Tech and human rights experts have renewed calls for a national framework on the use of facial recognition technology, as one described it as the "wild west of the digital world".
It's technology Australians use every day when unlocking their smartphones, but might not realise is in places they don't expect.
Yesterday, that was thrust into the spotlight when it was revealed major retail chains Bunnings, The Good Guys and Kmart were using facial recognition on customers.
An investigation by CHOICE found the companies were "capturing the biometric data of their customers", and 76 per cent of shoppers did not know the technology was used in Australian stores.
Bunnings' chief operating officer Simon McDowell said signs informing customers of the software's use were located at entrances, saying it to identify "persons of interest" and keep stores safe.
Peter Lewis, from the Australia Institute's Centre for Responsible Technology, says some retailers might have good intentions in using the technology, but it raises concerns nonetheless.
"What we do know is that this technology is the wild west of the digital world," he said.
"We know that there are companies that take these images and repackage them and sell them to governments, to other businesses.
"It's even being used in the war in Ukraine."
He called on the federal government to adopt the Human Rights Commission's 2021 recommendation for a moratorium on using facial recognition technology in "high-risk circumstances" until more safeguards are in place.
Edward Santow, a University of Technology Sydney professor and former Human Rights Commissioner, said moratoriums were already in place in some jurisdictions around the world.
That includes San Francisco, where there is a ban on police and city agencies from using facial recognition technology.
In Australia, there is no dedicated law surrounding the use of facial recognition but some protections do exist under privacy laws.
But going forward Mr Santow says Australia should be following the lead of the European Union (EU) in taking a "more nuanced approach" to how the technology can be used.
A draft EU bill would prohibit "harmful" use of the technology and increase privacy protections while allowing low-risk use.
"There are huge gaps in [Australia's] law, particularly about how it might protect against mass surveillance and error," Mr Santow said.
"There are some very legitimate uses for [facial recognition] and they should be encouraged.
"But we need to set red lines about the most harmful uses."
There are three broad types of facial recognition technology, which have differing degrees of accuracy.
The first is facial verification, which Mr Santow said is the "least sophisticated" and the type used on smartphones.
Next is facial identification, a "much more complicated" form that might be used to identify people in crowds and is "prone to error".
Facial analysis is the "most experimental" form and often equates to "junk science", according to Mr Santow.
It attempts to judge factors like the mood, age, sex and behaviour of a person based on their face and expressions.
Mr Santow said that form was "really dangerous" because it can give people — like law enforcement — a false sense of confidence.
Studies have also shown a drop in accuracy for facial recognition software when it comes to people of colour and women.
He raised an example overseas where facial recognition technology used by London's Metropolitan Police wrongly identified 96 per cent of people scanned as suspects, which was revealed in 2019.
The Office of the Australian Information Commissioner (OAIC) found in 2021 that New York-based Clearview AI had breached privacy by scraping Australians' biometric information from the internet and disclosing it through a facial recognition tool.
Clearview AI obtained the data without consent and did not take reasonable steps to notify those whose data was scraped.
The OAIC also found the Australian Federal Police failed to comply with its privacy obligations by using Clearview AI's tool on a trial basis between November 2019 and January 2020.
As for how widespread the use of facial recognition technology is in Australia, Mr Santow says "the short answer is we don't know".
He said the Choice's investigation "unmasks" some of the uses in the country, and that consent is one of the most pressing issues.
"One of the things I was pushing [as Human Rights Commissioner] is there should be greater transparency about how facial recognition is used," he said.
"There's a world of difference between some sort of fine print ... and actually having a meaningful exchange with an individual [so] they have the opportunity to opt out."
