Automatically recorded images by security cameras of shoppers' faces have been shared among 115 supermarkets and convenience stores in the Tokyo metropolitan and another area as an antishoplifting measure, without customers' knowledge, The Yomiuri Shimbun has learned.
Although the images are used mainly to prevent shoplifting, experts and industry bodies say it is necessary to make clear rules because providing people's facial data to a third party could constitute an invasion of privacy.
The facial data in question was shared by 115 stores of 50 separate operators that have installed a shoplifting prevention system that a Nagoya-based software development company began marketing in October last year. The stores include major convenience stores operated by individuals under franchise contracts.
At these shops, security cameras film all customers' faces. If a person shoplifts or makes an unreasonable complaint at one of the stores, security camera footage of the person is processed into facial data with the recognition system and classified into categories such as "shoplifter" and "complainer."
They are then sent to the software firm's server to be recorded. The facial images themselves cannot be browsed from other stores.
Once registered on the digital blacklist, however, a warning is issued to the staff of other stores-in a way only the staff can notice-when the face recognition system installed at these stores detects the blacklisted person visiting their stores.
At these stores, stickers are placed within the stores to inform customers that "face recognition security cameras are installed." But customers are not informed that the stores are sharing the facial data.
Facial recognition-done through computer analysis of a person's face-is a type of biometric recognition system used to confirm identity, age or sex, along with other specifics of individuals. Unlike fingerprints or iris recognition systems, it can collect information on individuals' facial data when the subjects pass by security cameras. Facial recognition systems are known to identify a specific person with an accuracy rate of at least 99.9 per cent and are used to identify terrorists at such places as airports.
Under the Personal Information Protection Law, facial images filmed by security cameras are considered personal information. The law allows such images to be filmed when they are used for crime prevention, but sharing the facial data could be a violation of the law that bans providing personal information to third party without the person's consent.
Face data sharing could be a privacy invasion if the data is used for personal identification by relating it to his or her criminal records or buying history, for example.
Commenting on the facial data sharing, lawyer Yoichiro Itakura, an expert of personal information protection, said the data could be used in a way disadvantageous to customers as "stores can arbitrarily register specific shoppers as suspicious people, and they may then suffer unjust treatment at stores they have never visited before."
Itakura also pointed out, "Even when someone is erroneously registered [as a suspicious person], he or she won't be given an opportunity to complain about the mistake."
An official of the Nagoya software development firm said: "The system has no problems. We just responded to the needs of the stores, which is their need to prevent shoplifting."