It comes as an Australian senator warns of “a private surveillance state” driven by the soaraway success of Auror, the $500 million New Zealand company revolutionising retail crime fighting.
The developments follow widespread coverage of a shopping incident involving Ghahraman at the Royal Oak Pak’nSave in Auckland and a police investigation into the matter.
The Herald has since revealed Foodstuffs, which owns Pak’nSave, did not directly complain to police but recorded the incident involving goods worth less than $150 into the Auror retail crime platform along with around 20,000 other incidents each year.
It was also revealed police tried to introduce the allegation into Ghahraman’s High Court sentencing appeal over four shoplifting convictions in the weeks after it happened.
Auror has since confirmed police have access to incidents recorded in its crime surveillance platform, which claims to cover 90% of New Zealand retail shopping spaces, even if retailers have not lodged them as complaints.
Police have refused to answer questions about how they learned of the incident saying it is an ongoing investigation.
The office of Michael Webster, Privacy Commissioner, has told the Herald it was seeking more information from Auror, Foodstuffs and police.
In a statement, a spokesman said: “[The Office of the Privacy Commissioner] keeps a watching brief on data aggregation platforms like Auror that provide automated number plate recognition and CCTV surveillance services due to the high potential privacy risk.”
The spokesman said platforms such as Auror carried a risk around the accuracy of information entered into the platform, inappropriate access to that information, disclosure of information on the database and “the potential for significant adverse impacts to individuals”.
“The more personal data is brought together the greater the risk should a privacy breach – including employee browsing - occur. The Privacy Commissioner expects agencies providing or using these services to be able to provide assurance of their compliance with their legal obligations.”
The Auror network is a software platform that connects retailers that are members and allows staff at those stores to enter and upload information and imagery linked to suspected retail crime events. The system is intended to match details with other incidents, identifying those shoplifting or committing other retail crime.
The system also offers retailers a “check box” to complain to police, with data showing around 80% of retail crime matters are now reported through Auror. It does not operate live facial recognition.
The company launched in 2012 and was recently valued at about $500 million by the Australian Financial Review with a huge uptake in Australia, where it boasts coverage of 50% of retail space, and in the United States, where it has secured contracts with some of the world’s biggest retail chains.
Auror has also been subject to concern over the degree to which it intrudes on the privacy of others and its relationship with law enforcement.
In 2022, the Herald revealed police had invented crimes to get around Auror’s rules so officers could track cars using its automatic licence plate recognition system. The Herald also revealed police went into what Auror calls a “partnership” without carrying out a proper privacy assessment.
It has also been revealed that neither police or privacy officials have any idea how many CCTV cameras are linked to the Auror network.
In Australia, Senator for New South Wales David Shoebridge raised concerns about Auror after it was revealed Australian Federal Police had signed up to the system - like New Zealand police - without doing proper privacy checks.
The Office of the Australian Information Commissioner told the Herald it had opened an investigation into Auror in February 2024. It was not currently investigating the company but “have provided guidance to Auror to assist it in meeting its privacy obligations”.
The spokeswoman said the advice was “particularly as to whether the collection of personal information is necessary to its business and reasonable steps to notify individuals, or ensure awareness, of” the collection of people’s information.
Shoebridge, whose portfolios include digital rights and justice, told the Herald his concerns remained with systems similar to Auror shown to have issues with accuracy and confidentiality.
“One of the real dangers in this space about online data and facial recognition is this push by those who are trying to profit from it that it is inevitable, that we have to give up on any kind of privacy. That’s patently false. This is not inevitable.”
Shoebridge said Australians and New Zealanders “should be able to go about their daily lives without being secretly surveilled by private entities and the state”.
On Auror’s claim of covering 90% of retail space, he said: “It’s like a private surveillance state that is largely unregulated and would be tracking New Zealanders multiple times a day.”
An Auror spokesperson said Australian Federal Police carried out a “full privacy assessment” of Auror in 2023 “which gave them comfort to continue using the software”.
“Auror is committed to empowering retailers and law enforcement to improve public safety and keep our communities safe.
“Auror frequently engages with regulators and has done so for more than a decade - Auror will continue to work with the NZ Privacy Commission.”
David Fisher is based in Northland and has worked as a journalist for more than 30 years, winning multiple journalism awards including being twice named Reporter of the Year and being selected as one of a small number of Wolfson Press Fellows to Wolfson College, Cambridge. He first joined the Herald in 2004.
Sign up to The Daily H, a free newsletter curated by our editors and delivered straight to your inbox every weekday.