Tribunal Partially Reverses Privacy Finding on Bunnings Facial Recognition
Australia's Administrative Review Tribunal partially overturned a 2024 privacy commissioner ruling against Bunnings, finding the retailer could use facial recognition to combat retail crime despite privacy concerns. The tribunal agreed Bunnings failed to properly notify customers about facial scanning but rejected the finding that the technology breached privacy rights.
What happened
The Administrative Review Tribunal reversed a November 2024 ruling by the Office of the Australian Information Commissioner that found Bunnings breached privacy by scanning customer faces in stores.
Bunnings deployed facial recognition in 62 stores across New South Wales and Victoria between January 2019 and November 2021, following a two-month trial in 2018. Customer facial images were scanned and compared against a database of hundreds of banned individuals, with images deleted if no match was found within four milliseconds.
Reported impact
Hundreds of thousands of people had their faces scanned without their knowledge during the trial period.
Index analysis
The tribunal found Bunnings was entitled to use facial recognition for the limited purpose of combating retail crime and protecting staff and customers from violence, abuse and intimidation.
The tribunal agreed with the privacy commissioner that Bunnings failed to properly notify customers about facial scanning, finding general video surveillance signage was insufficient. The tribunal determined Bunnings did not comply with Australian Privacy Principles in its notification practices.
Governance controls
The tribunal found the limited impact on privacy was not disproportionate when weighed against safety benefits, and that a permitted general situation existed for collecting facial information for retail crime prevention without customer consent.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.