The Administrative Review Tribunal of Australia has partially overturned the Office of the Australian Information Commissioner’s ruling that found hardware retailer Bunnings in breach of privacy law with its in-store facial recognition technology.
The Tribunal determined that Bunnings was entitled to rely on exemptions to consent requirements for the limited purpose of combating retail crime and protecting staff and customers from violence, abuse, and intimidation. However, the ART found Bunnings in breach of both transparency and notification clauses under Australian Privacy Principles.
“The Tribunal was satisfied that Bunnings was entitled to rely on exemptions to the requirement to obtain consent, for the limited purpose of combatting retail crime and protecting their staff and customers from violence, abuse and intimidation within their stores,” the decision stated.
Between November 2018 and November 2021, Bunnings operated facial recognition technology in one store as a trial before expanding to 62 stores in New South Wales and Victoria from January 2019. The Tribunal found that while Bunnings was not in breach of biometric data collection rules, the company failed to provide appropriate notice to individuals and should have completed a formal, structured, and documented risk assessment considering privacy implications.
This ruling represents a significant development in Australian privacy law’s treatment of retail facial recognition systems, establishing that crime prevention can justify biometric collection but not exemption from transparency obligations. The decision sets an important precedent for retail biometric deployment globally, balancing security needs against privacy requirements.
The finding contrasts with earlier regulatory actions against retail facial recognition, where privacy commissioners have taken harder lines on consent and transparency requirements for in-store surveillance systems.
Sources: OAIC, Inside Retail, Capital Brief
–
By the ID Tech Editorial Team
