7-Eleven Australia has destroyed facial images it collected via an in-store tablet used by customers to rate their service experience, and disabled the data collection on an ongoing basis following a privacy investigation.

The convenience store chain deployed the tablets in June 2020 along with some vague disclosure signs in its windows, immediately raising concerns about its collection and use of the identifying images.

The retailer said at the time that it used biometric capture to ensure that feedback left about a store was genuine and not entered multiple times by a single person.

“[7-Eleven’s] purpose for capturing facial images and generating faceprints was to detect if the same person was leaving multiple responses to the survey within a 20 hour period on the same tablet,” the OAIC said in its determination. [pdf]

“If they were, their responses may not have been genuine, and were excluded from the survey results. 

“It also enabled the respondent to have a broad understanding of the demographic profile of customers who completed the survey.”

However, following an investigation by the Office of the Australian Information Commissioner (OAIC), 7-Eleven said it would pull the plug on the facial recognition capture and destroy the facial data it had already collected.

Across its network of 700 stores, the tablets with built-in cameras captured 1.6 million surveys in the first 10 months of use.

Facial image data collected by the tablets was stored on third-party servers for a week before it was deleted. 

7-Eleven unsuccessfully argued that facial images and faceprints - algorithmic representations of a customer’s face - “are not personal information because they are not used to identify, monitor or track any individual”.

The retailer also argued that they did not try to match the facial data with any other customer information, and that the few people permitted to access the image data didn’t have enough information to identify someone, if they wanted to.

Australian information commissioner and privacy commissioner Angelene Falk overruled 7-Eleven on both arguments. 

She also sought assurances from the company that all faceprints had been deleted, in addition to facial images.

Falk warned organisations to “carefully consider whether they need to collect ... sensitive personal information, and whether the privacy impacts are proportional to achieving the entity’s legitimate functions or activities.”

Her investigation found that “individuals did not give either express or implied consent to the collection of their facial images or faceprints, nor did 7-Eleven take reasonable steps to notify individuals of the collection of personal information.”

She also concluded that biometric data “was not reasonably necessary for the purpose of understanding and improving customers’ in-store experience.”