Grocery’s trial use of facial recognition technology deemed compliant under Privacy Act

Privacy commissioner highlights possible benefits and concerns in Foodstuffs North Island’s model

Grocery’s trial use of facial recognition technology deemed compliant under Privacy Act

A privacy inquiry has found that, while Foodstuffs North Island’s live facial recognition technology (FRT) trial involved a high level of privacy intrusion due to the collection of each visitor’s face, privacy safeguards reduced this intrusion to an acceptable level. 

The inquiry report of Michael Webster, privacy commissioner, concluded that the utilisation of FRT during FNI’s trial complied with the Privacy Act 2020, according to a media release from the Office of the Privacy Commissioner (OPC). 

FNI’s FRT trial ran from 8 February 2024 to 7 September 2024 in 25 supermarkets. During that period, FNI’s FRT model scanned 225,972,004 faces; deleted 99.999 percent of images within a minute; and led to 1,742 match alerts, 1208 of which involved confirmed matches. 

“The trial findings will help other businesses to ask the right questions about whether FRT is necessary and appropriate for them and to understand what they would need to do to set FRT up and run it in a privacy protective way,” Webster said in the news release. 

Webster’s inquiry into FNI’s trial aimed to address FRT’s privacy impacts, its compliance with privacy legislation, and its effectiveness in combatting serious retail crime compared with less privacy-intrusive alternatives. 

In the news release, Webster shared that the inquiry’s findings demonstrated that using FRT can help reduce harmful behaviour, including serious violent incidents. However, Webster stressed that the findings also showed that utilising FRT engaged privacy concerns including: 

  • the unnecessary or unfair collection of personal information 
  • misidentification 
  • technical bias reinforcing human bias and existing inequities 
  • the potential for surveillance 

“These issues become particularly critical when people need to access essential services such as supermarkets,” Webster said in the news release. “FRT will only be acceptable if the use is necessary and the privacy risks are successfully managed.” 

Safeguards

According to the OPC, as privacy safeguards during its FRT trial, FNI: 

  • swiftly deleted images not leading to positive matches 
  • set up its system to only identify violent offenders and perpetrators of seriously harmful behaviour 
  • refrained from including in its watchlist images of children, those under 18 years old, or those considered vulnerable 
  • did not exchange watchlist information among its stores 
  • raised the operational threshold to trigger an FRT alert from 90–92.5 percent likelihood of image matches 
  • made two trained staff members verify match alerts 
  • limited access to the system and its information to trained and authorised staff 
  • prohibited the use of collected images for training data purposes 
  • reviewed and improved the system in areas with misidentifications or errors 

“Foodstuffs North Island designed the privacy safeguards used in the trial with feedback from my Office,” Webster said in the news release. “This has provided some useful lessons for other businesses which may be considering using FRT.” 

Improvement areas

“There is still some work to do to increase the safety and effectiveness of FRT software use in the New Zealand context, as FRT technology has been developed overseas and has not been trained on the New Zealand population,” Webster said. 

“As a result, we can’t be completely confident it has fully addressed technical bias issues, including the potential negative impact on Māori and Pacific people,” Webster added in the OPC’s news release

Webster identified possible areas for improvement as FNI considers permanently using FRT or expanding its use to more stores. Specifically, Webster expects FNI to: 

  • continue to monitor and review its FRT use 
  • update its documented processes and system settings to align with the practical reality 
  • assess the effects of skin tone on identification accuracy and store response 
  • assure the regulator and its customers that its privacy protections remain in place 

Moving forward, the OPC will keep working on developing a Biometric Processing Privacy Code, projected for publication in mid-2025. This code seeks to help ensure the safe utilisation of biometric information, including photographs used in FRT, in this country. 

Government response

Paul Goldsmith, justice minister, welcomed the OPC’s inquiry report as “great news for businesses that are considering using the technology as a means to protect their livelihoods.” 

In a news release from the government, Goldsmith noted that the report demonstrates that using FRT can effectively help fight retail crime, especially serious violent incidents toward retailers. 

“I expect our Ministerial Advisory Group will continue to look at this technology as an option to be used more widely and engage with the sector on it,” Goldsmith said in the government’s news release. “I’ll be encouraging the MAG to take this report into serious consideration.”