Kmart Australia broke privacy rules by running a facial recognition program in its stores for two years.
The Office of the Australian Information Commissioner (OAIC) said the retailer gathered biometric data from people entering 28 stores between mid-2020 and mid-2022. Instead of focusing on known offenders, the system scanned every customer who came through the doors.
How the system worked
Kmart started the trial in June 2020 to reduce refund fraud and spot people with a history of theft or aggressive behaviour. Cameras at store entrances and service desks recorded several images of each visitor. The software then created digital profiles and checked them against a database of past suspects.
Kmart explained that only images with a match were stored, while all others were deleted. It also stressed that the data was not used for marketing.
Why it raised concerns
According to the OAIC, the program went too far. The regulator argued that Kmart could have used less invasive methods to fight refund fraud. Therefore, the broad collection of sensitive data was not a fair trade-off for the potential benefits.
After the program ended
Once the system was shut down in 2022, refund-related incidents went up. Kmart reported a sharp rise in threatening behaviour from customers, which it says has made work more difficult for its staff.
Not the first retailer
This decision came less than a year after Bunnings faced a similar ruling. In that case, the chain had also used facial recognition to track customers. Together, these cases highlight the growing tension between store security and customer privacy.
