Office of the Privacy Commissioner (NZ) — Foodstuffs North Island Ltd

Decided by

Office of the Privacy Commissioner

Parties

Office of the Privacy Commissioner v. Foodstuffs North Island

Decision date

June 4, 2025

Remedy

Foodstuffs North Island must implement required improvements, including updating documented processes, conducting ongoing reviews, and monitoring skin tone identification accuracy, before making facial recognition technology permanent or expanding it to more stores.

Appeal

Appeal status not stated

Key holdings

1. The Privacy Commissioner determined that the trial model of live facial recognition technology operated by Foodstuffs North Island complied with the Privacy Act.

   “Privacy Commissioner Michael Webster has found that the live facial recognition technology model trialled by Foodstuffs North Island is compliant with the Privacy Act.”

2. Although the live facial recognition trial involved a high level of privacy intrusion, implemented privacy safeguards reduced the intrusion to an acceptable level.

   “The Inquiry found while the level of privacy intrusion was high because every visitor’s face is collected, the privacy safeguards used in the trial reduced it to an acceptable level.”

3. Foodstuffs North Island must make process and system improvements before making the technology permanent or expanding it to additional stores.

   “Some improvements will also need to be made by FSNI before the use of FRT is made permanent or expanded to more stores.”

In plain English

The Privacy Commissioner of New Zealand conducted an inquiry into a trial of live facial recognition technology used by Foodstuffs North Island across 25 supermarkets. The trial ran from 8 February to 7 September 2024 to evaluate whether the technology was effective at reducing serious retail crime and to examine its compliance with the Privacy Act. During the trial, 225,972,004 faces were scanned, and 99.999% of images that did not produce a match were deleted immediately within one minute. The system generated 1742 alerts, of which 1208 were confirmed matches. The Privacy Commissioner found that the trial model was compliant with the Privacy Act because the privacy safeguards implemented reduced the high level of privacy intrusion to an acceptable level. These safeguards included restricting access to trained staff, verifying match alerts with two trained personnel, raising the operational match alert threshold from 90% to 92.5%, and prohibiting the addition of children under 18 to the watchlist. Despite finding compliance during the trial, the Commissioner required Foodstuffs North Island to make several improvements before making the technology permanent or expanding it to more stores. These include updating documented processes, conducting ongoing reviews, and monitoring the impact of skin tone on identification accuracy to address potential technical bias. This outcome highlights how businesses attempting to use facial recognition technology in essential public spaces must balance safety benefits against significant privacy risks.