Two recent investigations by the Australian Privacy Commissioner dealt with the taking of facial images of individuals: Clearview AI and 7-Eleven Stores and the consents required.
Clearview AI Investigation
Commissioner initiated investigation into Clearview AI,Inc. Privacy 2021 AICmr 54 was the result of a joint investigation by the Office of the Australian Information Commissioner and the UK’s Information Commissioner’s Office: the Australian Privacy Commissioner ordered Clearview AI to cease collecting facial images and biometric templates from individuals in Australia, and to destroy existing images and templates collected from Australia.
UPDATE: The Privacy Commissioner Angelene Falk has also determined that the Australian Federal Police (AFP) failed to comply with its privacy obligations in using the Clearview AI facial recognition tool.
The Privacy Commissioner found that Clearview AI breached the Australian Privacy Act 1988 by:
- collecting Australians’ sensitive information without consent
- collecting personal information by unfair means
- not taking reasonable steps to notify individuals of the collection of personal information
- not taking reasonable steps to ensure that personal information it disclosed was accurate, having regard to the purpose of disclosure
- not taking reasonable steps to implement practices, procedures and systems to ensure compliance with the Australian Privacy Principles.
Clearview AI’s facial recognition tool includes a database of more than three billion images taken from social media platforms and other publicly available websites for use by law enforcement agencies. The tool allows users to upload a photo of an individual’s face and find other facial images of that person collected from the internet. It then links to where the photos appeared for identification purposes.
The OAIC investigation concluded there was a lack of transparency around Clearview AI’s collection practices, the monetisation of individuals’ data for a purpose entirely outside reasonable expectations, and the risk of adversity to people whose images are included in their database.
Clearview AI argued that the information it handled was not personal information and that, as a company based in the US, it was not within the Privacy Act’s jurisdiction. Clearview also claimed it stopped offering its services to Australian law enforcement shortly after the OAIC’s investigation began.
However, the Privacy Commissioner concluded that Clearview AI was required to comply with Australian privacy law and that the information it handled was personal information covered by the Privacy Act.
7-Eleven Stores investigation
In Commissioner initiated investigation into 7-Eleven Stores Pty Ltd (Privacy) (Corrigendum dated 12 October 2021) [2021] AICmr 50 the Privacy Commissioner ordered 7-Eleven Stores Pty Ltd to destroy, or cause to be destroyed, all faceprints it has collected through the customer feedback mechanism, in breach of APPs 3.3 and 5, and to ensure this act or practice is not continued.
The Privacy Commissioner found that from 15 June 2020 to 24 August 2021, 7-Eleven Stores Pty Ltd interfered with the privacy of individuals whose facial images and faceprints it collected through its customer feedback mechanism, within the meaning of the Privacy Act 1988 (Cth), by:
- collecting those individuals’ sensitive information without consent, and where that information was not reasonably necessary for the respondent’s functions and activities, in breach of Australian Privacy Principle (APP) 3.3
- failing to take reasonable steps to notify individuals about the fact and circumstances of collection and the purposes of collection of that information, in breach of APP 5.
The Facial Recognition Tool was deployed in 700 stores nationwide.
The Facial Recognition Tool was a built-in camera that took facial images of a customer as they completed an in-store survey. As at March 2021, approximately 1.6 million survey responses had been completed.
7-Eleven Stores Pty Ltd’s purpose for capturing facial images and generating faceprints was to detect if the same person was leaving multiple responses to the survey within a 20 hour period on the same tablet. If they were, their responses may not have been genuine, and were excluded from the survey results. It also enabled 7-Eleven to have a broad understanding of the demographic profile of customers who completed the survey.
If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.
Author: David Jacobson
Principal, Bright Corporate Law
Email:
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.
