An investigation into 7-Eleven’s use of facial recognition technology (FRT) has now been closed by the Office of the Australian Information Commissioner (OAIC).
The global convenience store chain — with over 700 stores in Australia — promised it would not repeat its 2021 breaches of the Privacy Act, which captured 1.6 million faces on tablets for customers to record feedback on their in-store experience.
But the controversial technology within the customer survey tablets was activated again in stores throughout 2023, and captured an additional 45,874 faces.
Know the news with the 7NEWS app: Download today
The tablets and the FRT technology were used in 700 stores across Victoria, New South Wales, ACT, Queensland and Western Australia, during the 2021 breaches, and in 54 stores during the 2023 breach.
But the Commissioner said on Friday that it is now “satisfied” that 7-Eleven has brought in the procedures and practices to ensure the privacy breaches will not happen a third time.
The second activation of the FRT was “inadvertent” and the “result of an automatic setting in new devices deployed across the impacted stores,” the OAIC found.
The technology was reactivated by the third-party supplier of the tool, and the functionality was active for about a year until April 2023, when 7-Eleven voluntarily notified the Commissioner about the issue.
Both the store and the third-party supplier were unaware facial images were being recorded during this time, according to the OAIC.
How and why was 7-Eleven using FRT?
The facial images being collected by the customer feedback surveys were being used to “detect if the same person was leaving multiple responses to the survey within a 20-hour period on the same tablet,” an OAIC report investigating the 2021 breaches said.
“If they were, their responses may not have been genuine, and were excluded from the survey results.”
It also offered ”a broad understanding of the demographic profile of customers who completed the survey,” the report said.
Those pictures were held on the tablet for 20 seconds and then uploaded to a secure server hosted in Australia for a seven-day period.
From there, the facial images were then sent to the third party service supplier of the tool, which used a program to turn the facial images to “an encrypted algorithmic representation of the face (face print)“ in the form of a string of characters.
That program also “assessed and recorded information about the customer’s approximate age and gender.”
“Only a small number of the Service Provider’s software engineers could view the ‘raw’ unblurred facial images,” OAIC acknowledged in the report.
Signage was put up in stores alerting customers of the FRT, but the OAIC found it was insufficient and “created an erroneous impression that (7-Eleven) captured customers’ images using facial recognition CCTV for the purpose of store surveillance.”
Privacy processes now in place
Following the reporting of the 2023 reactivation, and the OAIC investigation, the OAIC said sufficient actions were taken to remedy the privacy breach.
“Upon discovery of the incident, 7-Eleven promptly directed its service provider to delete all facial images that had been captured (to the extent any were retained) and received confirmation that this has occurred,” OAIC said.
“Shortly after the discovery of the incident, 7-Eleven and its service provider implemented a new feature which disabled the FRT functionality on a company level, which overrides individual device settings, for all 7-Eleven stores, as well as a mechanism to scan all 7-Eleven devices hourly to ensure that FRT is disabled.”
But the OAIC said it is still “concerned about the proliferation of FRT” more widely.
“The use of this technology continues to be a regulatory priority for the agency,” it said.
“Entities should ensure that they embed privacy into each new planned use of FRT at the outset and implement iterative testing of the robustness of their privacy protections.”