If the privacy watchdog doubles down on a proposed biometrics code of practice, Westfield shopping malls will likely be banned from using smart billboards that scan shoppers’ faces in order to target them with personalised advertising.

This type of targeted marketing, based on collecting images of people’s faces, fingerprints, voices, gaits and other biometric information, may be stopped by the Privacy Commissioner because it poses too many risks or uses sensitive personal information inappropriately.

Westfield malls in Auckland and Christchurch made headlines earlier this year when it was revealed they were using “SmartScreens” equipped with cameras that conduct AI-powered facial detection on passers-by. The digital billboards can determine an individual’s age, gender and mood while shopping in order to target advertising.

Such use has been earmarked for prohibition by the Office of the Privacy Commissioner (OPC), which has just finished a round of consultation on its proposed biometrics code with a limited set of stakeholders on whether the proposals could work effectively in safeguarding biometric information.

“Capturing facial images for the purpose of categorising individuals on the basis of their age, gender and mood is a collection of biometric information covered by the code proposals. However, this collection would not be allowed under the code proposals,” the OPC states in its discussion document.

Risks outweigh benefits

Concern has been mounting about the use of biometric technologies that recognise individuals based on their unique physical or behavioural characteristics – personal information of the most sensitive nature. Biometric information is personal information for the purposes of the Privacy Act 2020 because it helps identify and verify individuals.

The OPC wants the code to apply to all agencies – domestic and overseas, public and private – that collect and hold biometric information, which is compared and analysed only against algorithms or “automated processes”. A case exists for ruling out certain purposes for collection altogether because of the sensitivity of biometric information and the potential for its misuse, the OPC says.

The Act has 13 privacy principles governing how businesses and organisations should collect, handle and use personal information. Information privacy principle (IPP) 1 states an agency must collect personal information only if its collection is necessary for a lawful purpose connected with the agency’s functions or activities.

IPP 1 could be modified so that biometric information covered by the code must not be collected for marketing that is targeted to individuals using their biometric information. Moreover, collection would be prohibited on the grounds that it categorises individuals based on age or gender (categories that correspond to prohibited grounds of discrimination under s 21 of the Human Rights Act 1993) or infers an individual’s emotional state.

“We consider that the individual and social benefits of marketing products and services based on biometric characteristics do not outweigh the significant privacy intrusion of collecting and using such sensitive personal information. ‘Marketing’ would need to be defined, and there might be a case for allowing some types of marketing, such as for public-interest marketing campaigns,” the OPC says.

“OPC’s initial view is that collection for these purposes will rarely be justified, so only limited, compelling, public-benefit exceptions would be appropriate.” While the OPC has stressed no decision has been made to formally consult or issue a draft code, the regulator has signalled a decision will be made “later in 2023”. A final biometrics code wouldn’t be issued until “sometime in 2024”.

Passive collection

AI-powered advertising hit New Zealand malls a few months ago when it was revealed Westfield’s parent company, Australianowned Scentre Group, had recently installed SmartScreen billboards in all five of its retail malls in New Zealand: the Auckland suburbs of Albany, Manukau City, Newmarket and St Lukes, and Christchurch’s Riccarton.

Scentre Group’s website states the SmartScreen network of more than 1,650 screens “redefines what a retail marketing network can be” across 42 of its trans-Tasman Westfield malls. “The SmartScreen network gives brands and retailers an entirely new way to reach, engage and convert shoppers. Every single screen offers a powerful point of connection to the large and valuable retail audience,” it says, adding the “sophisticated” media solution offers brands “enhanced targeting capabilities”.

LawNews put a series of questions to Scentre Group in relation to its position on the proposed biometrics code, whether it would pause its use of SmartScreens until the regulatory environment became clearer and whether it would cease using the digital billboards if the proposed prohibition on targeted marketing were implemented. Scentre Group has yet to respond.

Scentre Group’s privacy policy states it may collect information from shoppers “passively using in-centre technologies such as SmartScreen advertising units, which utilise image-processing software to aggregate data such as shopper numbers and demographics. These technologies do not identify individual shoppers or record or retain images of individual shoppers.”

‘Ridiculous’

However, it’s likely most shoppers will not have read and understood the mall owner’s privacy policy, meaning their biometric data is likely being gathered without their knowledge. “The presumption that a shopper will have gone online, read and understood a mall’s privacy policy and consented to it before entering a public space like a mall is ridiculous,” says Consumer NZ chief executive Jon Duffy.

“It’s not ok to bury what you’re doing in some far-flung corner of the internet and call that disclosure. These companies need to do a better job of informing the public about their data collection and use.”

Auckland University associate professor Gehan Gunasekara, who co-founded the Privacy Foundation New Zealand, says Scentre Group’s use of SmartScreens is at the lower end of the spectrum of potential harm. “[But] this is the thin edge of the wedge. People might start to accept this kind of thing, but then the next thing is that you might be offered health products on the basis of the way you walk, or physical characteristics that suggest you have some kind of disease.”

Responding to Consumer NZ’s concerns, OPC said that “simply on ethical, trust and confidence grounds”, Scentre Group should inform customers it is targeting advertising based on real-time facial detection analysis of mall-goers. “This would allow customers the opportunity to make an informed choice about whether they wanted to be targeted in this way.”

Cut-through

The digital billboards were designed and developed in 2014 for Scentre Group’s BrandSpace division, which offers retailers and brands a range of marketing platforms to connect with a large customer audience, amounting to more than 535 million visits a year. French company Quividi, whose software is said to capture the biometrics of more than 1.5 billion people a month worldwide, helped with design and development.

Quividi says its technology relies not on facial recognition technology, which can recognise and identify individuals, but on facial detection instead, which determines only if an anonymous individual is looking at a given point of interest, the time they stayed engaged and an estimation of their basic demographic features.

The billboards can yield higher engagement and cut-through. Optus, Australia’s second-largest telecommunications group, tested Quividi’s platform across Westfield’s shopping malls in Australia by presenting shoppers with Samsung’s Galaxy S10 smartphone advertisements.

Messages were tailored to men and women of different ages – women aged 44 and under were shown the slogan “With enough data for your insta-habit” while those over 45 were told they would have enough data to “shop till you drop”.

The targeted messages had nearly two-thirds more watchers per play than the network benchmark, were almost one-third more efficient at reaching the target audience and the average attention time increased by 29% – all with the purpose of converting attention into greater sales.

“We can place brands where they can influence, engage and convert real humans who are ready to spend right now,” said BrandSpace sales group manager Lauren Mullane in a video explainer. Any final code will not simply provide guidance as it will be legally effective against the information, agencies, activities or sectors that it covers. Any breaches of the code have the same effect as a breach of the Privacy Act. Individuals can complain to the commissioner about breaches of the code and the commissioner can use compliance powers under the Act to enforce the code. ■