The privacy of shoppers signed up for Woolworths' new loyalty card Everyday Rewards has been questioned with the fine print revealing the supermarket can record licence plates, capture video and audio of customers and link them to membership numbers.

Tucked away under a privacy policy link in the terms and conditions of Everyday Rewards, it states the information gathered from customers includes not only full names, dates of birth and phone numbers but also images or audio recordings, IP address, email and other contact addresses.

Woolworths states video footage and audio recordings are used for security, theft prevention and safety purposes only.

Other information gathered online and in-store can be used so the supermarket knows "what, how and when you buy from us and your stated or likely preferences".

The Office of the Privacy Commissioner has voiced concerns and said part of the Privacy Act required agencies to be "open and transparent about what personal information they collect".

"This may require something more proactive than just putting it in deep in their privacy policy," the Office of the Privacy Commissioner said in a statement.

"Woolworths New Zealand needs to be able to explain that the steps they have taken to make sure people know about the collection of information through their loyalty programmes are 'reasonable in the circumstances'."

The Office of the Privacy Commissioner said people needed to be able to make informed decisions about whether they want to engage with services which are using their personal information - and that needs to be upfront.

The use of CCTV and audio capture came with great responsibility and the Office of the Privacy Commissioner said those who operated the recordings needed to be aware of how to manage privacy issues.

"We always recommend that agencies minimise the amount of personal information they collect. Any information that is collected should also be securely disposed of once it's no longer needed for the organisation's purpose," the office said.

If facial recognition or staff body cameras were used, signage alerting the shopper to the fact they were being filmed needed to be prominent in the store.

One Everyday Rewards customer said she "cut her card in half and put it in the bin" after reading the rights the consumer unwittingly gave to the company by signing up for the card.

The customer questioned how the information would be used and said she no longer felt comfortable using the card.

But a Woolworths spokesman said the supermarket took customer privacy and data security very seriously and was mindful of its obligations under the Privacy Act.

"Our privacy policy is easily accessible from a range of areas: there are privacy pages on both the Woolworths and Everyday Rewards websites, a direct link to the privacy policy upon registration for an Everyday Rewards membership and the policy is included in the first couple of paragraphs of both the online and EDR T&Cs," he said.

"There are also FAQs on the Woolworths Privacy Centre, which references video footage, audio and number plates as information collected."

The spokesman said the store was clear "that we may collect recordings through our store cameras, team safety cameras, and Automatic Number Plate Recognition system for safety and security purposes".

"We do not use video or audio footage for any other purpose."

Stores that had body-cam capabilities had signage, the man said, and the team would "verbally advise that it is being turned on".

There have been violent and aggressive attacks in stores in both Woolworths and Foodstuffs supermarkets, with both chains vowing to improve security measures to keep staff and customers safe.

One customer said he was not bothered too much with the recording of licence plates and CCTV footage - "I'm not planning on stealing anything or abusing anyone" - but questioned how the information was kept secure.

"If they have a file on each membership number and it comes up with a snapshot of the car and licence plate, your IP address, phone number and images or video of you at the self-checkout, I'd be pretty worried."

"But if that information only comes up if there is a serious crime, then I can understand the reasoning.

"They need to tell you you are being recorded though."

The man said if there was a data breach and the stored information was leaked, it "would not be a good look".

The man pointed to an IT oversight last week which saw Everyday Rewards customers cashing in by creating multiple accounts and sharing points to get vouchers.

The loophole was closed quickly by Woolworths, but not before people paid for booze for parties and were able to pay for hundreds of dollars in groceries.

The Woolworths spokesman said the data collected by Woolworths was secure and that only a small team had access.

"Our team is well versed in protecting the information we do hold," the spokesman said.

"Access to video footage is strictly controlled and limited to only those who need it. We also ensure that we partner with technology partners who have strict privacy and data controls in place."

- This story was originally published by the New Zealand Herald.