Privacy Information

The Loss Prevention Register is a private, internal web application operated by this retail business. It is used by authorised staff and managers to document and manage incidents that occur on the shop floor for legitimate loss prevention purposes.

This system also operates CCTV cameras fitted with facial recognition technology at this location — see "Facial recognition and camera use" below for a full explanation of how that works.

This system is not accessible to the public without staff credentials. It is not connected to any government or law enforcement database. It uses cloud services to operate and monitor the application, as described below.

The system may record the following information in relation to a person who has been identified by staff as a loss-prevention concern:

• An internal alias or label (not necessarily a legal name)
• General physical descriptors (e.g. approximate age group, gender)
• Photographs taken on the premises in connection with a specific incident
• Video recordings (for example, a clip filmed on a staff device or exported from store CCTV) added by staff in connection with a specific incident
• Notes describing observed behaviour or distinguishing features
• A record of incidents: date, description, and actions taken
• An internal status and, where applicable, a record that an access restriction has been applied
• For a small subset of these people only, biometric facial templates — up to five per person, each a mathematical representation of facial geometry generated from a picture a manager chose (a photo on their record or a still picture from the store's camera), used to power the automated camera alerts described below (a template is not a photograph and cannot be viewed as one)
• Automated detection records: the date, time, camera, and confidence score of each occasion the camera system matched a face against one of these facial templates

All records are required to be linked to a documented incident. Profiles are not created without a corresponding incident report.

Separately from the above, and in common with ordinary CCTV anywhere, the camera's view of the premises is recorded continuously and kept for approximately two days before being deleted automatically. This applies to everyone who passes in view of the camera, not only people on the register. No sound is recorded. See "Facial recognition and camera use" below for how that recording may be viewed, and "How long information is kept" for how long it lasts.

CCTV cameras at this location use facial recognition technology to help staff identify, in real time, individuals who have previously been the subject of a loss-prevention incident and added to this register. Notices are displayed at store entrances where this technology is in use.

How it works, in plain terms:

• Camera video is processed live, on a computer located on the premises. Each frame is analysed for a match and then discarded; the facial recognition process itself keeps nothing.
• Separately from that matching, the same on-premises computer keeps a rolling recording of the camera's view for approximately two days, so that a manager can review what happened around a loss-prevention incident. The recording is deleted automatically as it ages, oldest first, and no sound is recorded — picture only. This is ordinary CCTV recording; it is not facial recognition, and no face matching is performed on it.
• That recording stays on the premises. It is not uploaded anywhere and not continuously available over the internet. Only when a manager asks to review a particular moment is a short piece sent — over an encrypted connection, to private storage that is not publicly reachable, viewable only by the manager who asked for it, and deleted automatically about an hour later. Every such request is recorded in the audit log.
• Every face the camera detects is automatically compared against the small number of facial templates already enrolled in this register (see above). This comparison happens for everyone who passes in view of the camera, not just people already known to the business — this is an unavoidable part of how the technology checks for a match.
• If a face does not match anyone on the register, the facial recognition system creates no image, template, or record of that person. That detection is discarded immediately and is never seen by any staff member. (Like anyone else in view of the camera, that person will appear in the ordinary CCTV recording described above for about two days, and is then deleted with it — but no facial template is made and no identifying record is created.)
• If a face does match someone already on the register, the system creates a detection record (time, camera, and confidence score) and alerts staff, so they can decide whether any action is appropriate. It does not take any automated action itself (e.g. it cannot lock doors or contact police).
• A person is only ever added to the facial recognition register by a manager, following an existing loss-prevention incident — never automatically, and never based solely on a single camera detection.

Information is collected and held on the basis of the business's legitimate interest in protecting its property, staff, and customers from loss and harm. This is consistent with the Australian Privacy Principles under the Privacy Act 1988 (Cth), specifically APP 3 (collection of solicited personal information).

Biometric facial templates are treated by this business as sensitive information under APP 3.3, which attracts a higher standard of care than other personal information. Consistent with the exceptions available under APP 3.4, this business relies on the collection being reasonably necessary to prevent a serious threat to the safety of staff, customers, or property, and displays notices at store entrances so that any person entering the premises is aware that CCTV with facial recognition is in use. Facial templates are only ever created for individuals already the subject of a documented loss-prevention incident, never for members of the public at large.

Information is only collected where it is reasonably necessary for loss prevention purposes and is not collected by unlawful or unfair means.

Access is strictly limited to authorised employees of this business:

• Staff members may view profiles and incident records, submit new incident reports, add video recordings to a record, and see facial recognition alerts as they occur.
• Managers have additional authority to edit records, remove video recordings, manage staff access, enrol or remove a person's facial template, and review the audit trail.
• The rolling CCTV recording may be reviewed by managers only. Staff members cannot access it. Each occasion on which a manager reviews recorded footage, and each occasion on which a still picture is taken from it, is recorded in the audit log against that manager's name.

All access is authenticated. A complete audit log is maintained of every action taken within the system, recording who performed it and when — including every facial-recognition enrolment, removal, and alert acknowledgement.

Facial templates themselves are never displayed to any user of this system, including managers — the system only ever shows metadata (e.g. when each template was enrolled and how clear its picture was) and the picture each one was created from, never the underlying biometric data.

Cloud service providers process information needed to host, store, and monitor this system. Information may also be disclosed where required by law (e.g. a lawful request from a law enforcement agency).

All records, including photographs and video recordings added to this system, are stored in a private, encrypted database and file storage system. Photographs and videos are never accessible via public URLs. All access to them is performed through authenticated, time-limited server-side requests.

Some video recordings — typically very large camera exports — may instead be kept in this business's own Google Workspace shared drive. Access to that drive is limited to authorised staff, the files are not shared publicly, and this system stores only a link to each file.

The system is hosted on cloud infrastructure and is not accessible from outside the business without valid credentials.

Facial recognition matching is performed by a dedicated computer located on this premises. That computer holds the facial templates needed to perform live matching.

The same computer holds the rolling CCTV recording described above. That recording is kept on the premises on that computer alone — it is not copied to the cloud and not continuously available over the internet. Only a short piece that a manager has deliberately asked to review is sent off the premises, over an encrypted connection, into the same private storage described above; it is viewable only by the manager who requested it and is deleted automatically about an hour later.

Records are subject to an internal retention policy. Records that are no longer relevant to active loss prevention purposes are reviewed and, where appropriate, removed after a defined retention period. The retention policy is reviewed periodically to ensure it remains consistent with applicable privacy obligations.

Records relating to individuals who have been cleared of any concern are subject to shorter retention periods than records for ongoing cases.

The rolling CCTV recording held on the on-premises computer is kept for approximately two days and is then deleted automatically, oldest first. It is not archived, not backed up, and not retained beyond that period. The only way any part of it lasts longer is if a manager deliberately uses still pictures from it (at most five at a time) to create or update a profile or incident record — in which case only those pictures become part of that record and follow the retention rules for the record they belong to.

Video recordings added by staff to an incident follow the same retention policy as the rest of the record they belong to. A video removed by a manager is hidden immediately. Video files stored in this system are permanently erased when the related record is permanently deleted, and a manager deletes any linked video kept in the Google Workspace shared drive at the same time.

A biometric facial template is removed from active use as soon as a manager removes it or replaces it with a better picture, and all of a person's templates are removed as soon as they are taken off facial recognition — whether by a manager, because their access restriction is lifted, because their record is removed, or because they are recorded as under 18. The underlying biometric data itself is then permanently and irreversibly erased shortly afterwards — a short grace period is kept only to allow a manager to reverse an accidental change; it is not kept for any longer than that. Only the fact that a template previously existed (and when) is retained, for audit purposes — never the biometric data itself.

Under the Australian Privacy Act 1988 and the Australian Privacy Principles, you may have the right to:

• Request access to personal information held about you (APP 12), including whether any biometric facial templates have been created for you
• Request correction of personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13)
• Request that any biometric facial templates created for you be removed, where their retention is no longer reasonably necessary for loss prevention purposes
• Make a complaint if you believe your privacy rights have been interfered with

To make an access or correction request, to request removal of a facial template, or to lodge a privacy complaint, please contact the store manager directly.

If you are not satisfied with how a privacy concern has been handled, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.