Supermarket Trial Of FRT: Inquiry Results Announced

Press Release – Office of the Privacy Commissioner
'FRT systems have potential safety benefits, but they do raise significant privacy concerns, including the unnecessary or unfair collection of peoples information, misidentification, technical bias which can reinforce existing inequities and human …
Privacy Commissioner Michael Webster has found that the live facial recognition technology model trialled by Foodstuffs North Island is compliant with the Privacy Act.
However, his Inquiry report released today, shows that any business considering or using FRT needs to make sure it sets things up right to stay within the law.
'While the use of FRT during the trial was effective at reducing harmful behaviour (especially reducing serious violent incidents) it has also shown that there are many things that need to be taken into account.
'FRT systems have potential safety benefits, but they do raise significant privacy concerns, including the unnecessary or unfair collection of people's information, misidentification, technical bias which can reinforce existing inequities and human bias, or the ability to be used for surveillance'.
'These issues become particularly critical when people need to access essential services such as supermarkets. FRT will only be acceptable if the use is necessary and the privacy risks are successfully managed'.
The purpose of the Privacy Commissioner's Inquiry into Foodstuffs North Island's trial use of live FRT was to understand its privacy impacts, its compliance with the Privacy Act, and to evaluate if it was an effective tool in reducing serious retail crime compared with other less privacy intrusive options.
The Inquiry found while the level of privacy intrusion was high because every visitor's face is collected, the privacy safeguards used in the trial reduced it to an acceptable level.
'Foodstuffs North Island designed the privacy safeguards used in the trial with feedback from my Office. This has provided some useful lessons for other businesses which may be considering using FRT.'
The main privacy safeguards in place during the trial were:
– Images that did not result in a positive match were deleted immediately, as recommended by OPC – this meant there was very little privacy impact on most people who entered the trial stores
– The system was set up to only identify people who had engaged in seriously harmful behaviour, particularly violent offending
– Staff were not permitted to add images of children or young people under 18, or people thought to be vulnerable, to the watchlist
– There was no sharing of watchlist information between stores
– During the trial, the operational threshold that triggered an FRT alert was raised from 90% to 92.5% likelihood of the images matching, reducing the chances that people would be misidentified while managing down the 'computer says yes' risk
– Match alerts were verified by two trained staff, ensuring that human decision making was a key part of the process
– Access to the FRT system and information was restricted to trained authorised staff only
– Images collected were not permitted to be used for training data purposes
– Systems were reviewed and improved during the trial where misidentifications or errors occurred.
'There is still some work to do to increase the safety and effectiveness of FRT software use in the New Zealand context, as FRT technology has been developed overseas and has not been trained on the New Zealand population.
'As a result, we can't be completely confident it has fully addressed technical bias issues, including the potential negative impact on Māori and Pacific people. This means the technology must only be used with the right processes in place, including human checks that an alert is accurate before acting on it.'
'Some improvements will also need to be made by FSNI before the use of FRT is made permanent or expanded to more stores. These focus on ensuring the documented processes and system settings are updated to match what happens in practice, including ongoing review of the use of FRT to make sure its use is justified as an effective tool for reducing serious harm offending.
'I also expect that Foodstuffs North Island will put in place monitoring and review to allow it to evaluate the impact of skin tone on identification accuracy and store response, and to provide confidence to the regulator and customers that key privacy safeguards remain in place.
'The trial findings will help other businesses to ask the right questions about whether FRT is necessary and appropriate for them and to understand what they would need to do to set FRT up and run it in a privacy protective way.'
The report sets out my expectations for the use of FRT across nine key areas, says the Privacy Commissioner.
The FRT trial started on 8 February and ended on 7 September 2024 and ran in 25 supermarkets. During the trial, 225,972,004 faces were scanned (includes multiple scans of the same person), with 99.999% of these deleted within one minute, and there were 1742 alerts of which 1208 were confirmed matches.
OPC is currently developing a Biometric Processing Privacy Code, which applies to biometric information, including a photo of someone's face used in a Facial Recognition System. The new Code is expected to be published in mid-2025. The Biometrics Code is designed to provide guardrails for the safe use of biometrics generally, including FRT, in New Zealand.

Try Our AI Features

Explore what Daily8 AI can do for you:

Learn with AIFact CheckingText to SpeechAI Summary

Related Articles

Newsroom

10-06-2025

• Newsroom

Facial recognition tech not a green light for surveillance

Analysis: The Privacy Commissioner's much-anticipated report into Foodstuffs North Island's trial of facial recognition technology (deemed an 'inherently invasive' tool) offers plenty to chew over. Although the inquiry found the trial legal and generally compliant with the Privacy Act, important questions remain, and the report recommends that the technology stay under active review. People who may have been paranoid about facial recognition technology being used to monitor their every move in supermarkets – what's purchased and so forth – can rest easy. The commissioner found the technology was only used for the very narrow purpose of deterring serious incidents of violence and high-value retail theft by matching customers against a store's 'watchlist' (the image database of people of interest). It was not used for any other purpose, including minor retail crime prevention. The report cautioned against any future 'mission creep' in this regard. Furthermore, although everyone entering a store with such technology had their face scanned, images that did not trigger a match against the store's watchlist were deleted almost instantaneously. Meanwhile, watchlist data was deleted after two years in the case of perpetrators (and three months for their accomplices). The number of people put on watchlists peaked at 1800 during the trial and was down to 1504 at the end. Crucially, watchlist data was specific to each store, meaning there was no master list shared within the Foodstuffs' network. This meant anyone who had been added to one store's watchlist could still shop elsewhere, including at a store without facial recognition technology. Just as importantly, the criteria for being added to a watchlist were strict: either a conviction or a trespass notice was required. There was also de-linkage from other incident reporting systems, and watchlists were compiled manually. A two-camera/two-staff fail-safe system was adopted for positive matches, and the commissioner's report found no bias in how watchlists were compiled as well as used. Children and young people were excluded from watchlists. Meanwhile, Foodstuffs also maintained record keeping for judging the effectiveness of the facial recognition trial. A 16 percent decrease in serious incidents and an estimated 21 percent decrease in shoplifting in the participating stores was recorded. In addition, 115 serious incidents were avoided (including 65 people deterred from entering and 50 others through staff intervention). However, some scepticism was expressed because of qualitative limitations in the overall data set (especially data from non-participating stores which operated as the control group). The report documented at least two instances of misidentification, resulting in harm. Partly as a result, the accuracy rate required for positive matches was increased from 90 percent to 92.5 percent, although this still needed to be implemented. The Office of the Privacy Commissioner's Māori Reference Panel had opposed facial recognition technology in principle but gave advice enabling further safeguards to be adopted. Finally, the report cautions that its findings are 'not a green light for more general use of facial recognition technology'. This is a salutary reminder that decisions to employ it should not be taken lightly. Few small and medium-sized businesses will have the resources of Foodstuffs. The trial succeeded because of its investment in human time and effort. Technology, ultimately, is no substitute for this.

Scoop

05-06-2025

• Scoop

Expert Commentary: NZ Privacy Commissioner Provides Clarity For Retailers On Facial Recognition Technology

Nicholas Dynon is Brand Strategy & Innovation Director at Optic Security Group. He is a certified security risk professional and counter terrorism practitioner. 'The inquiry report found that the live facial recognition technology (FRT) model trialed by Foodstuffs North Island Limited (FSNI) in 25 of its supermarkets complied with New Zealand's Privacy Act. While the Privacy Commissioner assessed the level of privacy intrusion as high due to every shopper's face data being collected, the privacy safeguards in the trial reduced it to an acceptable level. 'The outcome has been met with strong and immediate political support, with Justice Minister Paul Goldsmith lauding the result as 'great news' and stating that he now expects the Ministerial Advisory Group for Victims of Retail Crime to 'continue to look at this technology as an option to be used more widely". 'The outcome also provides some much-needed clarity for retailers – and other organisations – who have held back on considering FRT as a potential solution to their security issues due to the fear of ending up on the wrong side of privacy legislation. But it's not a green light. 'The Privacy Commissioner has highlighted several changes that FSNI needs to make in order to make its trial permanent or to expand it to more stores. The Office of the Privacy Commissioner (OPC) has also set out nine key expectations for organisations that are considering using FRT. 'Compliant FRT deployment is about more than just the technology itself. Factors such as identifying and assessing the specific purpose for which you want to use FRT, maintaining watchlists, protecting the system from misuse and information breach, communications to customers, staffing and training, customer interventions, incident response, managing enquiries and complaints, and maintaining and monitoring the system, are all critical to compliance – and they involve significant research, planning, testing, and careful implementation. "At the same time, retailers should be aware that the results of an OPC survey published just weeks ago demonstrate that many New Zealanders are not supportive of the use of FRT in retail stores. 'The survey of over 1,200 New Zealanders found that 41% of respondents are 'concerned' or 'very concerned' about the use of facial recognition technology (FRT) in retail stores to identify individuals. A total of 25% are neutral on the topic, 31% are either not so concerned or not concerned at all, and 3% are unsure. 49% of Maori respondents indicated concern over FRT in retail. 'For retailers considering FRT, this means not only ensuring all the privacy legislation boxes are ticked but also taking a step back and asking whether FRT is the most appropriate solution to your security problem. 'Inappropriate FRT deployment exposes an organisation not only to legal risk but also to significant reputational risk. Engaging with trusted experts to understand the privacy dimensions and factors influencing social licence to operate this emerging technology are critical."

Scoop

04-06-2025

• Scoop

Police Commissioner Welcomes Report From The Office Of The Privacy Commissioner

Press Release – New Zealand Police Facial recognition technology is valuable for deterring, detecting and resolving crime. While there are many benefits to using technology it is crucial to have appropriate guidance in place. Police Commissioner Richard Chambers has welcomed an Office of the Privacy Commissioner report into the trial of facial recognition technology by a major supermarket chain, saying such technology is a valuable tool for fighting crime. 'I welcome the OPC's comments about the potential benefits of facial recognition technology and the finding that, in the case of the Foodstuffs trial, it was effective at reducing incidences of serious repeat offending.' 'The value of technology such as facial recognition is that it is fair and accurate. It has an important role to play in policing. Facial recognition technology is valuable for deterring, detecting and resolving crime. While there are many benefits to using technology it is crucial to have appropriate guidance in place.' 'I welcome the clear guidelines from the OPC on how retailers can use it effectively and the safeguards that are required. It offers useful guidance on whether its use is appropriate, what the privacy risks are and how those can be minimised.' Commissioner Chambers said the use of facial recognition technology as a crime prevention tool was a decision for retailers to make for themselves and their businesses. 'Police is supportive of retailers using tools like this to enhance safety for their staff and communities, as long as it is done lawfully and ethically. I am very enthusiastic about the opportunity to better use technology to help achieve positive outcomes. One of the biggest opportunities we have as a country is to embrace technology when it comes to fighting crime.'