Brazilian retailer quizzed over facial recognition tech

Hering will have to explain whether its innovation experiments violate user privacy and consumer rights.

Brazilian clothing retailer Hering will have to clarify whether its experiments around the personalization of its in-store customer experience comply with requirements around privacy.

The company has launched a store in a shopping mall in Sao Paulo, dubbed "Hering Experience", where facial recognition technology monitors customer reactions to clothing items.

In addition, the space has sensors that identify customer preferences and record heat maps as consumers manifest interest in the available products.

Facial recognition out of control? Half of US adults have their faces on police databases

Facial-recognition databases used by the FBI and state police hold images of 117 million US adults, according to new research.

Read More

By using the technologies, Hering can map visitor profiles to customize product offerings based on their reactions and serve up personalized ads.

The Brazilian Institute of Consumer Protection (IDEC) has notified the retailer, who will be required to clarify details around customer data collection, storage, and treatment.

IDEC's main areas of concern are around consumer consent of data collection and also a potential violation of privacy rights since the technology in use at the store collects biometric data.

Such information is seen as sensitive by the yet to be enforced general data protection law. Even though the regulations are yet to be enforced, IDEC points out that the right to privacy is a constitutional right.

The institute is also concerned about how data is being stored, how it is treated and if it is being shared with third-parties. Hering did not respond to ZDNet's requests for comment.

Last year, IDEC launched a civil lawsuit against São Paulo subway operator ViaQuatro around the collection of passenger data for marketing purposes.

The institute argued the initiative was illegal as consumers did not consent to have their data collected and sought $24 million in damages, to go towards educational projects related to consumer rights under the new Data Protection Law, to be enforced in Brazil in 2020.