Australia’s privacy watchdog has launched an investigation into retail giants Bunnings and Kmart over their use of facial recognition technology in some stores.

Consumer group Choice last month revealed Bunnings and Kmart were using the technology – which captures images of people’s faces from video cameras as a unique faceprint that is then stored and can be compared with other faceprints – in what the companies say is a move to protect customers and staff and reduce theft in select stores.

Choice reported the two companies along with The Good Guys to the Office of the Australian Information Commissioner (OAIC), raising questions over how people’s personal information was being handled through the technology.

The OAIC announced on Tuesday it had decided to launch an investigation into the personal information handling practices of Bunnings and Kmart in how they use the facial recognition technology in store, and whether it was consistent with Australian privacy law.

The Good Guys paused its use of the technology after preliminary inquiries from the OAIC and said at the time: “The Good Guys take the confidentiality of personal information extremely seriously and remains confident that the trial complied with all applicable laws.

“The technology was solely used to review incidents of theft, and for the purposes of customer and team member safety and wellbeing. The decision was made to pause the trial at this time pending any clarification from the OAIC regarding the use of this technology.”

Comment has been sought from Bunnings and Kmart.

Businesses are generally allowed to use CCTV to photograph customers on their premises, but Choice raised concerns that privacy law has not kept pace with advances in facial recognition technology.

Sign up to receive the top stories from Guardian Australia every morning

OREANDA-NEWS  Kmart said that personal information collected through the technology was kept private and protected in compliance with privacy law. Both Kmart and Bunnings said the stores with the technology had signage alerting customers to its use, and it was also mentioned in both companies’ privacy policies online.

Bunnings at the time said it disagreed with Choice’s findings.

“Our use is solely for the purpose of preventing threatening situations and theft, which is consistent with the Privacy Act.”

The company later told Electronic Frontiers Australia that the only images uploaded to the system were people who were banned from a store, or those who were “suspected of engaging in unlawful or threatening conduct”.

“The facial recognition technology checks for matches against these uploaded images, and where there isn’t a match then no action occurs,” Bunnings said. “No data relating to anyone other than these uploaded images are stored in the system.

“In recent years, we’ve seen an increase in the number of challenging interactions our team have had to handle in our stores and this technology is an important tool in helping us to prevent repeat abuse of team and customers.”

The Choice consumer data advocate, Kate Bower, said last month that businesses were rushing in to use the technology before Australians had been given a say on its use.