Australia's privacy watchdog puts Kmart and other glasses retailers on notice over a Chinese app maker

The regulator's own reading of the law puts the legal exposure in this case on one company. Retailers that sell smart glasses, and the companies that make them, "may not have any Privacy Act obligations if they do not collect any personal information with respect to those devices," Kind said ^[13]. "Instead, the entity providing the software at use in the device is likely to be the entity that collects and holds the information for the purpose of privacy law," she said ^[14]. Five companies received preliminary inquiries. One is under formal investigation ^[12].

The regulator has still put pressure on retailers. "We have written to the Australian Retail Council and to other retailers, putting them on notice that this company is under investigation," Kind said ^[7]. "Given the particular risks the OAIC has identified with the HeyCyan app, I would urge responsible retailers to consider whether it is appropriate to continue making these devices available," she said ^[8]. The federal government has decided against an import ban at this stage ^[9].

On Kind's account of the Act, the letter has no legal force. Her legal lever is against the software maker. The formal investigation lets Kind compel Shenzhen Qingcheng to provide information, and if the company keeps ignoring her she can seek a court injunction to limit the supply of its products ^[10]. It has ignored her so far. "The company did not respond at all to our multiple attempts to obtain information ... [and] did not even acknowledge receipt of our communications," she said ^[4].

In my view, a retailer that keeps the line is betting the supplier starts cooperating before a court acts on supply. The penalties at stake fall on the maker. "The Australian Privacy Act provides for really, really considerable monetary penalties in the form of $50 million per contravention ... and that can be applied per individual," Kind said ^[11]. By the ABC's account, Shenzhen Qingcheng could in theory face fines of hundreds of millions or billions of dollars if found to have interfered with Australians' privacy ^[19].

The vendor's assurances are contested. A legal representative for Shenzhen Qingcheng told the ABC that engineers had fixed the flaws it reported. Analysts at NSB Cyber and Abstract Shield found several improvements but said many fixes had not worked ^[20].

Kmart's own position is unclear. The glasses were gone from its website as of Wednesday, and the retailer had been approached for comment ^[15]. The Anko glasses had also sold out in August ^[16].

After the stocking decision, the next question is whether the law moves the risk. Kind said "the most substantial change will be the replacement of the 'reasonably necessary for an entity's functions and activities' test with a 'fair and reasonable' test" ^[17]. She said the new test "will require an entity to look at a range of factors, including the extent to which an individual had genuine choice in the collection of their personal information" ^[18]. That language addresses whoever collects the data. In the HeyCyan case, on this record, that collector is the software maker: it holds the legal exposure, and retailers carry the commercial exposure ^[13][14].