A report from Privacy Commissioner has found that Foodstuffs North Island’s trial of live facial recognition technology (FRT) in selected supermarkets complied with the Privacy Act but raised “serious social and cultural” concerns.
The six-month trial, conducted in 2024, was aimed at reducing serious retail crimes such as violent assaults and high-value theft. The system used real-time scanning of customers’ faces against a limited watchlist of known offenders, with most images deleted instantly if no match was detected. Independent evaluations confirmed the system’s effectiveness, particularly when safeguards were tightened after two misidentification incidents.
Despite the trial’s legal compliance, the report warned of broader implications. The Privacy Commissioner highlighted the potential for FRT to entrench surveillance culture, disproportionately impact Māori and other vulnerable groups, and risk misidentification due to existing algorithmic biases. Māori concerns were especially pronounced, with fears of cultural harm and over-monitoring of indigenous communities. The Commissioner’s Māori Reference Panel opposed FRT in supermarkets, citing its role as an essential service and the risk of widespread monitoring of the general public to target a small number of offenders.
The inquiry also found that Foodstuffs’ implementation showed strong privacy design, including strict image deletion policies, separate store-based watchlists, and limitations on who could be added. Still, the report recommended raising the match threshold from 90 per cent to 92.5 per cent or higher and refining criteria for adding individuals to watchlists. It cautioned against extending FRT use to lower-level offences or relying on it as a standalone security measure, urging continued human oversight and engagement with police and community stakeholders.
While not a green light for widespread rollout, the report serves as a precedent for how biometric surveillance may be responsibly tested in retail settings. Other businesses considering FRT are advised to rigorously assess privacy impacts and avoid undermining public trust.
The Privacy Commissioner will continue to monitor deployments and may issue enforcement actions if the technology is misused.
This article was originally published by the Daily Telegraph New Zealand.
