Say I implement facial recognition anti-fraud via an army of super-recognizers sitting in an office, watching the camera feeds all day (collecting the sensitive information into their brains rather than into a computer system). It'd be more expensive and involve employing staff (both the "technology of convenience" criteria. From a consumer perspective the privacy impact is very similar, but somehow the privacy commissioner would interpret this differently?
Maybe that is the point the privacy commissioner is trying to make, that collecting this information through an automated computer system is fundamentally different than collecting this information through an analog/human system. But I'm not sure the line is really so clear...