Wegmans’ use of facial recognition technology in stores raises questions

Rochester, N.Y. (WHAM) — Questions are swirling around Wegmans after signs posted in several New York City locations revealed the grocery chain is using biometric technology in some of its stores.

The signage, which is required under New York City law, alerts customers that biometric data may be collected on the premises. That data can include facial recognition technology and, in some cases, other biometric identifiers. The disclosures have sparked renewed concerns about consumer privacy, how such data is stored and how it may be used.

A cybersecurity expert says the technology itself is not new, but public awareness is.

“It’s always been out there, but now with privacy concerns at an all-time high, we’re more concerned,” said Jonathan Weissman, a principal lecturer in the Rochester Institute of Technology’s department of cybersecurity.

Wegmans’ use of facial recognition technology came to light after the required notices were spotted at its Brooklyn store. New York City mandates that businesses disclose the use of biometric data collection to customers.

Weissman said biometric systems are commonly used for authentication and identification purposes.

“Biometrics is great today for authentication, proving that somebody is who they claim they are,” Weissman said.

In a statement to 13WHAM, Wegmans confirmed it uses facial recognition technology in its grocery stores.

At Wegmans, the safety of our customers and employees is a top priority. Like many retailers, we use cameras to help identify individuals who pose a risk to our people, customers, or operation. In a small fraction of our stores that exhibit an elevated risk, we have deployed cameras equipped with facial recognition technology. In New York City, we comply with local requirements by posting the mandated signage to notify customers about the technology.

This technology is solely used for keeping our stores secure and safe. The system collects facial recognition data and only uses it to identify individuals who have been previously flagged for misconduct. We do not collect other biometric data such as retinal scans or voice prints. Images and video are retained only as long as necessary for security purposes and then disposed of. For security reasons, we do not disclose the exact retention period, but it aligns with industry standards.

Persons of interest are determined by our asset protection team based on incidents occurring on our property and on a case-by-case basis, by information from law enforcement for criminal or missing persons cases. We do not share facial recognition scan data with any third party.

We understand concerns about fairness and bias in facial recognition systems. We employ a multitude of training and safety measures to help keep people safe. Facial recognition technology serves as one investigative lead for us. We never base our decisions on a single lead alone.

Our goal is simple – to keep our stores safe and secure.

Weissman said facial recognition systems typically rely on databases of known individuals who may pose a risk.

“Generally, there’s a database of common criminals who might at some point enter the store, where awareness would be heightened at those moments,” he said.

Despite the security rationale, Weissman cautioned that biometric data carries inherent risks if breached.

“If your password is stolen, you can change it,” he said. “If your credit card is stolen, you can get a new one. If your biometric data is stolen, you can’t change your face and you can’t change your hands.”

Ultimately, Weissman said the decision comes down to consumers.

“What these companies are doing is not illegal,” he said. “It’s up to you whether you feel comfortable enough to shop in those stores.”