In some stores across Estonia, security camera footage is also monitored by artificial intelligence, which analyzes shoppers' behavior patterns. However, the technology is not yet widely used.
Retailers around the world have begun adopting artificial intelligence to make it easier to detect shoplifting. Connecting AI to an existing video surveillance system typically does not require new cameras and the algorithm analyzes behavioral patterns that might go unnoticed by security staff.
While the use of AI to monitor people has raised privacy concerns, the law does not distinguish between footage monitored by a person and footage monitored by AI.
"The General Data Protection Regulation (GDPR) and other laws governing the processing of personal data are technology-neutral. This means the same principles apply regardless of the technology used. If data processing is lawful without artificial intelligence, it does not become unlawful simply because AI is used," the Data Protection Inspectorate explained.
The clearest legal boundary concerns real-time facial recognition. For example, stores are generally not permitted to use a facial recognition system that would alert security personnel when someone previously convicted of shoplifting enters the premises. As early as 2024, Estonian retailers identified facial recognition cameras as a potential way to catch repeat shoplifters, but the Data Protection Inspectorate pointed out that the law does not allow their use for that purpose.
Several retailers across Europe have disclosed that they use AI as part of their video surveillance systems. Among Estonia's largest retail chains, however, interest has been relatively limited, with only Prisma confirming that it uses artificial intelligence in this way.
Prisma using AI in surveillance since 2022
"Prisma uses artificial intelligence in its stores as a tool to support video surveillance, primarily to help identify potential anomalies in customer behavior and draw the attention of security staff to situations that require further review," said Alar Olup, head of security for the supermarket chain.
According to Olup, implementing AI has improved the detection of violations and made the security department's work more efficient. He said AI is particularly useful in situations where it is necessary to identify behavior that deviates from normal patterns.
"At the same time, the system does not make final decisions on its own as every finding generated by the program must be reviewed and validated by a person," Olup emphasized.
He added that modern video surveillance and security systems increasingly support AI integration, with some solutions offering more advanced capabilities than others.
The use of AI does not mean people will disappear from security work. "Human judgment is still required to confirm an incident. If necessary, a security employee must intervene, complete the required documentation and, in the event of a violation, hand over the case materials to the police," the security chief said.
Maxima did not specify to what extent it uses AI in its video surveillance systems.
The company's head of security said that shoplifting and the methods used to detect it involve internal procedures and confidential information that the company does not comment on publicly. "We use AI to identify shoplifting cases and anomalies in our systems related to purchases, cash handling and similar activities," said Jaanika Terasmaa, the company's sales and marketing director.
Rimi, Selver and Lidl do not rely on AI in video surveillance
Mariann Järvela, communications manager for Selver, said the retail chain keeps up with the solutions available on the market and has been introduced to such technologies, but has so far decided to continue using its conventional video surveillance system.
"When implementing solutions like these, companies must take current data protection requirements into account. They place clear limits on the use of technological measures," she said.
Rimi's head of marketing and communications, Madis Eesmaa, emphasized that the chain does not use AI systems in its video surveillance and has not tested them either.
Lidl has also not adopted AI for its video surveillance, though it has not ruled out doing so in the future.
"While our current security and surveillance systems already provide a consistently high level of safety for both customers and employees in our stores, we are always open to evaluating new technologies from local and international service providers. I would also add that, because Lidl is part of a large international network, it cannot be ruled out that such solutions will eventually be introduced here as well," said the company's security specialist, Arvo Parve.
Coop had not responded to ERR's request for comment by the time this article was published.
Data could end up in third countries
The Data Protection Inspectorate noted that many AI-based solutions currently on the market may transmit the data they process to third countries for further processing.
"In such cases, the requirements of the General Data Protection Regulation apply in the same way as they do to any other transfer and processing of personal data. If camera footage contains personal data, the data controller must ensure that the processing is lawful and that the rights of data subjects are protected. Depending on the solution being used, this may include permanently blurring faces before the data is transmitted or using other technical measures that reduce the possibility of identifying individuals," the Data Protection Inspectorate said.
--
Editor: Marcus Turovski