The Office of the Australian Information Commissioner issued a determination earlier this fall about 7-Eleven’s use of “faceprints.” The OAIC found the convenience store improperly collected faceprint information without getting individuals’ consent in violation of the Privacy Act.

Accordingly to the OAIC, 7-Eleven used facial recognition technology as part of in-store surveys in 700 stores across the country. Approximately 1.6 million customers (as of March 2021) complete the survey on tablets with built-in cameras. The cameras took facial images of the customer as they went through the survey.  These images were uploaded by the third party providing the service to a centralized server. The third party then processed the images to make sure the same person wasn’t leaving multiple responses.  The images were also analyzed to understand the gender and age of survey respondents.

7-Eleven argued that the images were not “personal information” and that in any event, it had disclosed the recording in notices posted at the entrance of its stores.  Some notices had only an image of a surveillance camera, other signs though did say “by entering the store you consent to facial recognition cameras capturing and storing your image.” The OAIC disagreed with the company, stating that the images were personal information. Moreover, it found the signage (even the signs with the full statement) were insufficient for obtaining consent. The OAIC held that express consent was required, and could not be implied as a result of someone entering the store after reading the sign.

Putting It Into Practice: This case is a reminder that regulators beyond those in the US and the EU are concerned about use of facial recognition. Companies using these technologies in Australia will want to keep in mind the expectations around obtaining express consent when collecting faceprints.