13 February 2026
6 min read
#Data & Privacy, #Digital Economy
Published by:
This month’s decision of the Administrative Review Tribunal (Tribunal) on Bunnings’ use of Facial Recognition Technology (FRT) provides important guidance for businesses using or considering FRT in Australia.
The Tribunal set aside the Privacy Commissioner's finding that Bunnings breached Australian Privacy Principle (APP) 3.3, regarding consent but otherwise confirmed that Bunnings acted in breach of APP 1.2, 1.3 and 5.1 which relate to privacy processes and notification of individuals.
While the Tribunal’s decision has been widely portrayed in the media as a victory for Bunnings (in terms of allowing it to use FRT), much of the original determination which found Bunnings breached its basic privacy obligations in terms of its privacy notices and policies and procedures was upheld.
The net result is that the application of the findings for use of FRT are limited to the unique circumstances of Bunnings’ operations, and others who can meet the relevant test for relying on an exemption not to obtain consent from customer.
Bunnings could have alerted customers to the existence of FRT before they entered stores and obtained their consent, but they relied on an exemption from this.
The Tribunal used an analogy to explain its finding, which in our view inferred that the Privacy Commissioner had wrongly determined that Bunnings was using a ‘sledgehammer’ (being its chosen FRT system) to crack a ‘nut’ (being retail crime, theft and violence).
The Tribunal found that the technological features of the FRT system minimised the intrusion on privacy by permanently deleting collected sensitive information and limiting its susceptibility to cyberattacks. The FRT system was therefore not so much a ‘sledgehammer’ or an overreach and that the extent of retail crime being faced by Bunnings’ staff and customers was more serious than the Commissioner had considered. Therefore, using this FRT system to combat retail crime was more akin to using a nutcracker to crack a big complex nut situation versus the overreach that the original decision concluded.
However, the Tribunal did also determine that Bunnings should have done more to notify individuals and comply with other obligations under the Privacy Act when using the technology.
The Tribunal’s decision provides helpful guidance for businesses using or considering FRT in their own operations, noting that some businesses will be able to support the same right to the exemption as Bunnings, but most others will need to obtain consent in circumstances where the use of FRT is reasonable. We outline some of the key lessons and practical takeaways we derive from the case below.
1. Meeting the threshold for collecting personal information without consent
To rely on the exception to needing consent for collecting sensitive information, a business must first establish that it has reason to suspect that unlawful activity, or misconduct of a serious nature, related to its functions or activities has been, is being or may be engaged in.
A relatively low bar is needed to establish the existence of unlawful activity. Both the original decision and the Tribunal agreed that the actual or threatened violence, abusive or harassing behaviour, and trespass by a prohibited person evidenced by Bunnings constituted conduct that could pose a risk to the health and safety of individuals in its stores and met the bar to establish that such activity was engaged in.
2. Ensure the response is necessary and proportionate
A business must then establish that it reasonably believed that the use of the information collected through, in this case FRT, is necessary to take appropriate action.
The use of FRT must not be a disproportionate and excessive response that goes beyond what is needed to solve the problem. Both decisions referred to extensive expert evidence. Businesses thinking of using FRT could obtain those expert opinions as part of a privacy impact assessment and build them into their policies from the start.
3. Consider whether FRT is the only option and the privacy impact
The Tribunal found that there was a serious problem with retail crime in Bunnings’ stores, with a significant proportion being committed by repeat offenders. Businesses wanting to implement FRT should consider:
4. Consider the unique circumstances of your operating environment
The Tribunal emphasised that Bunnings’ circumstances were significantly different from most other retailers. Its unique challenges in preventing theft and threatening situations included:
5. Ensure compliance with governance and notification requirements
The Tribunal also provided important guidance on compliance with APP 1.2, 1.3 and 5.1, which it confirmed Bunnings breached. These principles cover governance and notification requirements. Practical steps include:
Where collection of sensitive information represents a serious intrusion of privacy, businesses should conduct a formal, structured and documented risk assessment of the FRT system from the outset.
For Bunnings, the Tribunal said the steps taken amounted to random enquiries and actions which did not amount to an implementation of practices, procedures and systems relating to Bunnings’ functions or activities that would have ensured that it complied with the APPs.
If you are considering implementing FRT or similar technologies, have questions about the decision or need assistance with conducting a privacy impact assessment, please contact us here.
Disclaimer
The information in this article is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information, we do not guarantee that the information in this article is accurate at the date it is received or that it will continue to be accurate in the future.
Published by:
