AI cameras at self-checkouts: what rights do consumers have?

After tobacconists, will self-checkouts at various retailers soon be equipped with cameras powered by artificial intelligence? The CNIL, the French authority responsible for protecting our privacy, published a series of recommendations on Tuesday, May 6th, aimed at retailers who wish to use these "smart" cameras for their self-checkouts – these are surveillance systems coupled with real-time image analysis software.

A section recalling "the rights of individuals" was also published. Since these devices are an infringement on freedoms, "any excessive surveillance" must be avoided, recalls the CNIL, which did the same for tobacco shops last March. This type of camera constitutes "a new mode of targeted surveillance during everyday acts," adds the independent authority.

Anomalies detected, which can trigger employee intervention

These cameras will in practice film the customer during their visit to the self-checkout – namely their gestures, their purchases, their hands, the scanning area, and the location where the purchases are placed once scanned. Like the smart cameras used during the Paris Olympics, the AI-powered surveillance devices will detect certain predefined events.

Here, the idea is to verify that each product is properly scanned before being placed in the shopping cart. The system can then detect an "anomaly" and ask you to "correct the situation." Otherwise, it can "trigger employee intervention," the CNIL describes in its recommendations.

However, during this capture, personal data is indeed collected. A customer's image—even with a blurred face—is indeed personal data, the capture of which must comply with the GDPR, the European regulation that protects personal data. As a result, brands that wish to deploy this type of device must comply with the obligations of this European regulation. On the consumer side, customers benefit from a series of rights.

Customer Information and Right to Object

Their image can be captured when passing through a self-checkout, but only if several conditions are met.

• The area recorded by the smart camera must first be limited, as well as the duration of the capture.
• Customers must be warned of this device. The information must be displayed in the store and on the self-checkout screen.
• The recorded images cannot be kept "for evidentiary purposes or to create a list of people who have been the subject of a report," explains the CNIL. They must only allow for the detection of an anomaly live.
• The data must be processed locally and not on the company's cloud, the authority recommends.
• Customers must be able to exercise "their right to object." Being able to pay at checkouts without augmented cameras is enough to meet this condition, only if "the checkout time" is not "substantially longer for people who have refused to use the augmented checkouts", specifies the CNIL.
• The system in question must be efficient and effective - if there are too many false positives, it must be set aside.

Be careful, the captured images can, in certain cases, be reused to "improve the algorithm" - therefore for training purposes of the artificial intelligence tool. But customers will be able to object, notably via a message to be checked or unchecked on the self-service checkout.

The independent authority recommends conducting, before any definitive deployment, "an experiment in real conditions, with an evaluation protocol."

Note that brands wishing to implement this type of system will have to demonstrate that less intrusive alternatives – such as random checks of shopping carts and receipts at the exit, RFID tagging of products or weighing scanned items – are not sufficient to limit thefts and attempted thefts.