The Federal Trade Commission (FTC) has prohibited Rite Aid from using facial recognition technology in its stores, claiming the retailer failed to implement reasonable security procedures and prevent harm to consumers. The FTC complaint said that from 2012 to 2020, store employees using this technology erroneously accused customers of wrongdoing based on “thousands” of false positive matches with a database of shoplifters and other troublemakers. The FTC also said these actions unfairly targeted Black, Asian, Latino and female customers.
This isn’t the first time Rite Aid has received an FTC order to enhance its data security; it happened in 2010, when the retailer had to pay $1 million to settle Department of Health and Human Services allegations that it failed to protect sensitive patient information.
“Rite Aid’s reckless use of facial surveillance systems left its customers facing humiliation and other harms, and its order violations put consumers’ sensitive information at risk,” said Samuel Levine, Director of the FTC Bureau of Consumer Protection in a statement.
In addition to the ban, the FTC has demanded that Rite Aid enhance its data security practices, including:
Advertisement
- Deleting, and directing third parties to delete images collected via the facial recognition system as well as any algorithms developed using the images;
- Notifying consumers when their biometric information is included in such a database;
- Providing “clear and conspicuous notice” to consumers about the use of facial recognition or other biometric surveillance technology; and
- Implementing a data security program that will be subject to independent third-party assessments.
The FTC complaint said that Rite Aid contracted with two companies to create a database of images of individuals considered to be “persons of interest” because the retailer believed they had previously engaged in, or attempted to engage in, criminal activity at one of its stores. The database included the individuals’ names and other information, such as criminal background data, and the retailer collected “tens of thousands” such images, “many of which were low-quality and came from Rite Aid’s security cameras, employee phone cameras and even news stories.”
A Rite Aid statement said that the company was “pleased to reach an agreement with the FTC and put this matter behind us,” but protested that “we fundamentally disagree with the facial recognition allegations in the agency’s complaint.” Rite Aid asserted that the “allegations relate to a facial recognition technology pilot program the Company deployed in a limited number of stores” and that Rite Aid had stopped using the technology in these stores more than three years ago, before the FTC’s investigation began.
The retailer’s statement also noted that the FTC settlement is subject to approval by the U.S. Bankruptcy Court overseeing its ongoing restructuring following its bankruptcy filing in October 2023.
