Australia’s Office of the Australian Information Commissioner (OAIC) has ruled that Kmart’s use of facial recognition in its stores was unlawful, finding that the retailer violated the country’s Privacy Act by collecting biometric data from customers without consent or proper notification.
Between June 2020 and July 2022, Kmart deployed facial recognition in 28 stores across Australia, excluding Tasmania and the Northern Territory. Cameras were positioned at store entrances and return counters to capture images of every customer. Those images were then compared against a database of individuals suspected of refund fraud. Kmart argued that it did not need consent from customers, asserting that its activities were covered by an exemption in the Privacy Act permitting data collection in cases of serious misconduct or unlawful activity.
The OAIC rejected that argument, stressing that facial templates constitute sensitive personal information under Australian law and require explicit consent. The regulator determined that Kmart failed to properly notify customers of the program, and that the indiscriminate capture of biometric data from all visitors represented a disproportionate interference with privacy. The OAIC also pointed to the availability of less intrusive measures for preventing fraud, concluding that the claimed benefits of the system did not outweigh the privacy risks.
As a result of the ruling, Kmart has been ordered not to reinstate the technology in its previous form and must publish a statement on its website within 30 days explaining its use of facial recognition and the findings of the regulator. The decision comes on the heels of a similar action against Bunnings, which was found to have breached privacy laws through the use of facial recognition in 62 of its stores. That case, which ID Tech previously covered when the OAIC opened its investigation, is currently under appeal.
The Kmart decision provides further clarity on the OAIC’s stance, reinforcing that the Privacy Act demands transparency, proportionality, and customer consent when biometric technologies are deployed. It also signals that regulators are prepared to scrutinize other businesses using similar systems, particularly when sensitive data is collected broadly and without adequate warning. The outcome builds on the trajectory established in the Bunnings case, underlining a growing regulatory insistence that retailers must balance security measures with fundamental privacy rights.
–
By Cass Kennedy
