Concern Foodstuffs’ facial recognition report 'green light' to wider use

Wednesday, 4 June 2025

The Privacy Commissioner says its report into Foodstuffs North Island’s facial recognition trial in supermarkets is “not a green light for more general use” of facial recognition technology, but the Council for Civil Liberties disagrees.

In Australia, a similar trial by hardware retailer Bunnings was knocked back by that country’s privacy commission, said Thomas Beagle, chair of the council.

Across the Tasman, retailers needed the express permission of people to capture images for facial recognition, while in New Zealand only a prominent sign at the door of a retailer was needed, Beagle said.

“If this [the New Zealand decision] isn’t a green light, the Australian decision was a red light,” Beagle said.

Beagle expected to see more retailers putting in facial recognition camera systems, especially as they did not need to do trials. Foodstuffs, which operates the New World, Pak ‘n Save and FourSquare brands, had liaised with the Privacy Commissioner before its trial, but other retailers will now be able to go ahead and use it without that step.

“Sometimes facial recognition technology will self-evidently be effective to meet a specific lawful purpose,” said the commission’s report into the Foodstuffs’ trial in 25 North Island supermarkets, which scanned shoppers’ faces just over 225 million times between February and September last year.

But it said each use of facial recognition technology had to be assessed on its merits, and warned: “We will continue to monitor facial recognition technology adoption”, including whether it complies with privacy laws.

The Council of Civil Liberties has warned against steps taken in the direction of developing a large-scale private surveillance system that can be accessed by authorities.

The Office of the Privacy Commissioner’s (OPC) report acknowledged: “A suggestion posed by the evaluation is whether the retail sector should develop a more centralised system, including a centralised offender dataset or watchlist.”

It said: “The suggestion is that this may potentially improve the effectiveness of retail use of facial recognition technology.”

However, the OPC said: “Taking this step would require closer regulatory monitoring and oversight.”

“You are not allowed to be anonymous in public any more. You are always going to be identified and tracked,” Beagle has previously said, calling for the use of facial recognition technology for surveillance to be banned, or at least heavily regulated, to preserve New Zealanders’ freedom to be anonymous.

It was not only in private retail stores and their car parks that camera recognition technology was being used. Beagle pointed to Auckland Transport’s licence plate recognition system, that could be accessed by police.

It was also used in airports by the Customs Service and SkyCity’s casinos.

Police did not currently use “live” facial recognition, but used facial recognition on CCTV footage supplied to it after crimes had taken place. However, police indicated last year that “further decisions about Police use of live FRT will not be made until the security, privacy, legal, and ethical perspectives are fully understood, and affected communities are consulted”, the report said.

Beagle said it was useful to authorities to have systems that could track people’s movements.

The Privacy Commissioner noted that facial recognition technology could be used to monitor large groups of people in real time, and some groups were already “over-monitored”, including Māori.

The Privacy Commission’s report into the Foodstuffs trial warned retailers against over-stepping reasonable uses of facial recognition, including enforcing trespass notices for minor crimes and “difficult” behaviour, which could see individuals excluded from supermarkets, which restricted their access to “essential services”.

“Facial recognition technology is an inherently invasive tool that should be reserved for serious retail crime behaviour, such as offences involving violence, aggression, intimidation or high value theft,” the report said.

“Looking to the future, we do not consider that it would be appropriate to use facial recognition technology to manage lower level criminal behaviour such as minor shoplifting, or against people who are perceived as ‘difficult’,” it said.

The report made it clear that retailers and other businesses who used facial recognition technology needed to be ready to justify their use of it.

The Privacy Commissioner’s report said data gathered by Foodstuffs with facial recognition technology was not automatically uploaded to the Auror crime detection system, which many retailers use to share intelligence and report on retail crime. Uploads had to be done by Foodstuffs’ staff.

The report said when there was not a 92.5% match of the face of a customer entering a store as a “person of interest”, their image was immediately deleted from Foodstuffs’ system. Before the trial, Foodstuffs intended to store all images for five days but it was dissuaded from doing so by the OPC.

It also initially intended to use the system to target behaviour that was merely “disruptive” rather than really harmful.

In preparing its report, the OPC heard reports from all 25 stores involved in the trial of extreme violence and threats from members of the public directed at staff.

These included physical attacks on staff causing serious injuries and hospitalisations, including punching and kicking and attacks with weapons including baseball bats, screwdrivers, store trolleys and iron bars.

There was also verbal abuse of staff, including racial abuse and death threats, often particularly directed at checkout staff.

The trial resulted in an estimated reduction in the incidence of serious harmful behaviours of 16%, a reduction in serious harm incidents of 19 a month across the 25 stores, and an estimated reduction in shoplifting of 21%, the OPC report said.

The evaluation found a 54% increase in the detection of breaches of trespass notices.

It was inevitable that errors would occur, and some people would be misidentified as a “person of interest”, a term often used by police.

That was particularly true as there was “currently no specific training data set for the New Zealand population”, the report said.

Things like poor lighting, and low-quality cameras could result in more mis-identifications.

One misidentification incident during the trial occurred in April 2024 when a Māori woman was mistakenly identified as a thief at New World Westend in Rotorua, causing her distress.