Amazon is offering the future of convenient shopping through the use of its revolutionary 'Just Walk Out' technology.  On Thursday 4th March, Amazon opened its first Amazon Fresh store in London to provide shoppers with a new 'effortless' shopping experience.  The new technology removes the need for tills, eliminates long lines to pay for goods and theoretically increases the ease and efficiency of shopping but what are the privacy implications of a shopping experience built entirely on surveillance and tracking technology? 

What is Just Walk Out?

Just Walk Out uses a combination of technologies created by Amazon to facilitate a shopping experience where customers can enter a store, grab what they want and just walk out.  This new way of shopping can be summarised in four simple steps: 

  1. Scan a code on your phone when you enter the store; 
  2. When you pick something off the shelf, it is automatically added to your virtual cart;
  3. If you put something back on the shelf, it is automatically removed from your virtual cart; and 
  4. Once you have what you need, just leave the store.  

The technology that enables this till-less shopping was developed, according to Amazon, by leveraging the same type of technology used in self-driving cars: computer vision, sensor fusion, and deep learning algorithms.  Shoppers are closely tracked and monitored while moving around the store by hundreds of cameras, depth-sensors and weight sensors. 

What about your data? 

Amazon may have already rolled out similar technology in the US, with its Amazon Go stores, but the data protection law in the UK is different.  Amazon will have to clearly address concerns raised about the size of the 'personal data footprint' this type of service will create and demonstrate its compliance with the UK data protection principles. 

Under UK data protection law, Amazon must have a lawful basis to process the personal data of shoppers and must provide all shoppers with fair processing information.  Shoppers are entitled to know what personal data is collected, the purpose for which it is used and how it will be shared.  This may include information about the contents of their shopping cart (if associated with them), the individual's movements around the store, the number of times they attend the store, whether they visit with family (including processing children's personal data) and even the number of times an individual decides to pick up and return a food item from the shelf.  All this information can only be lawfully collected and processed in compliance with the data protection principles.    

The large amount of data collected to track and monitor shoppers must be used in a transparent and limited way.  Amazon has said that it will only associate information collected in-store with a customer's Amazon account for up to 30 days.  However, this doesn't provide clear guidance on how the information collected will be used during the 30 days or how it will be used once it is no longer associated with an individual's account.  For example, after 30 days will tracking data be deleted, used as pseudonymised data or fully anonymised (keeping in mind the ICO's warnings on data being truly anonymised).  If it is retained, for what purpose will it be used?  Amazon may be tempted to use the significant data collected to profile an individual based on their shopping habits and to use the profile for targeted advertisements.  This raises additional concern in relation to tracking and direct marketing rules under the Privacy and Electronic Communications Regulations. 

Commentary

Not only has Amazon opened its own 'Just Walk In' store, the tech giant has gone one step further and is offering its 'Just Walk Out' technology to other companies to install and use in their own stores.  While Amazon may not yet have made a dent in the UK grocery market, it certainly understands the commercial benefit of commoditising technology like 'Just Walk Out' and rolling it out across all retail stores.  However, businesses looking to use the 'Just Walk Out' technology in their stores should seriously consider the data protection implications of this technology and ensure they have appropriate safeguards and policies in place to protection shoppers personal data. 

While consumers are looking for convenience and efficiency from their shopping experience, there is also an increased awareness of data protection and cyber security risks among consumers.  Customers will only trust a new till-less shopping experience, with a 'big brother' feel of monitoring and tracking technology at its core, if they can be confident that their personal data is being processed in a fair, lawful and transparent manner.