Privacy lessons for Victorian government agencies from the Bunnings decision

The Administrative Review Tribunal’s decision on Bunnings’ use of Facial Recognition Technology (FRT) in February this year may have gone under the radar for government lawyers given the affected organisation was a retail giant and the scenario appeared unrelated to the day-to-day activities of a Victorian government agency.

However, the decision contains important lessons for Victorian public sector organisations that collect sensitive or delicate information, particularly where new technologies are involved or obtaining explicit consent may not be practicable.

While the decision was considered under the Commonwealth Privacy Act and the Australian Privacy Principles (APPs), the Tribunal’s findings regarding transparency, governance and notification obligations are also relevant to Victorian public sector organisations subject to the Privacy and Data Protection Act 2014 (Vic) (PDP Act) and the Information Privacy Principles (IPPs).

The Tribunal upheld the finding that Bunnings breached APPs 1.2, 1.3 and 5.1, which relate to privacy governance and its notification obligations. Similar obligations may apply to Victorian public sector organisations under IPPs 1 and 5, which relate to collection and openness.

But first, what is different?

Privacy laws around Australia define personal information and sensitive information differently. Under the Commonwealth Privacy Act, for example, biometric information (including biometric templates) is considered sensitive information and is subject to stronger protections for collection and use than personal information. Much of the debate around the Bunnings decision related to this point.

For the Victorian public sector, however, the PDP Act does not explicitly include biometric information in its definition of sensitive information. Even so, some biometric characteristics, such as facial biometrics, may reveal sensitive information (as defined under the PDP Act), including information about a person’s racial or ethnic origin. The stronger protections given to biometric data in other jurisdictions may also shape community expectations about how that data should be handled in Victoria. For that reason, it is best practice to treat biometric information as ‘delicate’ information under the IPPs.

Key lessons for Victorian government agencies

Bunnings’ failure in implementing and using the FRT system was that it was not sufficiently transparent about how the system operated. Agencies may similarly assume that, because the collection, use and disclosure of personal information is authorised by law, such as by a secrecy provision, they have met their privacy law obligations. In doing so, they risk overlooking further requirements to provide clear notice, maintain appropriate governance frameworks and be transparent with individuals.

When implementing new technologies or projects that involve the collection, use and disclosure of personal or protected information, government agencies should consider whether they have appropriate governance and compliance measures in place, whether their privacy policies contain relevant information, and whether individuals are receiving adequate notice about how their information is being collected and used.

Victorian government agencies that are considering collecting, using or disclosing personal or protected information should bear in the mind the following:

• IPP 1.1 requires organisations to collect only the personal information necessary for one or more of their functions or activities. Agencies should specifically consider this requirement when collecting information using new technologies
• IPP 1.2 requires organisations to collect information only by lawful and fair means, and not in an unreasonably intrusive way. Collecting information or monitoring individuals without notice, consent or knowledge may be unfair in some circumstances
• agencies implementing new technology to collect, use or disclose personal information should consider undertaking a Privacy Impact Assessment (PIA) to identify and manage privacy risks. A PIA can help clearly define the purpose of collecting information through the new technology and ensure any intrusive activities, such as surveillance, are limited in scope and duration. As in Bunnings, it is especially important to identify a legitimate need that justifies using an intrusive option.
• agencies should consider whether the privacy interests of individuals, including third parties, may be affected by the proposed activity and put in place appropriate oversight and accountability mechanisms to deter and detect any misuse.
• if an agency is implementing surveillance, it needs to consider the likelihood of incidentally collecting third parties’ personal information, as well as its obligations under the Charter of Human Rights and Responsibilities Act 2006 (Vic), which requires organisations to consider whether a collection practice affects other rights, and if so, to what extent.
• IPP 1.3 requires organisations to take reasonable steps to make individuals aware of:
  • the identity of the organisation and how to contact it
  • the fact that they may access that information
  • the purposes for which the information is, or was, collected
  • the names (or types) of organisations or individuals to whom the information is usually disclosed
  • any law requiring the collection
  • the main consequences (if any) if the person does not provide any or part of the information. 

Steps to strengthen privacy compliance

Review governance and internal controls

The Commissioner found that Bunnings had systemic failures in its practices, procedures and systems for ensuring compliance with the APPs, breaching APP 1.2. For example, Bunnings did not conduct a privacy impact assessment (PIA) before implementing the FRT system, nor did it adequately document its privacy governance framework.

Alongside PIAs, Victorian government agencies should also consider whether a specific project requires updates to other parts of their privacy governance framework, such as internal security practices or data breach response procedures.

Include relevant information in privacy policy

Although Bunnings updated its privacy policies after introducing FRT, the Commissioner considered those updates insufficient because they did not mention biometric information or the use of FRT, as required by APPs 1.4(a) and 1.4(b). The lesson for government agencies is to be as specific as possible, especially where sensitive or delicate information is being collected, or where the technology used to collect that information could be seen as intrusive or novel.

Explain collection practices clearly

Bunnings was found to have breached APP 5.1 by failing to adequately notify individuals about the collection of their biometric data. While signage and privacy policies were in place, they did not sufficiently communicate the use of FRT, the purposes for collection or the consequences of refusing to provide biometric data. The decision referenced APPs 5.2(b), 5.2(d) and 5.2(e), highlighting the need for clear, accessible and transparent communication.

Interestingly, if Bunnings had provided adequate notice under APPs 1 and 5, it may have been able to demonstrate compliance with APP 3, on the basis that consent could have been inferred.

Further considerations

The decision also highlights several other practical considerations for Victorian government agencies collecting sensitive information (such as biometric information), including:

• consider the recent guidance issued by the OAIC on FRT, which notes that a precautionary approach to deploying FRT is required under Australian law and that a case-by-case assessment is always recommended
• use appropriate signage at or immediately before collection to notify individuals about the specific technology in use, including by displaying materials that would readily be seen by individuals. In Bunnings’ case, the Tribunal did not accept that it was impracticable for the retailer to provide notice about FRT
• refer specifically to the use of the technology in notifications and privacy policies, and avoid vague wording such as “we may use FRT to collect your data” if FRT is in fact being used to collect individuals’ sensitive or delicate information
• avoid relying on generalised notification of the method of collection, which may not support an inference that a more specific system is being used, particularly where the technology is relatively novel.

If you have questions about the decision or need assistance with a Victorian Government privacy project, including conducting a privacy impact assessment, reviewing collection notices or assessing the use of emerging technologies, please get in touch with us.

Disclaimer
The information in this article is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information, we do not guarantee that the information in this article is accurate at the date it is received or that it will continue to be accurate in the future.

Published by:

Emily Booth

Share this