Office of the Australian Information Commissioner (OAIC) — 7-Eleven Stores Pty Ltd

Decided by

Office of the Australian Information Commissioner

Parties

Office of the Australian Information Commissioner v. 7-Eleven Stores Pty Ltd

Decision date

October 14, 2021

Remedy

7-Eleven was ordered to destroy all faceprints collected through its customer feedback mechanism, having already ceased collecting facial images and destroyed existing facial images.

Appeal

Appeal status not stated

Key holdings

1. 7-Eleven interfered with customer privacy by collecting sensitive biometric information without consent or adequate notice.

   “convenience store group 7-Eleven interfered with customers’ privacy by collecting sensitive biometric information that was not reasonably necessary for its functions and without adequate notice or consent.”

2. The large-scale collection of biometric information was not reasonably necessary for understanding and improving customer experience.

   “large-scale collection of sensitive biometric information through 7-Eleven’s customer feedback mechanism was not reasonably necessary for the purpose of understanding and improving customers’ in-store experience.”

3. The Australian Information Commissioner ordered 7-Eleven to destroy all collected faceprints.

   “Commissioner Falk has ordered that 7-Eleven also destroy all the faceprints it collected.”

In plain English

Australian Information Commissioner and Privacy Commissioner Angelene Falk determined following an investigation by the Office of the Australian Information Commissioner that convenience store chain 7-Eleven interfered with customers privacy. Between June 2020 and August 2021, 7-Eleven installed tablets with built-in cameras across 700 stores to conduct customer surveys. Customers completed 1.6 million surveys within the first 10 months. The cameras captured facial images to generate facial representations or faceprints to screen responses and assess customer demographics. Commissioner Falk found these facial images and faceprints constituted sensitive biometric information protected under the Privacy Act 1988. The collection was deemed not reasonably necessary for understanding customer experience, violating Australian Privacy Principle 3.3. Furthermore, 7-Eleven failed to obtain express or implied consent and did not take reasonable steps to notify individuals about the collection, violating Australian Privacy Principle 5.1. In response, 7-Eleven stopped collecting facial images, destroyed existing facial images, and Commissioner Falk ordered the company to destroy all collected faceprints.