On 4 June, New Zealand's Office of the Privacy Commissioner released its much-anticipated inquiry report on Foodstuffs North Island's facial recognition trial. Overall, the OPC found the use of FRT during the trial was effective at reducing harmful behavior, but that this is "not a green light" for the grocery or wider retail sector. While the OPC does not expect every organization to run a trial the way Foodstuffs has, those contemplating FRT will still need to show necessity, proportionality and robust end‑to‑end safeguards.
In the report, the OPC acknowledged that Foodstuffs designed in several important privacy safeguards that helped it stay on the right side of the law. For example, images that did not match the store‑specific watchlist were purged almost instantly, which significantly reduced the privacy impact on most people who entered the stores. The system was set up to only identify people who had engaged in seriously harmful behavior and there was no sharing of watchlist information between stores. During the trial, the operational threshold that triggered an FRT alert was raised from 90% to a 92.5% match, reducing the likelihood of false matches and several image access and use limitations were implemented.
However, the OPC also noted that, while the trial complied with the Privacy Act overall, further improvements were needed before permanent roll-out or wider adoption. These included baking the 92.5 %, or higher, matching threshold into the algorithm; keeping watchlist criteria fixed on genuinely harmful conduct; refreshing the privacy impact assessment to mirror real-world practice; and committing to continuous review, recognizing that crime trends, laws and technology shift over time. Finally, the OPC reminded Foodstuffs that it should not rely solely on FRT but would still need to maintain other techniques for managing safety in stores.
It is interesting to note that the OPC's findings differed in some material ways to the findings of the Office of the Australian Information Commissioner in its 2024determination on the use of FRT by Bunnings. Most notably, while the OAIC found that the temporary capture of FRT images about all customers who entered the store was neither necessary nor proportionate, the OPC accepted this collection, focusing instead on the deletion of nonmatched images within 59 seconds, which it considered a privacy protective measure. Further, while the OAIC found Bunnings required consent to collect sensitive biometric information, the OPC did not, noting that the NZ Privacy Act is purpose-driven not consent-driven.
While the OPC's report provides clarity on the use of FRT, some uncertainties remain. As part of the inquiry, the OPC asked its Māori Reference Panel for its views on the use of FRT in supermarkets. The panel did not support its use in an essential‑services context, noting that it risked normalizing blanket surveillance and could disproportionately harm Māori customers. The OPC believes it would be highly desirable to explore options for ensuring New Zealand businesses have access to FRT software products that are evidently suitable for our population and supports opportunities for consent-based research that helps ensure that FRT is fit for New Zealand conditions.
Keep an eye out for an invitation to our upcoming virtual KnowledgeNet event on the implications of the OPC's inquiry report, in which a panel of experts will discuss the findings from privacy, consumer, Māori and retailer perspectives.
Daimhin Warner, CIPP/E, is the country leader, New Zealand, for the IAPP.
This article originally appeared in the Asia-Pacific Dashboard Digest, a free weekly IAPP newsletter. Subscriptions to this and other IAPP newsletters can be found here.
