate surrounding face biometrics in commercial environments.

The OAIC's updated guidance clarifies exceptions to consent obligations for Australian Privacy Principle (APP) entities considering facial recognition in retail settings. Collecting sensitive information, including biometrics, typically requires express consent, and must be reasonably necessary for an entity's functions or activities. However, the OAIC acknowledges the practical difficulties in obtaining direct consent from every passerby when facial recognition is deployed in public retail spaces. Retailers unable to meet consent pathway requirements must rely on exceptions, such as being authorized by law or falling under a "permitted general situation."

This update follows the 2024 Bunnings case, which established a high bar for using facial recognition in Australia, emphasizing that each deployment must be assessed against the Privacy Act. Despite community privacy concerns, approximately 80% of Australian shoppers reportedly support facial recognition for preventing violence and identifying offenders.

Source: Biometric Update