Bunnings Warehouse Privacy Breach Ruling Over Facial Recognition
The Australian Information Commissioner found that Bunnings Warehouse breached privacy law by using facial recognition technology in over 60 stores to scan hundreds of thousands of shoppers without consent between 2018 and 2021. The company collected sensitive biometric information without proper notification or privacy policy disclosure, though it argued the system was designed to identify and remove individuals banned for violent behaviour. Bunnings said it would challenge the finding.
What happened
The Office of the Australian Information Commissioner (OAIC) announced on Tuesday that Bunnings Warehouse breached the Privacy Act by using facial recognition technology in 63 stores across Victoria and NSW from November 2018 to November 2021.
The system scanned the faces of hundreds of thousands of individuals without consent, failed to notify people their personal information was being collected, and did not include required information in its privacy policy. Bunnings argued the technology was used solely to identify and remove individuals banned for violent and abusive behaviour, with data on non-matching individuals deleted in under a second.
Reported impact
The facial recognition system collected sensitive information—a person's face—in breach of the Privacy Act from approximately 62 to 63 stores, affecting hundreds of thousands of shoppers who had no knowledge their biometric data was being captured.
Index analysis
The Privacy Commissioner acknowledged Bunnings may have had well-intentioned efforts to address unlawful activity and recognised the potential of facial recognition technology to protect against crime and violent behaviour. However, the Commissioner found that good intentions do not justify collection of sensitive personal information without consent or adequate notice.
Governance controls
Bunnings stated the facial recognition system had strict controls around its use and that electronic data of the vast majority of people was processed and deleted in 0.00417 seconds unless matched against a database of banned individuals. The company said customer privacy was never at risk and the electronic data was never used for marketing purposes or to track customer behaviour.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.