OAIC Publishes Updated Guidance on Facial Recognition Technology for Australia
By: Cameron Abbott, Rob Pulham, and Emre Cakmakcioglu
The Office of the Australian Information Commissioner (OAIC) has published updated guidance for entities considering using facial recognition technology (FRT) in high-volume, publicly accessible physical spaces, like retail shopfronts.
The updated guidance incorporates the findings of the Administrative Review Tribunal regarding Bunnings’ use of FRT in its stores (see our earlier blog), and clarifies exceptions to the consent requirement to collecting sensitive biometric information.
The OAIC noted that the Bunnings decision “confirmed that there is a high bar for using facial recognition technology in Australia”, with the regulator signaling that its appetite in this space has not decreased. The timing of this guidance is particularly notable, given recent announcements of FRT being deployed in Australia instead of digital or paper tickets for live events, as well as the impending glut of AI “smart glasses”.
The guidance emphases 5 key principles for ensuring your organisation’s FRT deployment is compliant:
- Governance and Ongoing Assurance (APP 1): Clear governance arrangements in place, including privacy risk management practices and policies (including privacy impact assessments) that are documented and regularly reviewed.
- Lawful Basis for Collection (APP 3): Only collecting biometric information with valid consent, and only where collection is reasonably necessary and proportionate. Where consent is not relied upon, carefully consider whether a narrow exception applies.
- Transparency and Notification (APP 5): Regardless of the collection pathway, taking reasonable steps to notify individuals about the collection of their personal information.
- Accuracy, Bias and Discrimination (APP 10): Ensuring biometric information used in FRT is accurate and actively addressing any risk of bias or discriminatory outcomes.
- Security of Personal Information (APP 11): Even where personal information is held only briefly, taking reasonable steps to protect it from misuse, interference, loss, and unauthorised access, and destroying or de-identifying it once no longer needed.