The Federal Trade Commission has reached a settlement with Rite Aid, banning the pharmacy chain from using facial recognition technology for the next five years, following charges that the company misused the biometric tech in hundreds of its stores.
The FTC said in a Dec. 19 announcement that from 2012 to 2020, Rite Aid used artificial intelligence-based surveillance to identify customers who have engaged in shoplifting and other problematic behavior in its stores. The tech erroneously identified some customers as shoplifters, prompting Rite Aid employees, in some cases, to follow customers around the store, search them, call police, and accuse them of shoplifting, the FTC said, adding that the false identifications disproportionately impacted people of color.
“Rite Aid’s reckless use of facial surveillance systems left its customers facing humiliation and other harms, and its order violations put consumers’ sensitive information at risk,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “Today’s groundbreaking order makes clear that the commission will be vigilant in protecting the public from unfair biometric surveillance and unfair data security practices.”
Rite Aid released a statement denying the allegations that it misused the technology.
“We respect the FTC’s inquiry and are aligned with the agency’s mission to protect consumer privacy. However, we fundamentally disagree with the facial recognition allegations in the agency’s complaint,” the company said. “The allegations relate to a facial recognition technology pilot program the company deployed in a limited number of stores. Rite Aid stopped using the technology in this small group of stores more than three years ago, before the FTC’s investigation regarding the Company’s use of the technology began.”
The FTC said in the announcement that it is closely monitoring the collection of biometric information by retailers. In May, the commission released a statement noting that the collection of biometric data “raises significant consumer privacy and data security concerns and the potential for bias and discrimination.”
“Consumers face new and increasing risks associated with the collection and use of biometric information,” the FTC said in May. “For example, using biometric information technologies to identify consumers in certain locations could reveal sensitive personal information about them such as whether they accessed particular types of healthcare, attended religious services, or attended political or union meetings. Large databases of biometric information could also be attractive targets for malicious actors who could misuse such information.”
The FTC’s announcement on Rite Aid revealed that the pharmacy chain contracted with two companies to create a database of “persons of interest” who engaged in or attempted criminal activity at one of its stores. That database included images and other information on tens of thousands of individuals. Those profiles resulted in thousands of false positive matches, according to the FTC.
The complaint added that Rite Aid failed to mitigate the potential risks the tech would have on customers based on their race and gender. It also failed to “test, assess, document, or inquire about the accuracy of its facial recognition technology before deploying it …”
The settlement is subject to approval by the U.S. Bankruptcy Court overseeing the company’s restructuring and the U.S. Federal District Court where the original FTC complaint was filed.