Brazilian clothing retailer Hering will have to clarify whether its experiments around the personalization of its in-store customer experience comply with requirements around privacy.
The company has launched a store in a shopping mall in Sao Paulo, dubbed "Hering Experience", where facial recognition technology monitors customer reactions to clothing items.
In addition, the space has sensors that identify customer preferences and record heat maps as consumers manifest interest in the available products.
By using the technologies, Hering can map visitor profiles to customize product offerings based on their reactions and serve up personalized ads.
The Brazilian Institute of Consumer Protection (IDEC) has notified the retailer, who will be required to clarify details around customer data collection, storage, and treatment.
IDEC's main areas of concern are around consumer consent of data collection and also a potential violation of privacy rights since the technology in use at the store collects biometric data.
Such information is seen as sensitive by the yet to be enforced general data protection law. Even though the regulations are yet to be enforced, IDEC points out that the right to privacy is a constitutional right.
The institute is also concerned about how data is being stored, how it is treated and if it is being shared with third-parties. Hering did not respond to ZDNet's requests for comment.
Last year, IDEC launched a civil lawsuit against São Paulo subway operator ViaQuatro around the collection of passenger data for marketing purposes.
The institute argued the initiative was illegal as consumers did not consent to have their data collected and sought $24 million in damages, to go towards educational projects related to consumer rights under the new Data Protection Law, to be enforced in Brazil in 2020.