Facial recognition and biometrics: lessons from the OAIC's retail determinations

Few privacy questions have had as much regulatory attention in Australia as facial recognition in shops. Over five years, the Office of the Australian Information Commissioner (OAIC) has made determinations against a convenience chain, a global image-scraping company, a hardware retailer and a department store. One of those determinations has now been reviewed by the Administrative Review Tribunal, and the OAIC has revised its guidance in response.

Read together, the decisions give a clear picture of how the Privacy Act 1988 applies to facial recognition and other biometric systems. They are directly relevant to any organisation considering video analytics, identity verification or access control that relies on people’s faces, not only retailers.

Why biometric information is sensitive

The Privacy Act defines sensitive information to include biometric information that is to be used for automated biometric verification or biometric identification, and biometric templates. A facial recognition system captures an image, converts it into a template and compares that template against a stored set. Both the images and the templates are sensitive information.

That classification matters because sensitive information carries stricter rules. Under APP 3.3, an organisation must not collect it unless the individual consents and the collection is reasonably necessary for its functions or activities, or an exception in APP 3.4 applies. As Commissioner Carly Kind put it in the Bunnings matter, “We can’t change our face.”

The earlier cases: 7-Eleven and Clearview AI

In October 2021 the OAIC found that 7-Eleven had interfered with customers’ privacy by collecting facial images through tablets used for in-store customer feedback surveys in 700 stores. The images were converted into faceprints to screen out non-genuine responses and to profile customer demographics. The Commissioner found breaches of APP 3.3 and APP 5.1, and that the business benefits did not justify the privacy impact.

In November 2021 the OAIC published its determination that Clearview AI had breached the Act by scraping facial images from the internet, including collecting sensitive information without consent and by unfair means, failing to notify individuals, and failing to ensure accuracy. Clearview was required to stop collecting images from people in Australia and to destroy those it held. Clearview sought review, then withdrew in August 2023, leaving the determination in place.

Bunnings: the determination

On 29 October 2024 the Privacy Commissioner determined that Bunnings Group had breached the Act through a facial recognition system operated with CCTV in 63 stores in Victoria and New South Wales between November 2018 and November 2021. The OAIC published the determination on 19 November 2024 and noted the system likely captured the faces of hundreds of thousands of people.

The Commissioner found that Bunnings collected sensitive information without consent (APP 3.3), did not take reasonable steps to notify individuals (APP 5.1), and did not have adequate practices, procedures and systems or a privacy policy that covered the collection (APP 1). She described the technology as “the most intrusive option” and said that “just because a technology may be helpful or convenient, does not mean its use is justifiable.” Bunnings was required not to repeat or continue the conduct.

Bunnings: the Tribunal’s decision

Bunnings sought review. On 4 February 2026 the Administrative Review Tribunal affirmed the findings that Bunnings breached APP 1 and APP 5. It found Bunnings had not given people adequate notice and should have completed a formal, structured and documented risk assessment that considered privacy implications.

The Tribunal set aside the APP 3.3 finding. It was satisfied that Bunnings could rely on exceptions to the consent requirement, but only for the purposes of combating retail crime and protecting staff and customers from violence, abuse and intimidation in its stores. The Tribunal also accepted the factors the Commissioner had identified for assessing whether an exception applies: whether the technology was a suitable and effective response, whether less intrusive alternatives existed, and whether its use was proportionate.

The OAIC’s updated guidance describes the factors behind that outcome, including the seriousness of the violence and theft involved, the lack of effective alternatives in large stores, and design features such as brief storage and deletion of non-matches.

Kmart

On 26 August 2025 the Commissioner determined that Kmart Australia had breached the Act by using facial recognition at 28 stores between June 2020 and July 2022 to identify people suspected of refund fraud. Kmart relied on the exception for suspected unlawful activity or serious misconduct. The Commissioner accepted there was suspected unlawful activity, but found the collection was not necessary and was disproportionate, given less intrusive alternatives and the impact on the many people whose faces were captured. Notices and privacy policies were also found inadequate. Commissioner Kind noted that the Bunnings and Kmart decisions “do not impose a ban on the use of FRT.” According to the OAIC, the Kmart matter is under review in the Tribunal, with hearings scheduled for early 2027.

The tests that decide these cases

Where consent is impracticable, an organisation must point to a permitted general situation. The two relied on in retail are a serious threat to life, health or safety, and suspected unlawful activity or serious misconduct. Each requires a reasonable belief that collecting the information is necessary. The OAIC’s guidance breaks necessity into three questions.

• Suitability. Will the system actually address the problem, allowing for accuracy limits, lighting and evasion?
• Alternatives. Have less intrusive options such as staff, guards, conventional CCTV, legal restrictions or police cooperation been genuinely considered?
• Proportionality. Do the benefits outweigh the privacy impact on everyone scanned? The OAIC says collecting everyone’s information is unlikely to be proportionate for minor conduct.

The OAIC describes a precautionary approach as required under Australian law, and stresses that each deployment must be assessed against the Act on its own facts. The Bunnings outcome turned on its evidence. It is not a template.

The role of a privacy impact assessment

The common thread in Bunnings and Kmart is the absence of structured, documented reasoning before deployment. The Tribunal’s APP 1 finding turned on it. The OAIC recommends a formal privacy impact assessment before any facial recognition deployment, separate assessments where sites have different risk profiles, and publication of the report or a summary.

Before you deploy biometrics or video analytics

Treat the decision as a governance decision, not a procurement one. Establish the specific harm, the evidence for it and the alternatives tried. Design the system to collect as little as possible and delete non-matches immediately. Require human verification of matches and test accuracy and bias. Name the technology and its purpose in notices at or before the point of collection and in the privacy policy. Keep accountability with the organisation, not the vendor, and revisit the assessment as the system and the risk change.

General information, not legal advice. Confirm how the Privacy Act applies to any proposed use of biometric technology with your legal adviser.