Legislative Council: Tuesday, July 05, 2022


Facial Recognition Technology

The Hon. S.G. WADE (15:13): I seek leave to make a brief explanation before asking questions of the Attorney-General regarding facial recognition technology.

Leave granted.

The Hon. S.G. WADE: It has recently been reported that major Australian retailers Kmart, Bunnings and The Good Guys have been using facial recognition technology on their patrons, including children, in some of their stores, mostly without the customers' knowledge. The technology in question captures and stores the biometric information of individuals, commonly known as a faceprint. A survey has found that 76 per cent of respondents were unaware that facial recognition technology was being used by retailers, with 76 per cent expressing concern regarding the secure storage of faceprint data.

A motion was recently passed unanimously by the Adelaide City Council outlining its commitment to refrain from using facial recognition technology until this parliament considers how biometric surveillance should be regulated. My questions to the Attorney-General are:

1. Is the Attorney-General aware of whether retailers are using facial recognition technology in any of their South Australian stores and, if so, precisely how it is being used?

2. Has the Attorney-General commenced consultation with a view to developing state legislation that regulates the use of facial recognition technology in South Australia?

3. Will the Attorney-General endeavour to ensure this technology is not used in the retail sector in South Australia until sufficient safeguards are in place to protect the privacy and civil liberties of South Australians?

The Hon. K.J. MAHER (Attorney-General, Minister for Aboriginal Affairs, Minister for Industrial Relations and Public Sector) (15:15): I thank the honourable member for his question, it is certainly one that has garnered significant public attention over the last few weeks. I might first address the question of the Adelaide City Council and the potential police use of the Adelaide City Council's new CCTV technology that I think was the catalyst that gave rise to much of the public debate recently.

I am informed that any use that would be made by someone like the police would be subject to Premier and Cabinet Circular 12, known as the Information Privacy Principles Instruction, which requires that use, including by SAPOL, of personal information access would likely fall into section 8 of that Information Privacy Principles Instruction, which states:

Personal information should not be used by an agency for a purpose that is not the purpose of collection or a purpose incidental to or connected with that purpose (the secondary purpose) unless…the agency has reason to suspect that unlawful activity has been, is being or may be engaged in, and discloses the personal information as a necessary part of its investigation of the matter or in reporting its concerns to relevant persons or authorities

In addition, the use of listening and optical surveillance devices—which would almost certainly include CCTV cameras—is regulated by the Surveillance Devices Act 2016. I am advised that the Surveillance Devices Act currently provides a framework for when listening devices, optical surveillance devices, tracking devices and data surveillance devices can be used, and there are penalties for breaches of that act.

I am advised that the Surveillance Devices Act predominantly applies to private activities and conversations and does not typically apply to activities that occur in public places; however, it may be that some of the provisions of the Surveillance Devices Act are relevant to these situations, particularly those that relate to the use or communication of information derived from a listening or surveillance device.

I have been informed, upon request, that there is national work currently underway in relation to the specific use of facial recognition technology, and I am awaiting a briefing on where that national work is up to and what the likely results are.