Australia’s hardware giant Bunnings has secured a landmark legal victory that clears the way for biometric surveillance in retail stores.
The Administrative Review Tribunal overturned a 2024 privacy breach ruling on 4 February 2026. The decision permits Bunnings to deploy facial recognition technology for crime prevention, despite earlier findings by Privacy Commissioner Carly Kind that the retailer violated customer privacy laws.
The ruling marks a turning point for Australian retail security. It sets a precedent that could reshape how major chains protect staff and customers from violent crime.
The Technology Behind the Controversy
Between November 2018 and November 2021, Bunnings tested facial recognition tech across 63 stores in Victoria and New South Wales.
The system, developed by Japanese tech firm Hitachi, scanned CCTV footage of customers entering stores. It compared faces against a database of “enrolled individuals” flagged for theft, fraud, or threatening behaviour.
Here’s how the technology worked:
- Cameras captured facial images at store entrances
- System converted images to mathematical vectors in milliseconds
- Software compared vectors against database of known offenders
- Staff received alerts only when matches were detected
- Unmatched data was deleted within 4.17 milliseconds
The database included hundreds of individuals who had previously engaged in violence, organised retail crime, or other criminal conduct at Bunnings stores.
Tribunal Finds Crime Prevention Justifies Tech Use
The Administrative Review Tribunal ruled that Bunnings faced “very significant retail crime” warranting enhanced security measures.
Evidence presented to the tribunal painted a stark picture of retail violence. A Box Hill store manager reported confronting threatening or abusive behaviour every two to three days. Staff were left “visibly shaken and upset” after incidents.
Alexander MacDonald, Bunnings’ national investigations and security manager, testified that threatening situations were “the worst it has ever been.”
The tribunal accepted that Bunnings’ store environment created unique security challenges. Multiple entry and exit points combined with readily available items that could be used as weapons justified targeted security responses.
Bunnings calculated that 66 per cent of theft losses each financial year came from just 10 per cent of offenders.
The tribunal concluded: “Bunnings was entitled to use FRT for the limited purpose of combating very significant retail crime and protecting their staff and customers from violence, abuse and intimidation within their stores.”
Privacy Failings Still Found
While approving the technology’s use, the tribunal identified serious privacy compliance failures.
Bunnings breached Australian Privacy Principles by:
- Failing to provide appropriate notice to customers
- Not completing formal, structured risk assessments
- Leaving gaps in privacy policy documentation
- Inadequate disclosure of information collection practices
The Office of the Australian Information Commissioner welcomed aspects of the ruling. The regulator emphasised that even momentary collection of personal information counts as collection under Australia’s Privacy Act.
An OAIC spokesperson stated: “Today’s decision confirms the Privacy Act contains strong protections for individual privacy that are applicable in the context of emerging technologies.”
The commissioner’s office is carefully considering the decision and may appeal.
Bunnings Responds to Ruling
Managing Director Mike Schneider acknowledged the tribunal’s feedback on privacy practices.
“Our intent in trialling this technology was to help protect people from violence, abuse, serious criminal conduct and organised retail crime,” Schneider said.
“The tribunal recognised the need for practical, common-sense steps to keep people safe. It also identified areas where we didn’t get everything right, including around signage, customer information and our privacy policy, and we accept that feedback.”6
Michael Schneider, Managing Director at Bunnings Group Limited [LinkedIn]
The company has committed to improving customer notification, signage, and internal processes.
Broader Industry Implications
The ruling could trigger widespread adoption of facial recognition across Australian retail.
Major chains including Woolworths, Coles, JB Hi-Fi, and Harvey Norman are expected to evaluate similar security deployments. Consumer advocacy group Choice first exposed the practice in 2022, revealing that Kmart and The Good Guys had also used facial recognition tech.
The Australian Retail Council welcomed the decision. Chief Executive Chris Rodwell called it “a positive step forward in combating retail crime.”
“Facial recognition software could play an important role in protecting workers and customers from serious harm when used properly and transparently,” Rodwell said.
The sector has grappled with escalating retail crime. Bunnings reported abusive and threatening encounters increased 50 per cent year-on-year during the trial period.
Privacy Groups Sound Alarm
Digital Rights Watch strongly opposed the tribunal’s decision.
Tom Sulston, the group’s head of policy, called for an outright ban on facial surveillance in retail and other settings.
“(The finding) clearly goes against community expectations,” Sulston said. “Australians want and deserve clear and enforceable laws that meet our expectations. It is time for law makers to act.”
Eddie Major, AI Learning and Teaching Coordinator at Adelaide University, described the ruling as a dangerous precedent.
“This is the wedge – mass biometric surveillance without consent is now lawful in Australia for preventing crime,” Major said in a LinkedIn post.
He warned that other businesses were already employing facial recognition unlawfully, particularly gambling venues using the technology to recognise high-value customers.
Major predicted the scope would grow “with deployment of systems designed to predict behaviour and intent, based on inference of visual attributes, and extract maximal commercial value accordingly.”
Legal Framework for Retail Biometrics
The tribunal’s decision establishes clear parameters for lawful biometric surveillance in Australia.
According to legal analysis from Holding Redlich, the Privacy Act does not impose a blanket prohibition on facial recognition technology. Its lawful use depends on:
- Reasonable suspicion of unlawful activity
- Proportionate response to identified risks
- Appropriate system design to minimise privacy impacts
- Formal risk assessment of privacy implications
- Transparent notification to affected individuals
The ruling provides guidance on proportionality assessments. The tribunal considered the seriousness of harm being addressed, the limited purpose of technology deployment, and privacy mitigation measures built into system design.
Businesses seeking to deploy similar systems must substantiate risks, demonstrate why biometric collection is warranted, and ensure privacy policies accurately reflect technology operations.
What Happens Next
Bunnings can continue using facial recognition technology provided it addresses the tribunal’s privacy concerns.
The company must:
- Improve customer notification about data collection
- Update privacy policies with detailed information practices
- Implement formal risk assessment procedures
- Enhance signage explaining technology use
The OAIC has not ruled out an appeal. The regulator has emphasised that even fleeting data collection triggers privacy obligations.
Other retailers will likely move forward with deployment plans. The decision provides legal certainty that has been absent since consumer groups first exposed the practice in 2022.
Legislative reform could emerge if privacy concerns escalate. Digital rights advocates are pressing lawmakers to establish clear boundaries for biometric surveillance in commercial settings.
The balance between security and privacy will remain contentious as Australian businesses increasingly adopt AI-powered technologies across multiple sectors.
Global Context for Facial Recognition
Australia’s approach contrasts with stricter regulations in Europe and parts of the United States.
The European Union’s AI Act imposes significant restrictions on biometric surveillance in public spaces. Several US states have enacted bans or limitations on facial recognition use by both government and private entities.
China has embraced widespread facial recognition deployment, raising international concerns about surveillance overreach.
The UK recently announced increased use of facial recognition technology for law enforcement, including mobile vans scanning public spaces.
Australia now joins jurisdictions that permit commercial use of facial recognition for security purposes, though with privacy safeguards.
Also Read: Capstone Copper Ends Strike at Chile’s Mantoverde Mine with Three-Year Agreement
The Technology Debate Continues
The Bunnings ruling won’t settle the facial recognition debate.
Proponents argue the technology provides necessary protection for retail workers facing unprecedented levels of abuse and violence. They point to research showing 90 per cent of consumers support facial recognition use in stores for crime prevention.
Critics warn of mission creep and potential for mass surveillance without meaningful consent. They question whether less intrusive alternatives received adequate consideration.
The tribunal’s finding that data collection occurs even when images are deleted in milliseconds has significant implications. This interpretation means virtually any camera-based system that processes facial data triggers privacy obligations.
As AI continues transforming Australian retail and financial services, courts and regulators will face ongoing challenges balancing innovation, security, and privacy.
The Bunnings decision provides a framework, but not a final answer, to one of the defining technology questions of our time: where should the line be drawn on biometric surveillance in everyday life?
