Fears over growing private surveillance systems

Saturday, 25 January 2025

New Zealand is sleepwalking towards becoming a surveillance society, as a result of private businesses deploying increasingly connected camera systems, the head of the Council for Civil Liberties says.

That threatened to create something the public would never consent to if proposed by the government or police: a network of facial recognition cameras that authorities could tap into to track people’s movements.

The council’s chairperson Thomas Beagle is calling for the use of facial recognition technology for surveillance to be banned, or at least heavily regulated, to preserve New Zealanders’ freedom to be anonymous.

“You are not allowed to be anonymous in public any more. You are always going to be identified and tracked,” said Beagle.

He takes a wide view when defining public to include semi-public/private spaces such as supermarkets, car parks and other shops.

The media spotlight has fallen on private surveillance systems after businessman and former Auckland mayoral candidate Leo Molloy posted on social media claiming that police had tried to bring evidence about an alleged incident in an Auckland supermarket in October 2024 to court when Green MP Golriz Ghahraman was being sentenced for shoplifting.

Ghahraman was alleged to have put items into a tote bag in her trolley at Pak‘nSave Royal Oak, though at no point is it alleged she actually attempted to leave the store with any items she had not paid for.

Police decided not to lay any charges, after investigating.

Police confirmed they got the information about the alleged incident from the private Auror platform, which many big-name retailers use to log incidents of crimes and attempted crimes against them; mostly theft, threats of violence, and violence against staff.

“A police file number was assigned the same day and assessed two days later as part of staff, routine screening of shoplift offending,” deputy commissioner Tania Kura said in a statement.

Kura said she was “satisfied that staff were notified appropriately, and acted responsibly and appropriately with the information.”

A spokesperson for Foodstuffs said: “We ask our store teams to log every incident of shoplifting into our retail crime reporting platform which is then made visible to the police who determine what to do next.”

It appears the supermarket chain, which last year started using facial recognition in stores from Levin to Tauranga, did not complain to police directly about the alleged incident, with a Foodstuffs spokesperson telling The Post: “For low level offending like you’ve described, we don’t engage directly with the Police.”

Auror told The Post it had strong privacy settings, and believed the source of Molloy’s information could have found out through the court process.

Facial recognition technology was not in action in the store, but the incident highlighted serious issues with surveillance of the public, Beagle said.

“If you accept information is power, who gets to wield that power? It’s the people with money and power.

“Is this happening because she [Ghahraman] is a high profile political person, and what does it mean for other people who upset the police, or someone else?” Beagle asked.

Retail groups like Foodstuffs compile reports and information on crimes and suspected attempts to commit crimes in their stores. Some do this using the Auror platform, through which they can also share information with other retailers. Using AI and facial recognition, it is able to link incidents logged at different stores, its website shows.

And police are able to tap into the Auror platform when they are investigating crime.

Many retailers also use licence plate recognition technology to monitor their car parks, which police can tap into too through Auror when looking for stolen cars.

It all adds up to a surveillance network that is growing in sophistication.

“If you said the police can set up cameras all over New Zealand tracking your face and car, everywhere you go, people would say no, but we are happy for private companies to do it,” Beagle said.

Auror bills itself as a retail crime and loss prevention platform, and baulks at being called a surveillance system.

Auror, which is a New Zealand technology success story expanding rapidly overseas, says it is particularly helpful in targeting the 10% of retail criminals that are responsible for more than 60% of retail crime, degrading neighbourhoods, pushing up prices, and subjecting shop staff to abuse and violence.

Retailers argue they take privacy seriously when deploying anti-crime camera technologies and facial recognition systems.

“We understand people might have concerns about our use of facial recognition,” said Foodstuffs North Island, which uses the services of Australian facial recognition company Vix Vizion in 10 New World stores and 15 Pak‘nSaves.

It says the system is 90% accurate, and was intended to only identify people who had been recorded by its staff as being violent, abusive, trespassed from stores, or caught thieving, or attempting to steal things.

Where the system did not identify a match with one of these people, the images and data of individuals were deleted.

Retailers’ use of cameras is evolving, creating more opportunities for deploying facial recognition which police will be able to tap into, for example, Woolworths deploying bodycams for staff in some stores.

Police have issued a facial recognition technology policy, saying they will access facial recognition data retrospectively (not for live-tracking people) and only for “lawful policing activities” and only “lawfully obtained images and data”.

Exactly what “lawfully obtained” means is a moot point in New Zealand, and 2025 is going to be a year in which the future of private facial recognition use is decided.

The Office of the Privacy Commissioner (OPC) is consulting on a “biometric” privacy policy, but Beagle says it is weak, and would prefer the Australian’s far less permissive approach.

Australian retailers got a rude awakening when the Australian Privacy Commissioner ruled Bunnings’ use of facial recognition was unacceptable in its current form.

Bunnings responded by releasing videos showing appalling violence committed in its stores.

The OPC is due to soon release a report on Foodstuffs North Island’s use of facial recognition technology and will be asking Auror, Foodstuffs and the police about the October incident.

New Zealand’s draft biometric privacy code, if it is approved as is, would allow private use of facial recognition technology by the likes of supermarkets where it was for a legitimate purpose and was “proportional” to achieve that purpose.

Beagle would like to see a harder line.

“We need clear rules to say what you can, and can’t do,.“

In a statement to The Post, the OPC said it kept “a watching brief on data aggregation platforms like Auror that provide Automated Number Plate Recognition and CCTV surveillance services due to the high potential privacy risk.”

It said: “For example, there may be risks in terms of the accuracy of the information placed on the platform, inappropriate access and disclosure by any of the parties involved, transparency of use and the potential for significant adverse impacts to individuals.

“The more personal data is brought together the greater the risk should a privacy breach – including employee browsing - occur. The Privacy Commissioner expects agencies providing or using these services to be able to provide assurance of their compliance with their legal obligations.”