Bunnings Breached Privacy Laws by Using Facial Recognition on Customers, Privacy Commissioner Finds

Pretty poor form from Bunnings/Hammerbarn.

In short
A landmark decision by the Privacy Commissioner has found hardware chain Bunnings breached privacy laws by using facial recognition technology on its customers.
Retailers argue the technology helps prevent theft, but the Privacy Commissioner says Bunnings did not gain proper consent to capture people's unique biometric data.

What's next?
The Commissioner has ordered Bunnings not to repeat the behaviour and to destroy all personal information collected.

ABC article

Shame there won’t be a financial penalty.

Related Stores

Bunnings Warehouse
Bunnings Warehouse
Marketplace

Comments

  • +32

    I always leave home with a balaclava on for this reason

    • +3

      A few infrared LEDs under the brim of a hat is meant to work as well.

      • +4

        Doesn't it get hot under the foil?¿

        • +3

          not if it has active cooling with inbuilt fan and heatsink

    • You can't beat gait detection, even putting stones in your shoes doesn't work.

      • +4

        Amputate so you can vary height and stride length if you aren't a casual.

        • Seems like good advice for full time Bunnings staff, also!

      • +17

        If you Walk without rhythm then you won't attract the worm.

    • Fashion statement is just the beginning…

    • lol, thanks to the government a covid mask is easier.

    • +59

      This lax attitude towards privacy needs to (profanity) right off.

    • +12

      Why do they need to recognise my face when I buy drill bits or seedlings?

      • +8

        So that in the future if your social credit score is too low you can be detected and shamed/harrassed/whatever like they do in China?

        • +2

          Meh, life is basically already like that in Australia. More or less.

          Growing up poor or growing up rich, you may as well tattoo it as a credit score on your forehead in Australia if you look at the actual outcomes of the average people in those situations.

          In Adelaide we call this unwritten social credit system "What school did you go to?".

          • @AustriaBargain: Sure, but in terms of being spied on everywhere we go are we all being treated the same regardless?

            • +3

              @EightImmortals: Yeah we have that too, it's called gossiping about each other's income and stalking each other's social media.

          • @AustriaBargain: might watch that movie out of time with JT

      • -1

        Cause it’s usually aggressive bogan tradies driving utes

    • +2

      Im sure you are in favour of the "misinformation" bill too….

    • +1

      This. People like this is what I don't want the future ozbargain generation to know about FFS.

      • -3

        Don’t bother, same don’t want to meet you either ahaha I can imagine how affected are you by this. No time. Thanks

        • Are you sure? We must have crossed paths at bunnings sometime..

    • “Those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety.”
      ― Benjamin Franklin

    • You probably don't actually know what facial recognition is / what the requirements would be.

      You need to consider where this data is stored, how are we identify fredfloresjr, is there a unique identifier tied to him, what do we do with the data, who has access to see when you frequent the store.

      Stalkers best case scenario really if they had access.

      You need to consider ALL implications of how mismanaging your largely pointless from a loss prevention point of view facial recognition may affect customers / the public when abused.

  • +3

    Isn't this standard in colesworths though? I thought there was some sort of condition of entry written on a wall somewhere in the stores.

    • iirc they use height or something like that to track, not facial recognition

      • +7

        They fail at that if height is what they use. The cameras are always on my forehead, I'm tempted to put a pair of googly eyes there to see if that breaks the system.

        The checkout system definitely uses some sort of recognition system, though. It has been very good at detecting the fruits and veggies.

        • The checkout system definitely uses some sort of recognition system, though. It has been very good at detecting the fruits and veggies.

          It does - I noticed it being pretty intelligent when providing options for selecting fruit/vegetables and so I asked the staff member monitoring the self serve area. They said that the cameras on the register are recognising the item and only providing relevant options.

          • @Chandler: Woolies were pinged for using biometric data at the self-serve checkouts a long, long, time ago.

            Despite this clear warning, and advice from any tech person with a pair of eyes or ears, Bunnings carried on with their IoT camera rollout.

            https://www.internationalaffairs.org.au/australianoutlook/re…

            Their lobbyists clearly already knew OzGov would be happy with them mining the Peasant's personal biometric resources. Like some mineral resources, and LNG, mates all get to collect for free.

            These devices are all vulnerable to abuse, and use cloud-based recon by default. China gets all the data before Bunnings', law enforcement (or even your local librarians), which is why the spooks eventually told OzGov to buy using security-approved producers. They fell short of going any further and providing direction to business. Perhaps our pollies pay others to goto the Boonoir, while they consume grapes somewhere nicer.

            If enough customers asked Bunnings to sack their CEO for collecting and sharing our biometric data with world+dog it would work. Or if their shops began suffering at the till. OzGov are incapable or making them re-think such evil activity or even making them even respect existing (inadequate) laws.

            I've gone back to my local businesses since they started turning their stores into Colditzes, what with all these cams, robotic checkouts, and constant loud-hailed propaganda announcements telling us to manage our behaviour, or else!

      • +2

        Skin colour as well.

    • +5

      No.

      https://www.woolworthsgroup.com.au/au/en/privacy/in-store-te…

      It’s also important to note that we do not use facial recognition technology in any of our store

      https://www.smh.com.au/technology/the-self-serve-is-frustrat…

      "Cameras used by Coles do not record personal information or have facial recognition" (December 2023)

  • +2

    I think people might be surprised how normal this is for big business..

    • +3

      IIRC, three stores have tried this - Bunnings, Good Guys and Kmart. Are you aware of any others?

    • -1

      Proof? Or just a "feeling"?

  • +1

    Excellent and hopefully will see flow on to other retailers

    • How will they stop aggressive bogan tradies driving utes?

      • +1

        But that's their core business 🤷‍♀️

  • +11

    I would like to see the stats on how many thieves they actually caught using their facial recognition cams.

    • -2

      And if your worried about the size of your appendage, who cares, just hang it out …

      And if your worried about that hemorrhoid, just bend over and take it …

      Hang on, you don't need a hemorrhoid for that, just obey what @TheMindsetTraveller says is acceptable! (might be time to immigrate to China)

    • -2

      Not sure why your negged… its all true…

  • +3

    I’m looking forward to their AI powered onions so they can return to their rightful place atop the sausage

    • Maybe they should start doing brain detection for JV and his sock puppets 🤔

  • +10

    I'm waiting for some dodgy lawyer to do a class action. I want a free bunnings sausage as compensation.

    • Not unless u one of those aggressive bogan tradies driving utes in mullets

  • +2

    Privacy-conscious will not like this assertion, but… such rulings are based purely on a technicality of technology. Loss prevention officers walk around doing "facial recognition" every day. They can "recognize" you, follow you, and they can take note of your activity even before you enter the store. Consent is not asked, and in fact, it is not required at all. Many of them have a list of persons of interest they follow. But when software does their job, it's now a weird quirk of the law that now it's a problem.

    Mind you, I'm not saying this to "devils advocate" and cry "boohoo poor innocent business" or anything. But my concern is, our local privacy legislation is just… well, it is unclear. Rulings like this could easily go one way or the other depending on the whims of the commissioner. We don't have any robust framework for what data is/isn't ours, and how consent is given, and how it can be revoked, if at all. We don't have a "Australian GDPR" for example.

    So I think it's to be expected that businesses are "doing their own thing." Nobody is telling them what the boundaries are. Of course it becomes a wild west.

    • +9

      Do you really think that automated, country wide facial recognition systems are identical in their privacy threat to a security guard at one location?
      But I agree the privacy regulations need a drastic overhaul.

    • +5

      I think you're slightly missing the point. The issue isn't the facial recognition, the issue is the database behind it. It's the collection and storage of your personal data without your consent, using something that can be hacked or otherwise misused without your knowledge.

      Yep, we can have the same OUTCOMES using people, you're correct, and that's the way it was done before we had this technology.

  • +2

    The Commissioner has ordered Bunnings not to repeat the behaviour and to destroy all personal information collected.

    Oh how will Bunnings recover from that……. Oh wait, they didn't get fined, slap on the wrist at most, and told to put up a tiny sign to say they collecting this data.

    • Who will check the data was not backed-up or transferred elsewhere?

      Or even appropriately deleted, for that matter.

      There are many third party services actively targeting corporates to supply services that provide matches with other 'sources' and to automate the commencement of police investigations and drive the apprehension of ay individuals that come up as a positive (false, or otherwise) match.

      Does Bunnings even know who else could have collected it, or how many individuals have had, or even currently, have access?

      Did the Commission even think to ask, let alone verify the answer?

      Especially given that once the data is shared outside Australia, it cannot be regulated or in any practical way controlled.

      Simple things like, "Apart from the Facial Recognition Technology you use within your own perimeter, do you know if data from the cameras could have transferred elsewhere? What controls and metrics have you in place to ascertain the extent of any changes?" The commission only seems to have asked questions about the 'FRT' system itself.

      If Bunnings are like other businesses, their cams and other devices handling CCTV traffic would have been accessible by many more parties than they could imagine- not just their IT staff and contractors.

  • Doesn't Woolies have facial recognition? I swear I read or heard an employee they're releasing it

    • Well there is a camera at every self checkout …. so yes they have this capability. what they are will to say about this publicly is another discussion

      • They have object recognition on the self serve (and the scale in Fruit & Veg).

  • I better do my hair and make up the next time i go to Bunnings.

  • Wear a hat to beat the face detection. My local casino requires hat removal prior to entry so the cameras can spot banned gamblers. Bunnings won't stop you coming in wearing a hat.

    • Wear a hard hat, makes you even look more legit without being seen.

  • With so many Degenerates in our community, I'm not surprised big businesses are doing this, you only have to work in retail or a customer facing environment to see the worst that humanity has to offer. With the courts and the police not being hard on theft and crime sadly we are that the stage where we can no longer be anonymous when going about our business. This means to enter any private premises you will need to confirm your identity and this is the solution they will go with.Soon they will start making a condition of entry They are already doing this in all sorts of places, like passport control in airports, to license plate capture at the petrol station. There will be 3rd party companies who will maintain large databases for identification matching services.

    • +3

      Several comments seem to think this targetted at theft, when this kind of data accumulation will be used to target you with tailored pricing etc. designed to maximise profits.

      It is amusing to see people defending stores against some possible shoplifting when the real benefit to the big shops is about squeezing their law abiding customers.

      If you only buy Toyotas because you value their reliability and quality you don't want the car dealer to know that when you are haggling for your next Camry.

      • -3

        Why does theft and loss prevention and customer profiling to maximise profits have to be mutually exclusive. Big business will want to do both, both are real benefits , tackling both of these will optimise thier revenue.

        Your car dealer is already doing this. they know when you last purchased a vehicle and with high probability when you are going to purchase your next one.

        you don't think the residential real estate industry doesn't collectively maintain a register or database of low value and high value tennants.

        Now that its 2024 and big data has arrived, there is no stopping this and there is no way of regulating it unless you allow unfettered administration access to audit the it systems enabling these capabilitites.

        If this technology stops the next machete weilding teenager from terrorising retail staff this is the way it's got to be….and this is why we can't have nice things.

        • +4

          I don’t get the hand wringing, and idea that “well, if it possibly might do something good, its the way it has to be” or the idea that we can’t have regulations that stop surveillance being used disproportionately because somebody already has done it?

          Why can’t we ask for some evidence that the risk of machete wielders is high and that surveillance will stop them? Why can’t we make a regulation that allows audit access in the case of a whistleblower or other investigation?

          Why is it OK for big business to spend millions to take away privacy, but all too hard to regulate them in a way to minimise privacy violations?

          • -1

            @mskeggs: Because this requires government agencies to have the resources and expertise to do so, and the technologists are always a step ahead of any regulatory framework that is proposed or enacted.

            Also governments also like the idea of keeping tabs of thier citizens whether the motives are nefarious or not. So why not let the private sector do it and use thier service offerings because the idea of the government setting up a system to keep tabs on citizens is just politically incongruent.

            What will happen is there will be a token framework set up so say regulation exists but will be ineffective. This is beyond the consciousness of the ordinary citizen to there will be no political will to do this properly, unlike dare I say firearms and gun control, where citizens can contextualise something like this more easily, and one active shooter incident really brings things into focus.

            If the customer facing retailer ie Bunnings or Woolies is not allowed to do this in-house they will subcontract out these services out to third parties to "comply" with the regulations and simply say " We don't collect your data or Personal biometric information"

            • @H3R34TH4C0MM3NTS: Err, sorry, isn't the point of this thread that the regulation WORKED and Bunnings were caught out?

              You seem to have a conspiracy theory bent, and not understand how laws work. Outsourcing crime is still crime.

              • @foursaken: Regulation hasn't "worked" there is no regulation. It's just the privacy commissioner saying Bunnings have been naughty little boys and bunnings voluntarily saying "oops" we'll delete all our Pr0n now.

                There's no conspirators bent on this, this is all a PR exercise , why did Bunnings release some of the CCTV footage with customers terrorising staff and shoppers with a shotgun. This is to get the public to sympathise with them.

                Outsourcing crime is perfectly legal, Just take a look at Transurban and Australian Pacific Airports (who operate Melbourne Airport) robbing citizens every day legally on behalf of the government. If thats not morally criminal , I don't know what is.

            • @H3R34TH4C0MM3NTS: When I can vote Bunnings out of office, I’ll start giving them central powers. You and I can differ on whether government is effective, but surely you can agree there are things businesses should be restricted from doing?

      • There's no realistic chance they're using such data for marketing.

        People think because they imagined such a scenario could happen, that ergo it must indeed actually be happening. It's not the case.

        If you sign up for a few loyalty cards and actively give these companies your data, you can see just how poorly they "target" their promotions and ads. These companies typically mass-produce the same (non-targetted) advertising for everyone. Everyone gets the same specials, the same flybuys deals, the same promo pamphlets, etc.

        To think that it's some fine tuned, all-seeing, all-powerful machine that takes in data from all angles and watches you in store and calibrates the next move is… over the top.

        This data is not meaningful. They already have sales captured at the register.

        • Yes, how would they be able to unite all this data? Surely they would not be able to tell how long you spend in-store, how much you spent and on what? What use would any of that be? /s

      • If you actually read details of what they were doing you would see they are NOT collecting any data. What was deemed "collection of data" was them holding the image in memory for 4/1000th of a second while they processed it and then deleted if not one of the violent offenders they were trying to defend against. This was a fantastic example of how businesses SHOULD be able to use facial recognition as it was done in a non privacy invasion way, sadly the luddites ruling on this didn't understand the technology enough.

        • I think the issue is more that they didn’t they didn’t follow the privacy principles, which doesn’t bode well that when someone in the customer retention team says “since we have this in place, let’s just increase the scope a little”.

          • @mskeggs: I Can understand their view though, if i built that i would not consider holding a picture in memory for a fraction of a second as collecting and storing private info, i kd consider it the opposite. The system is designed with privacy in mind with nothing for a customer retention team to use, just the moronic ruling that having in for a fraction of a second constitutes collection.

            • @gromit: The criticisms in the parts of the judgement I saw in the media were that they didn’t inform people adequately, or seek their consent, they didn’t update their privacy policy, and that they recorded everyone, not just those who might pose a problem (that is, they didn’t consider no surveillance and using other measures).

              The Australian Privacy principles are very weak, and that they didn’t follow these simple things suggests the vibe at Bunnings is one where they decide if something is privacy invasive or not - which is what they have doubled down on in their statement.
              I’m happier with regulation deciding whether something is important, rather than someone in Bunnings ICT team who says “it isn’t surveillance because we only keep it for a fraction of a second, so we can do it in secret.”

              • @mskeggs: The point of recorded EVERYONE, was they considered stored in memory for processing for a fraction of a second storing and collecting. Bunnings have said they are appealing the decision as they rightfully should, it was a really bad call. The only part they got right is bunnings should have clear signs posted. Bunnings obviously didn't think they were recording or storing information on everyone as they weren't, they were immediately deleting, i.e. deleting after a fraction of a second after the images were processed.

  • +5

    If you read the judgement there is no discussion about the legality of facial recognition technology (FRT) and implications for using FRT under privacy law.

    The judgement is that Bunnings did not have sufficient risk/concerns to utilise it. (IE the threat to staff/stock from people who could be identified by the system was insufficient to merit utilising FRT).

    This is something that I'm sure will be challenged, because no one should be put at risk by being at work, and identifying known high risk targets potentially reduces this risk.

    • -1

      There was less crime and road deaths during COVID lock down, does that mean we should all be locked down?
      Since they operated the system, how many incidents were avoided? I note they didn’t mention any figures on this in their statement.
      The criticisms of Bunnings in the reports I have seen relate to using a sledgehammer to crack a walnut - everyone is surveilled, not just those who might deserve to be, and the lack of compliance with privacy principles, like including it in their privacy policy and adequately notifying people.

      The Australian Privacy Principles are very weak. That Bunnings did not follow them in this case is a pretty clear demonstration that they aren’t very good at balancing privacy versus harms of surveillance.

  • -2

    If you want privacy don't go out in public.

  • I just watched some videos of crazy people that shop at Bunnings. I've never personally seen anything like it, while I have been there. Must go there more often.

    • the guy with the shotgun?

    • -1

      Is it suprising? Most look like bogan tradies with mullet hair driving utes

      • How many times are you going to make the same comment?

  • -1

    Don't shoot the messenger, but….perhaps the Law needs to change.
    Is being recognised on Security cameras really going to hurt you? I doubt it, but it will help find ya partner that wandered off bored to death in store. It will reduce thieves getting away so often & it will help against theft Inflation.

    My Store = My Rules…. after I would ensure I meet all AU Rules, permissions and signage etc.
    (My customers came into my workshop for years, and followed my rules).

    Then it is your choice to come into MY store, with cameras watching every aisle for Stock Control for finding the lost souls.
    You being in that Aisle is purely coincidental and YOUR choice.

    If the System can use FRS and it is legally allowed, and my store Security team need/use it, then we will use it.

    Excepting I am retiring to a hermit on an island life, so I don't really care but I have nothing to hide,although I do understand some do, and some do take this Privacy Attitude seriously…. Again that is your choice.

    On the other hand, I do NOT understand why some have this serious Privacy Attitude.

    Cameras are everywhere nearly, and regardless of your own personal reasons, surely this tech helping to find a missing persons - good or bad - should take priority over your personal fears?

    It comes down to the same logical retort on complaints against Speed, Red Light, Mobile Phone& Seat Belt cameras etc,…. you have nothing to fear if you are not breaking the Law.

    • +1

      you have nothing to fear if you are not breaking the Law.

      This is a simplistic interpretation of privacy and could be used to justify almost anything. You should read this:

      Solove, D. J. (2007). I've got nothing to hide and other misunderstandings of privacy. San Diego Law Review, 44, 745.

      • I'm not going to read the entire paper but it appears at first glance this is relating to Government encroachment on privacy which I'm pretty sure most people vehemently object to. In this case, this is a private company which is undertaking surveillance on their own properties in order to protect staff, customers and property which is an entirely different argument.

        • +1

          Arguably government and companies are just different forms of organisation. If I have a right to privacy, it should operate equally against all peoples (individuals or organised collectives).
          Also bunning’s market share and the practices they’ve taken to build and protect that market share mean it’s difficult for the average Australian to avoid it. If a business is positioned in such a way in a country, such that it’s very difficult for a citizen to avoid transacting with it (or at least not without incurring decent expense), do they still earn all the protections that any private enterprise might - or has it become too far embedded in the lives of the public to really be in the private domain….
          Bed time for me, sleeping soundly, knowing my face isn’t training BunningsGPT

          • @SailorGoon: Attempting to conflate Government and businesses is an asinine argument.

        • which is an entirely different argument.

          How so?

          • @blitz: I'm sorry, but if you're incapable of making the distinction between Chinese style surveillance on all its citizens anywhere, anytime and a private company who's conducting surveillance on their own property, it's not worth my time or energy continuing the discussion.

        • +1

          Private companies can do whatever but cannot override the law which is the case for Bunnings.

  • With the outrageous amount of theft from societal degenerates these days, I'm not surprised at them using technology to catch recidivous offenders. And guess who pays for the millions of dollars of theft each year from stores? The law abiding public.

    • yea i guess next step for Bunnings is to start hiring private security guards instead of a poor teenager at the front of the store like everyone else eg Pharmacies, electronic stores but not sure how much power they will have or care

  • +2

    It is completely moronic that this was treated as a breach. If anything this was a demonstration of correct and safe use of the technology in a non damaging way to peoples privacy.

Login or Join to leave a comment